🏠 Active Directory Home Lab

A hands-on Active Directory security and penetration testing lab built from scratch using VMware, Windows Server 2022, and PowerShell — following John Hammond's Active Directory series.

---

📋 Lab Overview

Field	Details
Platform	VMware Workstation Pro 17
Domain	xyz.com
Domain Controller	DC1 — Windows Server 2022 Core
Workstation	WS01 — Windows 11 Pro N
Network	NAT — 192.168.15.0/24
Purpose	Learning AD security & penetration testing
Status	In Progress

---

🖥️ Lab Architecture

Host Machine (AMD Ryzen 7 7445HS)
└── VMware Workstation Pro 17 — NAT Network: 192.168.15.0/24
    ├── DC1   Windows Server 2022 Core   192.168.15.155 (Static)
    │         Roles: AD DS, DNS, Kerberos
    │
    └── WS01  Windows 11 Pro N           192.168.15.132 (DHCP)
              Joined to xyz.com
              DNS → 192.168.15.155

---

📚 Chapters

#	Title	Status
Chapter 0	Creating Our Server + Workstation Virtual Environment	✅ Complete
Chapter 1	Joining a Home Lab Domain (Installing the Domain Controller)	✅ Complete
Chapter 2	Automating Domain Users & Groups	✅ Complete
Chapter 3	Random Users & Weak Passwords	✅ Complete
Chapter 4	Tearing Down the Domain Controller	✅ Complete
Future	BloodHound Enumeration	🔜 Upcoming
Future	Kerberoasting	🔜 Upcoming
Future	Pass-the-Hash / Pass-the-Ticket	🔜 Upcoming
Future	Golden Ticket Attack	🔜 Upcoming
Future	Privilege Escalation in AD	🔜 Upcoming

---

🌐 Domain Info

Field	Value
Domain Name	xyz.com
NetBIOS Name	XYZ
Forest	xyz.com
Domain SID	S-1-5-21-1327692051-1775273641-3263256819
PDC Emulator	DC1.xyz.com
DNS Root	xyz.com

Domain Computers

Computer	Role	IP
DC1	Domain Controller	192.168.15.155
DESKTOP-8TCVO2K	Workstation (WS01)	192.168.15.132

Domain Users

Username	Full Name	Group	Status	Added In
Administrator	—	Domain Admins	Enabled	Chapter 1
Guest	—	—	Disabled	Chapter 1
krbtgt	—	—	Disabled	Chapter 1
~100 random users	Various	Various random groups	Mixed (see Ch3/Ch4)	Chapter 3

Note: Chapter 2 users (alice, bob) were removed when DC1 was reverted to a clean snapshot before Chapter 3. Chapter 4 introduced a full teardown workflow — all random users and groups can now be cleanly removed via gen_ad.ps1 -Undo.

Domain Groups

Group	Scope	Added In
Domain Admins	Global	Chapter 1
DnsAdmins	Domain Local	Chapter 1
Employees	Global	Chapter 3
Engineers	Global	Chapter 3
Lawyer	Global	Chapter 3
Managers	Global	Chapter 3
Developers	Global	Chapter 3
Student	Global	Chapter 3
Executives	Global	Chapter 3
+ 3 more random groups	Global	Chapter 3

Note: All Chapter 3 random groups are removed when gen_ad.ps1 -Undo is run. New random groups are generated each rebuild.

---

🧰 Tools Used

Tool	Category	Chapters
VMware Workstation Pro 17	Virtualization	0, 1, 2, 3, 4
Windows Server 2022	OS	0, 1, 2, 3, 4
Windows 11 Pro N	OS	0, 1, 2, 3, 4
PowerShell	Scripting / Mgmt	1, 2, 3, 4
sconfig	Server Config	1
AD DS Role	Active Directory	1
PS Remoting	Remote Mgmt	1, 2, 3, 4
JSON Schema	IaC / Config	2, 3, 4
secedit	Security Policy	3, 4
Get-Random / ArrayList	PS Random Selection	3
BloodHound	AD Enumeration	🔜
Impacket	AD Attacks	🔜
PowerView	AD Enumeration	🔜

---

📁 Repository Structure

active_directory/
├── README.md
├── code/
│   ├── data/
│   │   ├── first_names.txt
│   │   ├── group_names.txt
│   │   ├── last_names.txt
│   │   └── passwords.txt
│   ├── ad_schema.json            ← Chapter 2: Static schema
│   ├── gen_ad.ps1                ← Chapter 2–4: AD object creation + teardown script
│   ├── out.json                  ← Chapter 3–4: Generated random schema
│   └── random_domain.ps1         ← Chapter 3: Random schema generator
└── Chapters/
    ├── Chapter-0/
    │   ├── README.md
    │   └── screenshots/          (13 screenshots)
    ├── Chapter-1/
    │   ├── README.md
    │   └── screenshots/          (12 screenshots)
    ├── Chapter-2/
    │   ├── README.md
    │   └── screenshots/          (8 screenshots)
    ├── Chapter-3/
    │   ├── README.md
    │   └── screenshots/          (11 screenshots)
    └── Chapter-4/
        ├── README.md
        └── screenshots/          (10 screenshots)

---

📌 Resources

Resource	URL
John Hammond YouTube	https://www.youtube.com/@_JohnHammond
Microsoft AD Documentation	https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/
Microsoft Evaluation Center	https://www.microsoft.com/en-us/evalcenter/
VMware Workstation	https://www.vmware.com/products/workstation-pro.html