Windows Server 2022
Home Lab to Production-Ready
Complete Setup Guide from Scratch
What You Will Build Prerequisites
A full enterprise-grade Windows Server A PC with at least 16GB RAM and 100GB free
environment covering networking, security, disk space. VirtualBox installed. Windows
identity management, monitoring, and backup. Server 2022 ISO downloaded.
Chapters at a Glance
Chapter 1 — VirtualBox and VM Setup
Chapter 2 — Windows Server 2022 Installation
Chapter 3 — Network Configuration and Static IP
Chapter 4 — Firewall Configuration
Chapter 5 — DNS Server (Bind9 equivalent: Windows DNS)
Chapter 6 — DHCP Server
Chapter 7 — Remote Desktop Services
Chapter 8 — Active Directory Domain Services
Chapter 9 — High Availability (Second Domain Controller)
Chapter 10 — Network Segmentation and VLANs
Chapter 11 — Security Hardening and Group Policy
Chapter 12 — Certificate Authority (AD CS)
Chapter 13 — Patch Management (WSUS)
Chapter 14 — Monitoring and Logging
Chapter 15 — Backup and Recovery
Chapter 16 — File Services
Chapter 1 — VirtualBox and VM Setup
VirtualBox is a free hypervisor that lets you run virtual machines on your personal computer.
Think of it as a computer inside your computer. This is where your Windows Server will live.
1.1 Download and Install VirtualBox
1. Go to [Link] and download the installer for your operating system (Windows,
Mac, or Linux).
2. Run the installer and accept all default settings.
3. Also install the VirtualBox Extension Pack from the same page — it adds USB support
and better performance.
1.2 Download Windows Server 2022
4. Go to [Link]/evalcenter and search for Windows Server 2022.
5. Register with a free Microsoft account and download the ISO file (approximately 5GB).
6. Choose Standard Evaluation with Desktop Experience — this gives you a full graphical
interface which is best for learning.
1.3 Create the Virtual Machine
7. Open VirtualBox and click New.
8. Set the following:
◦ Name: WindowsServer2022
◦ Type: Microsoft Windows
◦ Version: Windows 2022 (64-bit)
9. Set RAM to 4096 MB (4GB minimum, 8GB recommended).
10. Create a virtual hard disk of 60GB.
11. Before starting, go to Settings and configure the following:
◦ Storage: attach the Windows Server 2022 ISO to the optical drive
◦ Network > Adapter 1: change from NAT to Bridged Adapter
◦ Under Name: select your real network card (Wi-Fi or Ethernet)
◦ System > Processor: assign 2 CPUs minimum
⚠ WARNING
Bridged Adapter is critical. NAT mode gives your VM a private 10.0.2.x address that is isolated from
your real network. Bridged mode makes your VM a full participant on your home network with a real
192.168.0.x address that other devices can reach.
Chapter 2 — Windows Server 2022 Installation
With the ISO attached and VM configured, you are ready to install Windows Server.
2.1 Boot and Install
12. Start the VM. It will boot from the ISO automatically.
13. Select your language and click Next, then Install now.
14. Choose Windows Server 2022 Standard Evaluation (Desktop Experience).
15. Accept the license agreement.
16. Choose Custom: Install Windows only (advanced).
17. Select the virtual disk and click Next. Installation begins.
18. The VM will restart several times. This is normal.
2.2 Initial Configuration
19. After installation, you are prompted to set an Administrator password.
20. Choose a strong password and note it down — this is your only account at this stage.
21. Log in. Server Manager will open automatically.
22. Set the computer name: open Server Manager > Local Server > click on the current
computer name > Change > set a name like WIN-SERVER-01 > restart.
⚠ WARNING
Always rename your server before adding roles and joining a domain. Changing the name afterward
causes complications with certificates and Active Directory.
Chapter 3 — Network Configuration and Static IP
A server must have a fixed IP address. Every service you install will depend on knowing where
to find the server. If the IP changes, everything breaks.
3.1 Find Your Network Information
Open Command Prompt and run:
Command Prompt / PowerShell
ipconfig /all
Note down your current IP address, subnet mask, default gateway, and DNS server. Your
gateway is your router's address (usually [Link] or [Link]).
