Part 1: Building a Windows Domain from Scratch, and the Four Things That Went Wrong

I got an unexpected job interview using a tech stack I haven't personally run. As I’ve done for every past job, I started trying to build out their systems in miniature based on what I heard in the screening interviews and could find on the net.
(Hold your judgment when you learn it's common stuff for most workplaces out there. I'm an open source kinda of person)
I learn faster by breaking things and figuring out why, so I built a small Windows domain in a home lab and kept notes on everything that went wrong. This post is going to be a little bit different than normal: it’s a rundown of what I built and what broke, with the full command list in a companion post, rather than a walkthrough.

The Lab

I built the lab on a desktop PC using VMware Workstation Pro. (This is strictly a home lab environment, so don't take it as a battle-tested production story.) My original plan included a nested ESXi and vCenter cluster, but Broadcom's licensing changes around late 2023 put vCenter out of reach for a free lab, so vSphere was out of scope. I'll probably cover Proxmox for this portion in the future.

Instead, I kept the setup focused on five VMs on a single NAT network (10.10.10.0/24), with VMware's local DHCP turned off and a fixed IP plan:

  • DC01 (10.10.10.10): Windows Server 2025 Core running Active Directory Domain Services, DNS, and DHCP.
  • FS01 (10.10.10.20): Windows Server 2025 Core acting as the file server and WSUS host, with a second 100 GB NVMe virtual disk for shared data.
  • BKP01 (10.10.10.30): Windows Server 2025 running Veeam Backup & Replication Community Edition. I intentionally left it off the domain to mirror the practice of isolating backup servers from production AD.
  • STOR01 (10.10.10.40): TrueNAS Community Edition acting as the network storage target.
  • CL01 (.100 to .150 via DHCP): Windows 11 Enterprise client and admin workstation.

What I Built

Rather than turning this into a step-by-step tutorial, here is a quick rundown of the build:

  • Domain and DNS: Promoted DC01 to a new forest (ad.iterlyze.com, NetBIOS LAB), pointed its DNS at itself, and configured a forwarder (10.10.10.2) and a reverse lookup zone (10.10.10.in-addr.arpa). (Learned that Pointing a DC at itself is fine with a single DC; once a second DC exists, each DC should point at a partner DC first and itself second.)
  • OU structure: Created a top-level Lab OU broken down by object type (Users, Workstations, Servers, Groups, Admins, Service Accounts), with departmental OUs (Nursing, Radiology, IT) nested under Users.
  • Separate admin account: Created a dedicated adm-user account in OU=Admins and added it to Domain Admins so I could stop using the built-in Administrator account.
  • DHCP: Installed and authorized the DHCP server in AD, then configured an active IPv4 scope (10.10.10.100 to 10.10.10.150) that hands out 10.10.10.10 for DNS.
  • Bulk users from CSV: created ten users across Nursing, Radiology, and IT with PowerShell and placing each user directly into their departmental OU.
  • AGDLP groups: Built global role groups (GG-Radiology-Techs, GG-Nursing-Staff, GG-IT-Staff) and nested them inside domain local resource groups (DL-Share-Radiology-Modify and DL-Share-Radiology-Read).
  • File share and NTFS permissions: Provisioned \\FS01\Radiology with SMB share access, then locked down the underlying NTFS folder with icacls (disabling inheritance, granting Modify to the Radiology Modify group and Read/Execute to the Read group, which contains Nursing.).
  • Group Policy: Linked a 15-minute screen lock policy (InactivityTimeoutSecs = 900) to OU=Workstations and a Group Policy Preferences drive map (R: to \\FS01\Radiology) with item-level targeting for Radiology techs. 
  • Account lockout, AD Recycle Bin, and Windows LAPS: Configured a 5-attempt lockout threshold (verifying Event ID 4740 on the PDC Emulator), enabled the AD Recycle Bin and tested restoring deleted users with their group memberships intact, and extended the AD schema to deploy Windows LAPS to workstations.

Four Things That Went Wrong

The list above may look clean, but in practice, four separate things broke along the way. Here is what went wrong, what I first suspected, and what was actually happening.

1) Downloaded ISOs That Wouldn't Boot

  • The symptom: When I powered on the new VMs for the first time, they ignored the virtual DVD drive and booted straight to PXE / "No Media".
  • What I thought it was: Corrupt ISO download.
  • What it actually was: Empty file. Every ISO returned the exact same SHA-256 hash:
E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855

Apparently, that hash is well known: it is the SHA-256 of a zero-byte file. My downloads had silently failed... twice! So, I used a command-line tool to download the ISOs.

curl.exe -L -C - --retry 5 -o WinServer2025.iso "URL"

(Maybe I should look up why web-browser downloads are consistently less reliable for large files. In fact, I'm going to do that now.)
Apparently, the common causes are:

  • Browsers don't retry reliably.
  • Browsers abort a slow/idle download.
  • Security scanning on Windows.
  • HTTP/3 (QUIC) over UDP.
  • Expiring download links.

2) Windows Server Installed with No Desktop

  • The problem: No desktop & some Windows Server applications need it.
  • What I thought it was: N/A.
  • What I needed to do: Reinstall the Windows Server 2025 Standard Evaluation (Desktop Experience) edition.

