Windows Active Directory 101: A Beginner’s Guide and Home Lab Setup

13 min readJun 26, 2024

Unlock the power of Windows Active Directory with my beginner-friendly guide! Learn the basics of Windows Active Directory and get a comprehensive guide to configuring AD in your home lab, managing network resources seamlessly, and boosting security with centralized operations.

This step-by-step tutorial covers everything from installation to advanced configurations, making it easier than ever to master network management.

Active Directory is a directory service developed by Microsoft, included in most Windows Server operating systems. It allows administrators to manage permissions and access to network resources, ensuring that users and computers can securely interact within a domain network.

AD is used to manage Windows Domain networks and stores information related to objects such as computers, printers, users, etc.

Non-windows devices like linux, firewalls, etc. can also authenticate to AD via LDAP or RADIUS.

Which Type of Authentication is Used in Active Directory?

Active Directory (AD) authentication primarily uses the Kerberos protocol, which allows users to log in once with their credentials to access various resources. Instead of transmitting user credentials over the network, Kerberos generates a session key for the user, valid for a specific duration, providing secure and flexible authentication. Additionally, a token containing the user’s access rights and policies is created, ensuring that users can only access resources they are authorized to use.

The Purpose — Why to use AD?

Active Directory simplifies the administration and management of networked resources. Some of the use cases are:

Centralized Resource Management: AD allows administrators to manage all network resources from a centralized location, making it easier to maintain and secure the network.
Improved Security: AD enhances network security through its robust authentication protocols, such as Kerberos, ensuring that only authorized users can access specific resources.
Group Policy Management: AD allows the use of Group Policy Objects (GPOs) to enforce security settings and operational policies across the entire network, ensuring compliance with organizational standards.
Single Sign-On (SSO): Users can access multiple services and resources across the network with a single set of credentials, simplifying the user experience.
Most commonly used Identity management service across the globe.

What impact does AD create on organization’s IT infrastructure?

Streamlined Operations: AD simplifies complex network environments, reducing the likelihood of errors and making it easier to deploy and manage applications and services.
Enhanced Security Posture: AD’s comprehensive security features protect against unauthorized access and help organizations comply with regulatory requirements, thus reducing the risk of data breaches.
Increased Productivity: By automating and centralizing the management of network resources, AD reduces the time IT staff spend on routine tasks, freeing them to focus on strategic initiatives.

Domain Controller — Heart of AD:

A domain controller is a server with AD DS server role installed that has specifically been promoted to a domain controller. It does following:

Host a copy of the AD DS directory store.
Provide authentication and authorization services.
Replicate updates to other domain controllers in the domain and forest.
Allow administrative access to manage user accounts and network resources.

AD DS Data Store:

This contains the database files and processes that store and manage directory information for users, services, and applications. It consists of:

NTDS.dit (NT Directory Services Directory Information Tree) file is the database file used by Active Directory to store all directory information, which includes: User accounts and passwords, Groups and their memberships, Organizational units (OUs), Computer accounts, Security policies and permissions, Schema and configuration data, other directory objects.
It is stored by default in the %SystemRoot%\NTDS folder on all domain controllers.
It is accessible only through the domain controller processes and protocols.

Common Terminologies in AD

Active Directory Forest Example (Source)

AD Objects: These are the smallest fundamental units of Active Directory. Objects can be anything, such as users, groups, computers, routers, firewalls, printers, and so on.
Users: A user is a type of AD object. While most user accounts are assigned to individuals, some are designated for application use, known as service accounts.
Groups: Group objects are collections of user accounts, computer accounts, and others, which are used to simplify access controls (e.g., security groups).
Organizational Unit (OU): Administrators often use OUs to group users based on their functionalities or departments. OUs can also be used to group devices like computers, mirroring the organization's structure to easily apply relevant policies to each group.
Domain: It is a collection of AD objects, such as users, computers, groups, and OUs, that are stored in a shared database.
Forest: A forest is a set of one or more domains. Organizations can have a single forest or multiple forests based on their requirements and complexity.

Building Home Lab

Prerequisites:

1 Windows Server VM
1 Windows Workstation VM
50–60 GB disk space
8GB memory or more.

Downloading ISO:

Here is the download link to the Windows Server and Windows 10 Enterprise. Go ahead and download both ISOs and get back to start.