3.2 Set the Static IP
23. Open Network and Sharing Center from the taskbar or Control Panel.
24. Click Change adapter settings.
25. Right-click your network adapter > Properties.
26. Select Internet Protocol Version 4 (TCP/IPv4) > Properties.
27. Select Use the following IP address and enter:
Field Value Why
IP Address [Link] Fixed address for this server
Subnet Mask [Link] Defines your network size
Default Gateway [Link] Your router's address
Preferred DNS [Link] The server asks itself first
Alternate DNS [Link] Google DNS as fallback
ℹ INFO
[Link] is the loopback address — it always means 'this machine itself'. You point DNS here
because this server will become the DNS server. It should answer its own DNS queries before going
anywhere else.
28. Click OK and close all windows.
29. Verify connectivity:
Command Prompt / PowerShell
ping [Link]
ping [Link]
Both should succeed. If they do not, double-check the gateway address matches your router.
Chapter 4 — Firewall Configuration
Windows Defender Firewall is already active and reasonably configured by default. When you
install server roles, Windows automatically creates firewall rules for them. However, you should
understand how to manage it manually.
4.1 Open the Advanced Firewall
30. Open Server Manager > Tools > Windows Defender Firewall with Advanced Security.
31. You will see three sections: Inbound Rules, Outbound Rules, and Connection Security
Rules.
4.2 Default Policy
The correct default posture for a server is:
• Block all inbound traffic except what is explicitly allowed
• Allow all outbound traffic
This is already the default in Windows Defender Firewall.
4.3 Verify Critical Rules Are Active
Check that the following inbound rules are enabled:
Rule Name Port Purpose
Remote Desktop (TCP-In) 3389 RDP access
DNS (UDP-In) 53 DNS queries
DHCP Server (UDP-In) 67 DHCP requests
File and Printer Sharing 445 SMB file sharing
World Wide Web Services (HTTP) 80 Web traffic
World Wide Web Services (HTTPS) 443 Secure web traffic
4.4 Create a Custom Rule (Example)
32. In Inbound Rules, click New Rule on the right panel.
33. Select Port > Next > TCP > enter the port number > Next.
34. Select Allow the connection > Next.
35. Apply to Domain, Private, and Public as needed > Next.
36. Give it a name and click Finish.
Chapter 5 — DNS Server
DNS translates names to IP addresses. Without DNS, every device on your network would need
to remember IP addresses. With DNS, you can use names like [Link] instead.
5.1 Install the DNS Role
37. Open Server Manager > Manage > Add Roles and Features.
38. Click Next through the wizard until Server Roles.
39. Check DNS Server > Add Features when prompted > Next through the rest > Install.
5.2 Create a Forward Lookup Zone
A forward lookup zone translates names to IPs ([Link] to [Link]).
40. Open Server Manager > Tools > DNS.
41. Expand your server name > right-click Forward Lookup Zones > New Zone.
42. Select Primary Zone > Next.
43. Zone name: [Link] > Next through the rest > Finish.
5.3 Add DNS Records
44. Expand Forward Lookup Zones > click [Link].
45. Right-click in the empty area > New Host (A or AAAA).
46. Add the following records:
Name IP Address What It Represents
myserver [Link] Your Windows Server
router [Link] Your home router
dc01 [Link] Domain Controller alias
5.4 Configure DNS Forwarders
Forwarders tell your DNS server where to go for names it does not know (like [Link]).
47. In DNS Manager, right-click your server name > Properties.
48. Click the Forwarders tab > Edit.
49. Add [Link] and [Link] > OK.
5.5 Test DNS
Command Prompt / PowerShell
nslookup [Link]
nslookup [Link]
Both should return IP addresses. The first confirms your local zone works. The second confirms
forwarders work.
Chapter 6 — DHCP Server
DHCP automatically assigns IP addresses to devices on your network. Right now your router is
doing this. You will take over that role with Windows Server.
6.1 Install the DHCP Role
50. Open Server Manager > Manage > Add Roles and Features.
51. Check DHCP Server > Add Features > Next through the rest > Install.
52. After installation, click the flag notification icon > Complete DHCP configuration >
Commit.
6.2 Create a DHCP Scope
A scope defines the range of IPs your server can hand out.
53. Open Server Manager > Tools > DHCP.
54. Expand your server > right-click IPv4 > New Scope.
55. Fill in the wizard as follows:
Field Value
Scope Name Home Network
Start IP [Link]
End IP [Link]
Subnet Mask [Link]
Exclusions [Link] to [Link] (your server and router)
Lease Duration 8 days
Router (Gateway) [Link]
DNS Server [Link]
Domain Name [Link]
56. When asked to activate the scope, select Yes.
6.3 Disable DHCP on Your Router
This is critical. Two DHCP servers on the same network will assign conflicting IP addresses,
making devices unreachable randomly.
