I built a small enterprise Windows domain in VMware centered on SRV-DC01, a Windows Server 2022 Domain Controller, and CLIENT01, a domain-joined Windows 11 workstation. The environment includes AD DS, DNS, departmental OUs, Group Policy, AGDLP authorization, and secured SMB resources.
I then treated the domain as a security environment: enabling role-specific telemetry, investigating authentication and identity events, hardening password and SMB controls, and retesting the system to verify that security improvements preserved business functionality.
- Status Completed August 2026
- Domain kevinlab.local
- Systems SRV-DC01 + CLIENT01
- Evidence Architecture + testing + scripts
A domain environment built across identity, policy, and resources.
From domain services to tested authorization.
Enterprise Foundation
- Created the kevinlab.local domain and forest on SRV-DC01.
- Configured AD DS, DNS, departmental OUs, users, groups, and server networking.
- Validated NTDS, DNS, KDC, and Netlogon services.
Client and Policy
- Joined CLIENT01 to the domain and verified DNS discovery, Kerberos, and the secure channel.
- Placed the workstation in its intended OU and applied role-specific Group Policy.
- Confirmed policy scope with gpupdate and gpresult.
Authorization Testing
Implemented AGDLP and assigned share and NTFS permissions through resource groups. Cross-department tests proved that HR and Finance users could modify their own shares while unauthorized access remained denied.
Building visibility, then improving the baseline.
Security Telemetry
Created separate workstation and Domain Controller auditing policies for logons, process creation, account and group changes, command lines, and PowerShell Script Block Logging.
Event Investigation
Generated and investigated events 4624, 4625, 4688, 4720, 4726, 4728, 4729, and 4104, connecting each event to its actor, target, source system, and security control.
Identity Hardening
Reviewed highly privileged groups, kept departmental users separated from administrative roles, and raised the minimum domain password length from seven to 12 characters.
Host and SMB Hardening
Verified Windows Firewall across both systems, confirmed SMBv1 was disabled, retained modern SMB functionality, and required SMB signing for integrity protection.
A tested security environment with evidence behind every claim.
Problems Solved
Corrected CLIENT01's DNS configuration to restore domain discovery and used PowerShell to verify a group-membership change that did not persist through the GUI.
Controls Retested
Confirmed that domain services, authentication, Kerberos, departmental access, SMB sharing, and security logging remained operational after hardening.
Documented Evidence
Organized the architecture, configuration screenshots, access tests, event evidence, hardening assessment, troubleshooting notes, and useful commands in a public repository.