Click on Download the ISO and enter any random data for the registration process and then your download process should begin shortly.

Note: In this Lab, we will be using virtualized machines so if you don’t have VirtualBox installed, please click here and download the latest VirtualBox version.

VirtualBox Steps:

Click on New -> Enter name to distinguish your machine like windows workstation-1, windows server, and so on.
Select Skip Unattended installation and select processor power and storage as per your computer’s capacity.
After completing the steps, go ahead and start the VM.

Note: We’ll not be going in details on how to configure virtual machine in this blog as it will take too long.

After initial boot, enter the details like your region and time-zone.
Which type of installation do you want? Custom: Install Microsoft Server OS only
Select the operating system you want to install: Windows Server 2022 Standard Evaluation (Desktop Experience)

Click next and installation process will begin shortly. The windows will reboot and then you’ll be asked the password for the Administrator account.

For this lab purpose, I’ve used password Root@123.

Press ALT+CTRL+DEL to log in. If you’re unable to send key, Go to VirtualBox’s toolbar and open Input -> Keyboard -> Insert ALT+CTRL+DEL

Setting up the Domain Controller

Firstly, we would name the machine something different from the default name given.

Start menu -> Search for View your PC name -> Rename your PC.

As seen below, I have renamed my PC as Yogesh-DC because this will be our DC (Domain Controller) for the lab.

After changing the name, restart the machine.

Feature Installation — Active Directory Domain Services (AD DS)

Active Directory Domain Services (AD DS) are the core functions in Active Directory that manage users and computers and allow sysadmins to organize the data into logical hierarchies.

AD DS provides for security certificates, Single Sign-On (SSO), LDAP, and rights management.

Open Server Manager.
Click Manage option on the top right corner of the window.
Select Add Roles and Features.
A wizard will pop up named Add Roles and Features Wizard. Click Next.
Installation Type: Role-based or feature-based installation.
Server Selection: Select your machine name from the list.

Server Roles: We want domain services, so select the option titled Active Directory Domain Services (AD DS), and a pop-up will appear as shown below.

Click Add Feature and Select Next.
Features: Click next as this step does not require any additional things to do.
AD DS: Click Next.
Confirmation: Check the option Restart the destination server automatically if required.

Configuring DC — Promoting the server to DC

After installation, you can close the wizard and the Notifications in the command bar and then the task details

Click on Promote this server to a domain controller.
Deployment Configuration: Select Add a new Forest as currently we do not have any existing forest or domain.
Enter your desired domain name and click next. For this lab my domain name is: Yogesh.local

Configuring DC — Deployment Configuration

You can enter the same password we used before; Root@123. Click Next

DNS Delegations: Keep it as it is.
Additional Options: The NetBIOS domain name will be populated automatically and then click next.
Keep Paths and Review Options: Default. Click Next
Prerequisites Check: Click Install

After installation, the system will reboot once again.

Now, we’ll login with the new account we’ve created with the password we set earlier. In my case, the domain username was Yogesh\Administrator.

Routing and Remote Access — Implementing RAS/NAT in DC

Adding Role:

Here, we will configure a kind of private network through which our client machines will get internet access through our domain controller server and not directly from our Host OS. To do this, we will have to add another service/role in our DC.

Open Server Manager and click on Add Roles and Features Wizard, Click Next, Select your server then,

Server Roles: Remote Access
Features and Role Services: Check Routing
Keep the other settings default and install the Role.

We will come back to the configuration of the Routing after some Network changes.

Network Adapter Settings in VM

By looking at the network diagram, we can see that we need to setup an internal network which will work within the VM infrastructure.

The first step is to do is to add Network Adapter. In the Windows Server in which we’ve installed the DC, I’ve added two Network Adapters: NAT(default) and Internal Network. Go ahead and do the same.

After adding, restart the machine if required and then search for “Network and Internet” settings. Click on Change Adapter options as shown below.

As shown below, you’ll be seeing two interfaces but named differently. One would be for NAT and other for Internal Network. Now, a small task for you is to have identify which one is which.

After identifying, rename these network adapters as shown above like Internal (in which we’re going to configure DHCP and RAS) and Internet (which is connected through NAT).
Go ahead and right click on the interface named Internal and Click Properties. Double click on the Internet Protocol Version 4 (TCP/IPv4) as shown below.