57. Log into your router (usually [Link] in a browser).
58. Find the DHCP settings (usually under LAN or Network).
59. Disable the router's DHCP server and save.
✓ NOTE
Your Windows Server is now the only DHCP authority on the network. Devices will receive IPs from
it, along with the correct DNS server address pointing to [Link].
Chapter 7 — Remote Desktop Services
Remote Desktop allows you to manage your server from another machine without needing
physical access to the VM. In production environments, servers often have no monitor attached
at all.
7.1 Enable Remote Desktop
60. Open Server Manager > Local Server.
61. Click on the Remote Desktop status (shows Disabled).
62. Select Allow remote connections to this computer.
63. Click Apply > OK.
7.2 Connect From Another Machine
From a Windows computer on your network:
Command Prompt / PowerShell
mstsc
Or press Win + R and type mstsc. Enter your server's IP address ([Link]) and log in with:
Command Prompt / PowerShell
Username: HOME\Administrator
Password: your password
From a Mac, download Microsoft Remote Desktop from the App Store and add a new PC with
IP [Link].
7.3 Allow Multiple Sessions (Optional)
By default, only one RDP session is allowed at a time. To allow more:
64. Open Group Policy Editor: press Win + R > type [Link].
65. Navigate to: Computer Configuration > Administrative Templates > Windows
Components > Remote Desktop Services > Remote Desktop Session Host >
Connections.
66. Enable Limit number of connections and set it to your desired number.
ℹ INFO
For a home lab, one session is fine. Multiple sessions become relevant when you have multiple
admins managing the same server.
Chapter 8 — Active Directory Domain Services
Active Directory is the heart of a Windows Server environment. It manages users, computers,
and policies across your entire network. Without AD, every machine manages its own accounts
independently. With AD, one account works everywhere.
8.1 Install the AD DS Role
67. Open Server Manager > Manage > Add Roles and Features.
68. Check Active Directory Domain Services > Add Features > Next through the rest >
Install.
8.2 Promote to Domain Controller
69. Click the flag notification icon > Promote this server to a domain controller.
70. Select Add a new forest.
71. Root domain name: [Link] > Next.
72. Set the following options:
• Forest functional level: Windows Server 2016
• Domain functional level: Windows Server 2016
• DNS Server: checked
• Global Catalog: checked
• DSRM Password: set a recovery password and store it safely
73. Click Next through DNS Delegation (ignore the warning) > NetBIOS name will auto-fill as
HOME > Next.
74. Leave paths as default > Next > Install.
75. The server will automatically restart.
8.3 Log Back In
After restart, the login screen changes. Use:
Command Prompt / PowerShell
Username: HOME\Administrator
Password: your password
8.4 Create Users and Groups
76. Open Server Manager > Tools > Active Directory Users and Computers.
77. Expand [Link] > right-click Users > New > User.
78. Fill in the user details and set a password.
79. To create a group: right-click Users > New > Group > give it a name.
80. Add users to groups by right-clicking a group > Properties > Members > Add.
⚠ WARNING
Best practice: never use the Administrator account for daily tasks. Create a named admin account for
yourself (e.g. [Link]) and a separate standard account for regular use.
Chapter 9 — High Availability (Second Domain Controller)
A single domain controller is a critical single point of failure. If it goes down, no one can log in,
DNS fails, and DHCP may fail. The solution is a second domain controller that replicates
everything from the first.
9.1 Create a Second VM
81. Create a new VM in VirtualBox with the same specs as the first.
82. Install Windows Server 2022 with Desktop Experience.
83. Set a static IP: [Link].
84. Set DNS to point to the first DC: [Link] (primary) and [Link] (secondary).
9.2 Join the Second Server to the Domain
85. On the second server, open System Properties: right-click This PC > Properties >
Advanced system settings > Computer Name > Change.
86. Select Domain and enter: [Link].
87. Enter Domain Admin credentials when prompted.
88. Restart the server.
9.3 Promote the Second Server to Domain Controller
89. Log in as HOME\Administrator.
90. Install the AD DS role as done in Chapter 8.
91. Click the flag notification > Promote this server to a domain controller.
92. This time select Add a domain controller to an existing domain.
93. Domain: [Link] > Next.
94. Check DNS Server and Global Catalog > set DSRM password > Next through the rest >
Install.
