> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/active-directory/lab-setup.md). # Active Directory Lab Active Directory security notes for Active Directory Lab, covering enumeration, Kerberos, credentials, ACL abuse, lateral movement, exploitation workflow, and validation steps. ## Installation and configuration of the domain controller (DC) #### 1. Windows Server Installation * Download **Windows Server 2022** ISO {% embed url="" %} * Select **Windows Server 2022 Standard (Evaluation)**

* Install the system on a virtual machine * Installer **VMware Tools**

#### 2. Initial setup * Edit **machine name**

* Configure a **static IP address**

#### 3. Installing roles * Install the role: * **Active Directory Domain Services (AD DS)**

#### 4. Promotion to domain controller * Create a **new forest** * Domain name: `whoami.local`

* Restart the virtual machine after configuration ## Installing Windows 10 machines in the domain {% embed url="" %} #### 1. Creation of machines * Create two machines: * **WS01** * **WS02**

#### 2. Machine configuration * Change the computer names: * WS01 * WS02

Configure the IP address with DNS pointing to the domain controller: * DNS : `172.16.0.100`

* Change **advanced sharing** settings (network and discovery)

#### 3. Creation of users In the **Active Directory Administration Center**:

Create two users: * user1 * user2

#### 4. Domain Integration * Go to: **Professional or educational access**

* Choose: **Connect to a domain** * Enter domain name: `whoami.local` * Authenticate with a domain account

## Active Directory Features: Users, Groups and OUs In **Active Directory Users and Computers**, you can manage and modify the configuration of the forest and objects.

#### User and OU management

#### Example: creation of a department

Create an **organizational unit (OU)**, for example: * *Toulouse* * Move existing users into this OU to organize the structure.

#### Group management * Create groups, for example: * **IT** Add users to the group.

A group can be **a member of another group**. * Example: * The *IT* group can be a member of the *Administrators* group The users then inherit the **permissions** of the parent group.

#### GPO Management (Group Policy Objects) **GPO** allows you to manage configuration policies.

#### Creating a GPO * Go to: **Group Policy Management**

* Click the OU, for example **Toulouse** * Create a new **GPO**

* Edit the policy

#### Types of policies GPOs can be applied according to: * **User** * **Ordinateur**

#### Example: run a script at session start * Go to:/ **User Configuration → Windows Settings → Scripts (Logon)** * Create a `script.bat` file with the contents {% code overflow="wrap" %} ```bash calc.exe ``` {% endcode %}

Result: the calculator opens when the user logs in.

#### Shared Resources (SMB) Creating a share * Go to:/ **Server Manager → File and Storage Services → Shares**

* Create a new SMB share, for example: * Local folder: `C:\Shares\it` * Network path: `//DC01/it`

#### Automatic mounting via GPO To automatically connect the share:

* Use a script: {% code overflow="wrap" %} ```bash net use t: //172.16.0.100/it ``` {% endcode %}

Result: the network drive automatically appears on the workstations.

#### Point of vigilance (security) Pay attention to these folders: * **NETLOGON** * **SYSVOL**

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/active-directory/lab-setup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.