Jensen IT Notes
Back to projects

Documented lab

Active Directory Lab in Proxmox

I built this lab to practise the Windows domain tasks that often sit behind account, access, and desktop support tickets.

Overview

Why I built it

Build a small Windows domain and practise the account, access, policy, and client checks behind common desktop support tickets.

Lab environment

Proxmox VE hosts a Windows Server 2025 domain controller and a Windows 11 client. OPNsense separates the lab network.

What I configured

AD DS and DNS, users, groups, OUs, a domain-joined client, shared folders, NTFS permissions, mapped drives through Group Policy, password and lockout policies, delegated administration, and Remote Assistance.

Topology and workflow

How the work is organized

  1. 1 Build the Windows Server and Windows 11 virtual machines in Proxmox
  2. 2 Install AD DS and DNS, then promote the server to a domain controller
  3. 3 Create OUs, groups, users, shared folders, and Group Policy settings
  4. 4 Join CLIENT01 to lab.local and verify domain sign-in and policy application

Troubleshooting

Problem encountered

The domain-join tests made the DNS dependency clear: reaching the server by IP was not enough. The client had to use the domain controller for DNS before the domain name and sign-in worked correctly.

Checks, findings and fixes

Domain join depends on DNS

Problem
A client may reach the domain controller by IP but still fail to locate lab.local.
Check
Compare IP connectivity with a ping to lab.local and review the client preferred DNS server.
Finding
Active Directory name resolution requires the client to use the domain controller at 10.10.10.10 for DNS.
Fix
Set the client preferred DNS server to the domain controller before attempting the domain join.
Verification
The client resolved lab.local, joined the domain, restarted, and returned the domain account with whoami.

Resolution

I corrected the client DNS settings, verified name resolution, joined the client, refreshed policy with gpupdate, and confirmed the mapped Sales drive from the user session.

Verification

  • CLIENT01 joined lab.local and accepted a domain user sign-in
  • whoami returned the expected domain account
  • The Sales drive appeared after gpupdate in the intended user session
  • Password, lockout, delegated admin, and Remote Assistance tasks were checked in their target scope

What I learned

Many Active Directory support problems are really DNS, policy scope, or permission problems. Share permissions and NTFS permissions also have to be checked together.

GitHub repository

The repository contains the complete lab documentation, configuration notes, verification steps, and original screenshots.

View the complete lab and screenshots on GitHub