95. Server will restart and become the second DC.
9.4 Configure DHCP Failover
96. On the first server, open DHCP Manager.
97. Right-click your scope > Configure Failover.
98. Add the second server ([Link]) as the partner.
99. Select Hot Standby mode (the second takes over if the first fails) > Finish.
✓ NOTE
Now if your primary server goes offline, the second DC handles authentication and DHCP
automatically. Users will not notice any interruption.
Chapter 10 — Network Segmentation and VLANs
A flat network where every device can talk to every other device is a security risk. VLANs divide
your network into separate zones. A compromised client machine cannot reach servers directly.
Guests have no access to internal resources at all.
10.1 VLAN Design
VLAN ID Subnet Purpose
Servers 10 [Link]/24 Domain controllers, file servers, DNS,
DHCP
Clients 20 [Link]/24 User workstations and laptops
Management 30 [Link]/24 Admin access only, heavily restricted
Guest 40 [Link]/24 Internet only, no internal access
10.2 Simulate VLANs in VirtualBox
In a home lab without a managed switch, you simulate VLANs using VirtualBox internal
networks.
100. For each VM, go to Settings > Network.
101. Set Adapter 1 to Internal Network and give it a name matching its VLAN (e.g.
vlan-servers).
102. VMs on the same internal network can communicate. VMs on different internal
networks cannot, until you configure routing.
10.3 In a Real Environment
Production VLAN segmentation requires a managed switch and a router or firewall that
understands VLANs (like pfSense, Cisco, or Fortinet). The switch tags traffic with VLAN IDs and
the router enforces which VLANs can talk to which.
• Server VLAN: clients can access file shares but cannot RDP into servers directly
• Management VLAN: only specific admin accounts can access it
• Guest VLAN: firewall blocks all traffic to internal VLANs
Chapter 11 — Security Hardening and Group Policy
Group Policy Objects (GPOs) are rules that apply automatically to users and computers in your
domain. They are how enterprise environments enforce security at scale — no manual
configuration on each machine.
11.1 Open Group Policy Management
103. Open Server Manager > Tools > Group Policy Management.
104. Expand Forest > Domains > [Link].
105. Right-click Default Domain Policy > Edit to open the Group Policy Editor.
11.2 Essential Security Policies
Password Policy
Navigate to: Computer Configuration > Policies > Windows Settings > Security Settings >
Account Policies > Password Policy
Setting Recommended Value
Minimum password length 12 characters
Password complexity requirements Enabled
Maximum password age 90 days
Minimum password age 1 day
Enforce password history 10 passwords
Account Lockout Policy
Navigate to: Account Policies > Account Lockout Policy
• Account lockout threshold: 5 invalid attempts
• Account lockout duration: 30 minutes
• Reset account lockout counter: 30 minutes
Additional Hardening GPOs
• Disable USB storage: Computer Configuration > Administrative Templates > System >
Removable Storage Access > set all to Denied
• Screen lock timeout: User Configuration > Administrative Templates > Control Panel >
Personalization > Screen saver timeout: 10 minutes
• Disable guest account: Security Settings > Local Policies > Security Options > Accounts:
Guest account status: Disabled
• Restrict Control Panel access for standard users
11.3 Tiered Administration Model
Never use your Domain Admin account for daily tasks. Structure your admin accounts in tiers:
Tier Account Type Used For
Tier 0 Domain Admin (e.g. [Link]) Domain Controllers only
Tier 1 Server Admin (e.g. [Link]) Member servers only
Tier 2 Workstation Admin (e.g. Client machines only
[Link])
Standard Regular user (e.g. john) Daily work: email, documents
⚠ WARNING
Logging into a workstation with a Domain Admin account is one of the most common ways domain
credentials get stolen via credential harvesting attacks. Keep Tier 0 accounts off all machines except
DCs.
Chapter 12 — Certificate Authority (AD CS)
Without a Certificate Authority, any HTTPS service inside your network either runs unencrypted
or uses self-signed certificates that browsers reject with scary warnings. AD CS makes your
server the trusted certificate authority for your whole domain — all issued certificates are
automatically trusted by domain members.
12.1 Install AD CS Role
106. Open Server Manager > Manage > Add Roles and Features.
107. Check Active Directory Certificate Services > Add Features > Next.
108. Under Role Services, check Certification Authority > Next > Install.
12.2 Configure the Certificate Authority
109. Click the flag notification > Configure Active Directory Certificate Services.
110. Select Enterprise CA (requires AD DS, which you already have).
111. Select Root CA (this is your top-level authority).
112. Select Create a new private key.
113. Leave cryptography settings at defaults (RSA 2048, SHA-256).
114. CA Name: home-ROOT-CA > Next.
115. Validity period: 10 years (for a root CA) > Next > Configure.
12.3 Issue Certificates to Servers
116. On the server needing a certificate, open IIS Manager or MMC > Certificates
snap-in.
