Active Directory lab with policy and recovery checks

The goal

I wanted a small Active Directory environment that was structured enough to test policies properly, not just a server that could technically sign a user in.

The lab included a Windows Server domain controller for corp.local, organisational units for users and workstations, role-based groups, password policies, and baseline Group Policy Objects.

The decisions that mattered

DNS and time came first

The domain controller used itself for DNS. I also configured it as the reliable time source for the lab.

Both choices are easy to treat as setup details. They are not. Kerberos depends on correct name resolution and time, so either mistake can turn into login failures that look unrelated.

Policies followed the OU structure

I kept policies away from the domain root where possible and applied them to deliberate organisational units instead. That made the scope easier to reason about and reduced the chance of testing a rule against every account at once.

Admin passwords were handled separately

The default domain policy applies broadly. I used a fine-grained password policy for the admin group rather than making every account inherit the stricter rule.

What broke

The fastest failures came from incorrect DNS and time settings. Policy scope was the slower problem because the interface can look correct even when the expected policy never reaches a workstation.

I stopped trusting the configuration screen on its own and used command-line checks instead.

Checks I used

• Get-ADDomain and Get-ADForest for the domain and forest state
• gpresult /r to confirm which policies reached a workstation
• whoami /all to inspect group membership and privileges
• PowerShell scripts to create repeatable users and groups

Next pass

The lab still needs a second domain controller, System State backups, and a recovery runbook that has been tested rather than only written.