Build it
A domain controller with DNS, DHCP and file shares, plus Windows clients joined to the domain.
IT support homelab
The other side
of the reset button.
On the service desk I unlock accounts and reset passwords every day. I wanted to understand what actually happens on the server when I click that button, so I'm building a small company network from scratch and then breaking it on purpose.
company: NorthPeak
(it's made up)
(it's made up)
0test users
0break/fix incidents
0PowerShell scripts
0GPOs
Why this project
Tickets only show you
half the story.
A user calls, their account is locked, I unlock it and they're happy. Twenty minutes later it's locked again. The fix for that isn't in the ticketing tool, it's on the domain controller. This lab is where I learn that part.
Break it
Nine problems I've either seen on the desk or will see: lockouts, bad DNS, a dead DHCP server, a broken trust.
Write it up
Every fix becomes a ticket with timestamped work notes and a KB article a regular employee could follow.
The network
Small, isolated,
and on purpose.
The lab runs on its own virtual network so its DHCP server can never hand out addresses to my real devices. Only the domain controller has a second connection out to the internet. Click a machine to see what it does.
10.10.10.0/24 · isolated
Host / rangeAddressAssigned by
DC01
10.10.10.10StaticStatic range (servers, printers)
10.10.10.1 – .99ManualDHCP scope
10.10.10.100 – .200DHCPExclusion
10.10.10.100 – .109—WS01 reservation
10.10.10.150DHCP reservationScope options
003 · 006 · 015Gateway, DNS, domain name The directory
Laid out like the
retailers I've supported.
OUs decide which policies apply and who can manage what. Groups decide who can open which folder. Keeping those two jobs separate is the main thing I wanted to get right. Open the folders to look around.
Security groups
Named GS-<team>-<access> so you can tell what a group is for without opening it.
Share vs NTFS
The share is wide open to signed-in users. The real control happens in NTFS, through groups only. Over the network, whichever is stricter wins, which is exactly what incident #8 is about.
Group Policy
Who wins when
two policies disagree?
Policies apply in order: Local, Site, Domain, then each OU down the tree. The last one applied wins. Step through it with a setting that two policies fight over.
Desktop wallpaper on WS02 (store PC)
Windows default
Default Domain Policy
12-character passwords, lock after 5 bad tries for 15 minutes. Password rules only count when linked at the domain root.
Fine-grained password policy
Stricter rules for the adm.* accounts: 15 characters, lock after 3 tries.
U-Drive-Mappings
One GPO maps every department drive. Item-level targeting checks group membership, so access follows the group.
U-Stores-Desktop-Lockdown
No Control Panel or Settings for store staff, and the company wallpaper.
C-Stores-Removable-Storage
Blocks USB drives on store PCs. Computer settings only, so it follows the PC, not the person.
Why U- and C-?
U- GPOs hold only user settings, C- only computer settings. The unused half is switched off, so a setting in the wrong half is easy to spot.
Break / fix
Nine things I break
so I can fix them.
Each one is written up the way I'd log it at work: what the user said, what I checked, what I ran, the root cause, and whether Tier 1 could close it or had to escalate. Click a ticket to open it.
How priority is set
Impact is how many people are affected. Urgency is how soon it has to be fixed. Hover a cell. One cashier locked out is a P3; a whole store with no network is a P1.
Hover or tap a cell
PowerShell
Anything I click,
I also script.
Every step in the build guide has the GUI path and the PowerShell version. The onboarding script reads a CSV, puts each person in the right OU and groups, and forces a password change at first sign-in. It supports -WhatIf, because I always want a dry run first.
ActiveDirectoryGroupPolicyDnsServerDhcpServerSmbShareicaclsdsacls
Where it's at
Planned, documented,
now building.
The design, scripts, tickets and KB articles are written. I'm building it in Microsoft Azure now, on official Windows Server 2022 machines I manage from my Mac, and I'll add screenshots and real command output to the repo as each phase is done.
In the repo