117. Request a new certificate > Domain enrollment policy > select Web Server
template.
118. Fill in the common name (e.g. [Link]) > Enroll.
119. The certificate is issued automatically and trusted by all domain members.
ℹ INFO
Domain member computers automatically trust certificates issued by your enterprise CA because the
root CA certificate is distributed via Group Policy to all domain machines.
Chapter 13 — Patch Management with WSUS
Without centralized patch management, every machine on your network goes directly to
Microsoft to download updates. This wastes bandwidth, happens at unpredictable times, and
gives you no control over what gets installed when. WSUS (Windows Server Update Services)
solves all of this.
13.1 Install WSUS
120. Open Server Manager > Manage > Add Roles and Features.
121. Check Windows Server Update Services > Add Features > Next.
122. Under Role Services, check WID Connectivity and WSUS Services.
123. Set the content directory (where updates are stored): C:\WSUS > Next > Install.
13.2 Configure WSUS
124. After installation, click the flag notification > Launch Post-Installation Tasks.
125. Open Server Manager > Tools > Windows Server Update Services.
126. The WSUS Configuration Wizard opens:
• Sync from Microsoft Update > Next
• Skip the proxy settings > Next
• Click Start Connecting — it downloads the catalog of available updates
• Choose your languages and products (Windows Server 2022, Windows 10, Windows
11)
• Select update classifications: Critical Updates, Security Updates, Definition Updates
• Set a sync schedule: daily at 3:00 AM > Next > Finish
13.3 Point Clients to WSUS via GPO
127. Open Group Policy Management > edit Default Domain Policy.
128. Navigate to: Computer Configuration > Administrative Templates > Windows
Components > Windows Update.
129. Configure the following:
• Specify intranet Microsoft update service location: [Link]
• Configure Automatic Updates: Auto download and schedule install
• Scheduled install day: Every Sunday at 3:00 AM
✓ NOTE
All domain machines will now receive updates from your WSUS server instead of Microsoft directly.
You review and approve updates before they reach machines.
Chapter 14 — Monitoring and Logging
If you have no monitoring, you will only discover problems after users complain. Good
monitoring tells you about issues before they cause outages, and logs tell you exactly what
happened and when.
14.1 Windows Event Forwarding
Event forwarding collects logs from all machines and centralizes them on one server.
130. On the collector server (your main DC), open Command Prompt as
Administrator:
Command Prompt / PowerShell
winrm quickconfig
131. On all source computers (via GPO), navigate to: Computer Configuration >
Administrative Templates > Windows Components > Event Forwarding.
132. Configure the target subscription manager URL:
Server=[Link]
133. On the collector, open Event Viewer > Subscriptions > Create Subscription.
134. Select source computers (or an AD group) and the event logs to collect.
14.2 Key Events to Monitor
Event ID What It Means Priority
4625 Failed login attempt High
4720 User account created High
4728 User added to security group High
4776 Domain credential validation failed High
7045 New service installed Medium
1102 Audit log cleared Critical
4648 Logon with explicit credentials High
14.3 Install a SIEM (Optional but Recommended)
A SIEM (Security Information and Event Management) system collects logs, correlates events,
and alerts you to suspicious activity. For a home lab, these are good free options:
• Elastic SIEM — free, runs in Docker, powerful dashboards
• Wazuh — open source, specifically designed for security monitoring
• Graylog — centralized log management with alerting
14.4 Server Uptime Monitoring
Use a lightweight tool to alert you when a server goes offline:
• Uptime Kuma — simple, runs in Docker, sends notifications via email or Telegram
• Prometheus + Grafana — more advanced, gives you metrics dashboards (CPU, RAM,
disk, network)
Chapter 15 — Backup and Recovery
A backup you have never tested is not a backup — it is hope. Every production environment
needs a documented, tested backup and recovery procedure.
15.1 What to Back Up
What Why How Often
Active Directory System Restore the entire domain if the DC Daily
State is lost
File server data Protect user files Daily
Server configurations Rebuild servers faster after failure Weekly
DHCP database Restore IP lease history Weekly
DNS zones Restore DNS records Weekly
GPO backup Restore Group Policies After every change
15.2 Back Up Active Directory (System State)
135. Install Windows Server Backup: Server Manager > Manage > Add Roles and
Features > Features > Windows Server Backup.