After opening the IPv4 properties, select Use the following IP address and configure as shown below.

Here, we’ve set the DNS server’s IP address as 127.0.0.1 (loopback) as for our client machines, the IP addresses will be allocated through the DHCP service we implemented in the DC.
After configuring, click OK.

Configuration of Routing and Remote Access Service

After installing go to Tools -> Routing and Remote Access
Right click on your DC and click “Configure and Enable Routing and Remote Access”

After opening the Wizard, Click Next. In the Configuration, select NAT option.

Click Next and then Finish.

Now, the next step is to add DHCP service that will allow our client machines to get an IP address from the DC that the client machine will use to connect with the internet.

DHCP Configuration

Again go to Manage -> Add Role or Feature -> DHCP.
Keep the defaults as it is and install the service.

After installing, go to Tools -> DHCP and open it.

Now, right click on IPv4 and click on under your Domain and click New Scope.
As shown below, enter the desired scope name but I’ve kept the name as descriptive as possible. We will use the network range 172.16.0.100–200/24 as we’ve configured the same network range in our Internal network settings of DC previously.

Now, add the Start and End IP address ranges as below.

Click Next and Select “Yes, I want to configure these options now.”

Lease Duration: For this lab purpose, I’ve set the duration for 10 days that means the IP address assigned to the system will have lease of 10 days after which the IP will be changed.

Router: As explained before, our DC will act as our Router for our client machines so we will set the IP address of Router of DC that was 172.16.0.1.

Keep the defaults as it is in the Domain Name and DNS Servers.

Lastly, select “Yes, Activate this scope now.”

Post DHCP Install Configuration

From the notifications panel in Server Manager if you see option for Post DHCP Install Configuration, just authorize it.

Adding OU and Users

Here, we will create one OU named Network Admins and one user named John Doe from which we will login to our workstation machine. We will assign Admin rights to the user.

Hit windows key and Search for Windows Administrative Tools and open Active Directory Users and Computers.
Now, right click on our domain name -> New -> Organizational Unit.

After adding the OU, we will add a user to it.

Enter the user details and password on the next page with desired policies and hit Finish.

Setting up the Client Machine

Now, we need to setup our client windows machine. Link here to download Windows 10 Enterprise ISO.

After downloading add new VM in Virtual with desired settings and once you’re done, go ahead and continue with this blog.

Note: Before you start the machine ensure that the only Network Adapter that is attached to the VM is Internal Network (intnet). If NAT is attached, remove it.

Once the installation is completed, we will verify that we are connected successfully to the Internal network.
Go to Network and Internet Settings -> Change Adapter Options -> Right click on Ethernet -> click Properties

Now, double click on IPv4 settings and write the DNS IP address by selecting the option, “Use the following DNS server addresses”
The DNS IP address will be the same as we had set in our DC.

Now, we can go ahead and rename the workstation’s name as we did for the server machine above but with a small twist.

Now, a wizard box will pop up titled, “System Properties”. Click on Change button as shown below.

We will try connecting to the domain controller by adding the domain name as shown.
Enter the desired Workstation’s name and then select “Domain” in Member of and enter our Domain name.

Enter the username we created earlier from our DC. In my case it was John@Yogesh.local

Workstation — Adding Credentials for Login

After changing the settings, restart the machine and login with new credentials.

Note: After installing and running virtual machines simultaneously, if your VM or Host OS lags, I highly recommend you to change your memory settings.

Testing the Internet Connection

After completing all the steps, you should be able to connect to the internet.

Here’s a simple test to do that. I’ve pinged the google and then used tracert command for checking the route. We can see that

In conclusion, this guide provides a comprehensive walkthrough of setting up a Windows Active Directory (AD) home lab. It covers the basics of AD, its importance, and step-by-step instructions for configuring a Domain Controller, DHCP, and client machines using VirtualBox. By following these detailed steps, users can create a functional AD environment to manage network resources, enhance security, and streamline IT operations, simulating a real-world enterprise setup for learning and testing purposes.

References:

Great resource by Josh Madakor (How to Setup a Basic Home Lab Running Active Directory (Oracle VirtualBox) | Add Users w/PowerShell)