3) A File Server with No D: Drive

  • The symptom: On FS01, I added a second 100 GB virtual NVMe disk in VMware Workstation and initialized it as GPT, expecting to store shared folders on D:\Shares\Radiology. When I went to create the directory, D: wasn't a usable drive.
  • What I thought it was: I thought VMware hadn't hot-plugged the virtual disk properly, or that Initialize-Disk had formatted the volume and something had gone wrong.
  • What it actually was: The virtual CD/DVD drive was already using drive letter D:...

I had to move the CD-ROM drive to Z: first, then explicitly create a partition and format it as NTFS:

Get-CimInstance Win32_Volume -Filter "DriveType=5" | Set-CimInstance -Property @{DriveLetter='Z:'}
New-Partition -DiskNumber 1 -DriveLetter D -UseMaximumSize | Format-Volume -FileSystem NTFS -NewFileSystemLabel Data

4) New-SmbShare Failing with Error 1332

  • The symptom: With D: finally ready, I ran New-SmbShare to grant full share-level access to Authenticated Users (so NTFS could handle the real permission restrictions) and hit error 1332:
    New-SmbShare : No mapping between account names and security IDs was done.
    + CategoryInfo          : NotSpecified: (MSFT_SMBShare:ROOT/Microsoft/Windows/SMB/MSFT_SMBShare) [New-SmbShare], CimException
    + FullyQualifiedErrorId : Windows System Error 1332,New-SmbShare
  • What I thought it was: I thought FS01 was having trouble reaching the domain controller to resolve security identifiers (SIDs), or that I had a typo in the group name.
  • What it actually was: Out of habit from typing LAB\ in front of my domain groups and admin account, I had written -FullAccess "LAB\Authenticated Users". Authenticated Users is a built-in Windows security principal, so it lives under NT AUTHORITY, never under your domain's NetBIOS name. Changing the string to "NT AUTHORITY\Authenticated Users" fixed it immediately. (You will get the same 1332 error from icacls if you grant folder permissions to AD groups you haven't created yet.) 

The full list of commands I ran, grouped by task, is in a companion post: Lab 1 Command Reference.

What I'd Add Next 

  • A second domain controller, including transferring FSMO roles and updating DNS client settings on both DCs.
  • A full restore test from Veeam, not just a successful backup job.
  • Tiered admin accounts, so the account that manages workstations isn't a Domain Admin.
  • Proxmox cluster in place of vSphere. 
  • WSUS GPO.
  • Common breaks and practicing fixes. 

This started as interview prep and turned into a a decent blog post.



Comments

Post a Comment

Popular posts from this blog

Fail2ban Behind Reverse Proxy

Image
Assumptions, Prerequisites, Prior Set Up This guide is for when the reverse proxy & FoundryVTT server are both on separate machines This guide builds upon the prior one and details how to setup fail2ban to block bad bots, automated login attempts, and repeated connection attempts that are likely malicious, when your server is behind a reverse proxy.  If you haven't taken a look already my prior post detailed how to go about setting up fail2ban rules. https://blog.iterlyze.com/2024/11/fail2ban-foundryvtt.html  This guide assumes you are using a Debian 12 server (or Ubuntu) and have a basic idea of how to use a Linux shell. Some other assumptions that won't affect setting up fail2ban include that you are using Nginx as the reverse proxy, nftables as your system's firewall frontend, and that you are forwarding traffic to a FoundryVTT server. Make sure the reverse proxy and the server it sends traffic to is working before trying to set up fail2ban. If you are setting up Fou...
Read more

Fail2ban Rules for Foundry VTT

Image
Leave a comment if you like, hate, or find something confusing. This guide covers the steps required to create your own fail2ban jails, using foundryvtt as an example. *Warning I take some playful liberty at the start of this post. Welcome fellow nerds, geeks, otaku, or whatever you smartypants call yourselves. I'm assuming you might fit one of the following categories probably because you either know what Fail2ban is you nerd, or you know what FoundryVTT is you DnD tabletop (but on computer) roleplaying geek . Now that i've gotten the tongue in cheek (insults/compliments) aside I have a confession to make. I know what both of those things are so does that make me like a Generked? Okay I just mixed the two words together, that might be good for a riddle or puzzle in some future game. Anyways enough blabbing, you are probably here for the technical content anyways. Everything that i'm writing is assuming you use an Ubuntu/Debian based Linux distribution. Most Linux distros ...
Read more

Proxmox Link Aggregation Using balance-alb Windows vs Linux

Image
  Proxmox Link Aggregation Using balance-alb Mode Explanation I have this nice little business switch that unfortunately doesn't support LACP for network link aggregation. One of my cables also turned out to be a little bit faulty, so to prevent any mishaps in the future I decided to configure a link bond between the proxmox box's two NICs (Network Interface Cards). Link bonding, also known as Link aggregation or NIC Teaming is where you have two network interfaces on your host working together. This can provide some redundancy, load balancing, and even increase your throughput depending on your configuration. the balance-alb setting can be used regardless of what the switch supports. It's best only used on small networks. I ran into an interesting problem. None of the VM's could access the network after changing my proxmox box to use the  balance-alb  bond mode. The solution turned out to be simple. For windows VM's Install the VirtIO driver in windows, and then se...
Read more