🔐 AD-Security-Lab

Oleh Borysovskyy | Active Directory Security & Sysadmin Home Lab

This repository documents hands-on work securing and administering an Active Directory environment using Windows Server 2025 and Windows 10 in a virtualized home lab. Focused on real-world sysadmin tasks, GPO hardening, user/group management, and common AD attack vector defense.

---

🖥️ Lab Environment

Component	Details
Domain Controller	Windows Server 2025 (Datacenter)
Client Machine	Windows 10 Pro (domain-joined)
Domain Name	mycyber.local
Hypervisor	VirtualBox (Host: Windows 11)
Network	Internal Lab VLAN (isolated)
Monitoring	Security Onion 2.4 (SIEM/IDS)

---

📁 Repository Structure

AD-Security-Lab/
├── gpo/                    # Group Policy Object configurations
├── user-management/        # User/group creation scripts and docs
├── hardening/              # AD and Windows Server hardening steps
├── attack-defense/         # AD attack simulations and mitigations
├── scripts/                # PowerShell automation scripts
├── screenshots/            # Lab evidence and documentation
└── README.md

---

✅ Completed Lab Tasks

🏗️ Domain Setup

• Installed and configured Windows Server 2025 as Domain Controller
• Promoted server to DC with mycyber.local domain
• Configured DNS, DHCP on the DC
• Joined Windows 10 client to the domain
• Verified domain connectivity and login

👥 User & Group Management

• Created Organizational Units (OUs): IT, HR, Management
• Created domain users and assigned to OUs
• Created security groups and assigned user memberships
• Configured account lockout policy (5 attempts / 30 min lockout)
• Enforced password complexity policy

🛡️ Group Policy Objects (GPO)

• Created and linked GPOs to specific OUs
• Disabled USB storage via GPO (removable media restriction)
• Enforced screensaver lock policy (15 min timeout)
• Restricted Control Panel access for standard users
• Configured Windows Firewall rules via GPO
• Deployed software restrictions (AppLocker baseline)
• Tested GPO application with gpupdate /force and gpresult /r

🔒 Hardening

• Disabled NTLM v1, enforced NTLMv2
• Enabled SMB signing on DC
• Disabled legacy protocols (SMBv1)
• Configured audit policies (logon events, account management, object access)
• Reviewed Event Viewer: Security log (Event IDs 4624, 4625, 4740)
• Enabled Windows Defender and configured exclusions

🎯 Attack Simulation & Defense

• Simulated brute-force login attempt — monitored Event ID 4625 alerts in Security Onion
• Tested Kerberoasting detection (SPN enumeration)
• Simulated Pass-the-Hash — reviewed NTLM authentication logs
• Verified account lockout triggering and alerting

---

🔧 PowerShell Scripts

Bulk User Creation

# Create 10 test users in the IT OU
$password = ConvertTo-SecureString "Lab@12345!" -AsPlainText -Force
1..10 | ForEach-Object {
    New-ADUser -Name "TestUser$_" `
               -SamAccountName "testuser$_" `
               -UserPrincipalName "testuser$_@mycyber.local" `
               -Path "OU=IT,DC=mycyber,DC=local" `
               -AccountPassword $password `
               -Enabled $true
}

Check Locked Accounts

Search-ADAccount -LockedOut | Select-Object Name, SamAccountName, LastLogonDate

Force GPO Update on All Computers

Get-ADComputer -Filter * | ForEach-Object {
    Invoke-GPUpdate -Computer $_.Name -Force
}

---

📊 Key Event IDs Monitored

Event ID	Description
4624	Successful logon
4625	Failed logon attempt
4648	Logon with explicit credentials
4740	Account locked out
4728	Member added to security group
4732	Member added to local group
4776	DC validated credentials (NTLM)
7045	New service installed

---

🚧 In Progress / Next Steps

• Configure fine-grained password policies (PSO)
• Set up read-only domain controller (RODC)
• Implement AD tiering model (Tier 0/1/2)
• Configure privileged access workstation (PAW) concept
• Add Winlogbeat → Security Onion log forwarding documentation
• Document BloodHound AD enumeration and defense

---

🛠️ Tools Used

• Active Directory Users and Computers (ADUC)
• Group Policy Management Console (GPMC)
• PowerShell (AD module)
• Event Viewer
• Security Onion 2.4 (SIEM monitoring)
• Mimikatz (attack simulation — isolated lab only)
• BloodHound (AD enumeration)
• Wireshark (network traffic analysis)

---

📜 Certifications Relevant to This Lab

• ✅ CompTIA Security+ (completed)
• 🎯 CompTIA CySA+ (pursuing)
• 🎯 Microsoft AZ-800 (Windows Server Hybrid Admin)

---

Part of my broader cybersecurity home lab — see Oleh-Borysovskyy for the full lab overview.