136. Open Windows Server Backup from Tools.
137. Click Backup Once or Backup Schedule.
138. Choose Custom > Add Items > System State.
139. Select a backup destination (external drive or network share) > Backup.
15.3 Automate Backups via Task Scheduler
Command Prompt / PowerShell
wbadmin start systemstatebackup -backupTarget:D: -quiet
Schedule this command in Task Scheduler to run daily at 2:00 AM.
15.4 Test Your Recovery
At least once, go through the full recovery process:
140. Simulate a failure: take a snapshot of your VM, then break something
intentionally.
141. Restore from backup using: wbadmin start systemstaterecovery
142. Verify everything came back correctly.
143. Document the steps and how long it took.
ℹ INFO
Recovery Time Objective (RTO) is how long it takes you to restore service. Recovery Point Objective
(RPO) is how much data you can afford to lose. Know both numbers before a real failure happens.
Chapter 16 — File Services
A file server gives your users a central place to store and access files, with permissions
controlled by Active Directory groups. Users access it as a network drive — they do not need to
know which server it lives on.
16.1 Install the File Server Role
144. Open Server Manager > Manage > Add Roles and Features.
145. Under Server Roles > File and Storage Services > File and iSCSI Services.
146. Check File Server and File Server Resource Manager > Add Features > Install.
16.2 Create Shared Folders
147. Create folders on your server, for example:
Command Prompt / PowerShell
C:\Shares\HR
C:\Shares\Finance
C:\Shares\IT
C:\Shares\General
148. Right-click a folder > Properties > Sharing > Advanced Sharing.
149. Check Share this folder and give it a share name (e.g. HR).
150. Click Permissions and assign access to the appropriate AD group.
16.3 Set NTFS Permissions
Share permissions only control network access. NTFS permissions control actual file access.
Both must be configured.
151. Right-click the folder > Properties > Security > Edit.
152. Remove Everyone.
153. Add the relevant AD group (e.g. HR-Users) and set permissions:
• Read: can view files
• Modify: can read and edit files
• Full Control: admin access, only for IT
16.4 Map Network Drives via GPO
154. Open Group Policy Management > create a new GPO linked to the Users OU.
155. Navigate to: User Configuration > Preferences > Windows Settings > Drive
Maps.
156. Right-click > New > Mapped Drive.
157. Set the location (e.g. \\myserver\HR), drive letter (H:), and target the HR AD
group.
Users in the HR group will automatically see the H: drive when they log in to any domain
machine.
16.5 Set Storage Quotas
158. Open File Server Resource Manager from Tools.
159. Expand Quota Management > Quotas > Create Quota.
160. Set a quota path (e.g. C:\Shares\HR) and a limit (e.g. 10GB per user).
161. Choose a template or create a custom threshold with email notifications.
Summary — What You Have Built
Congratulations. You have built a near-production Windows Server environment from scratch.
Here is everything you have deployed:
Chapter Component Status
1-2 VirtualBox + Windows Server 2022 Foundation
3 Static IP + Network Configuration Infrastructure
4 Windows Defender Firewall Security
5 DNS Server ([Link] zone + forwarders) Infrastructure
6 DHCP Server (scope + failover) Infrastructure
7 Remote Desktop Services Management
8 Active Directory Domain Services Identity
9 Second Domain Controller + HA Redundancy
10 VLANs + Network Segmentation Security
11 Group Policy + Security Hardening Security
12 Certificate Authority (AD CS) Security
13 WSUS Patch Management Operations
14 Event Forwarding + Monitoring Operations
15 Backup and Recovery Resilience
16 File Services + Permissions + Quotas Services
ℹ INFO
This environment covers the core of what a small-to-medium enterprise Windows infrastructure looks
like. The main things that separate this from a large enterprise are scale (more servers, more users),
stricter change management processes, 24/7 monitoring teams, and compliance requirements (ISO
27001, SOC2, etc.).
Suggested Next Steps
• Explore Microsoft Azure AD (Entra ID) and hybrid identity — connecting your on-prem
AD to the cloud
• Study for the AZ-800 exam (Administering Windows Server Hybrid Core Infrastructure)
• Set up a SIEM (Wazuh or Elastic) and practice threat detection
• Simulate an attack (with tools like BloodHound) and see what your monitoring catches
• Practice disaster recovery: deliberately break your DC and restore from backup