Hyper-V Implementation Guide

Assignment 2 – Network Design & Simulation for Organization Red

Course: CS465 – Networking & Active Directory
Prepared for: [Insert Instructor]
Prepared by: [Insert Group Members]
Date: September 25, 2025
Table of Contents
[Update TOC in Word: References → Table of Contents → Automatic Table]
1. Prerequisites
Hardware and Host Requirements:

- A Windows 10/11 Pro or Windows Server machine with Hyper-V role enabled OR a
dedicated Hyper-V host.
- Minimum recommended host resources: 16 GB RAM (32+ GB recommended), 4+ CPU
cores, 200 GB free disk space.

Software and ISOs:

- Windows Server 2022 (Evaluation or licensed ISO) for Domain Controllers, DNS, DHCP,
RRAS, File Servers, and other servers.
- Windows 10/11 ISO for client VMs.
- (Optional) Windows Server Backup tools or third-party backup.

Files to keep handy before you start:

- All ISOs placed in an accessible folder on the Hyper-V host (e.g., D:\ISOs)
- Product keys (if available)
- This guide (open in parallel)

2. Lab Topology & IP Addressing Plan

Quick topology (logical): HQ Data Center (Red) ↔ Branch1 ↔ Branch2 ↔ Branch3; Yellow
site (same forest); Green site (separate forest but trusted). All links are virtualized in Hyper-
V.

IP addressing (use these exact addresses in lab):

VM / Site Role Hostname IP Address (Static)

HQ - Domain DC / DNS / GC DC-RED-01 [Link]

Controller 1

HQ - Domain DC / DNS DC-RED-02 [Link]

Controller 2

HQ - File Server File Server / DFS FS-RED-01 [Link]

HQ - RRAS Router RRAS Router RRAS-ROUTER [Link] (gw for HQ)

Branch1 - DC RODC / DC BR1-DC [Link]

Branch2 - DC RODC / DC BR2-DC [Link]

Branch3 - DC RODC / DC BR3-DC [Link]

Yellow - DC DC (same forest) YEL-DC-01 [Link]

Green - DC DC in separate GRN-DC-01 [Link]

forest

Client VM User Workstation CLIENT-01 [Link]

Subnet notes: HQ = [Link]/24; Branches = [Link]/24, [Link]/24, [Link]/24; Yellow =

[Link]/24; Green = [Link]/24.

3. Step-by-step Hyper-V Build (Beginner-friendly)

Step 0 — Plan and prepare

1. Read this entire guide once before starting. 2. Create a folder on the host for the lab (e.g.,
C:\HyperVLab). 3. Copy ISOs into C:\HyperVLab\ISOs. 4. Create a folder for VM virtual
disks: C:\HyperVLab\VHDX. 5. Decide how many simultaneous VMs your host can run (start
with at least DC-RED-01, DC-RED-02, RRAS-ROUTER, FS-RED-01, BR1-DC, YEL-DC, GRN-DC,
CLIENT-01 = ~8 VMs).

Step 1 — Enable Hyper-V on the Host

If Hyper-V is not yet enabled on your Windows host, do the following:

GUI method: Control Panel → Programs and Features → Turn Windows features on or off →
check Hyper-V (Hyper-V Management Tools and Hyper-V Platform) → Restart.

PowerShell method (run as Administrator):

```powershell
Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All
Restart-Computer
```

Step 2 — Create Virtual Switches

We will create several virtual switches to emulate WAN/LAN separation. Use 'Virtual Switch
Manager' in Hyper-V Manager.
Create the following switches:

- 'WAN' — Type: Internal or External (use Internal if you don't need real internet). This will
act as the backbone router network.
- 'HQ-LAN' — Type: Internal
- 'BR1-LAN' — Type: Internal
- 'BR2-LAN' — Type: Internal
- 'BR3-LAN' — Type: Internal
- 'YEL-LAN' — Type: Internal
- 'GREEN-LAN' — Type: Internal

Tip: If you choose External for WAN, VMs can access your physical network/internet which
may help updates, but be careful with IP conflicts. Internal keeps everything isolated on the
host.

Step 3 — Create a base VM template (Windows Server)

Create one 'golden' VM you will clone for other servers. Steps:

1. In Hyper-V Manager → New → Virtual Machine. Follow wizard: Name: BASE-SRV;

Generation: Gen 2 (or Gen 1 if ISO requires); Startup memory: 4096 MB; Network: connect
to 'WAN' or any switch (we will reassign later). Create a new virtual hard disk, size 60 GB;
Install OS from bootable image → point to Windows Server 2022 ISO in C:\HyperVLab\ISOs.
2. Start the VM and go through Windows Server installation (language, disk, product key if
available). Create Administrator password. After installation, run Windows Update
(optional but recommended), install Guest Services Integration Components if required by
host OS.
3. Configure VM: set TimeZone, rename to BASE-SRV, install Hyper-V Integration Services if
applicable.
4. Shut down, then create a differencing disk or use Export/Import or clone the VHDX to
create child VMs quickly.

Recommended base VM settings

- CPU: 2 vCPU (adjust based on host)
- Memory: 4–8 GB for server VMs
- Disk: 60–120 GB for DCs and file servers
- NIC: 1 NIC initially; you will add more NICs for RRAS later

Step 4 — Create All Required VMs from the Base Image

Create each VM listed in the IP plan. For each VM: New → Virtual Machine → Use the existing
VHDX (copy the [Link] to a new file and attach). Configure settings:
- Name the VM exactly as in the table (e.g., DC-RED-01).
- Assign 2 vCPU for DCs (3–4 if your host has resources).
- Assign memory (4–8GB for DCs; 8–16GB for file servers)
- Add network adapters: attach to the site-specific virtual switch (e.g., DC-RED-01 → HQ-
LAN). For RRAS add multiple adapters: one to WAN and one to HQ-LAN.
- Add an additional virtual hard disk for data if the server will be a file server (e.g., +100 GB
attached as D:\).

Create the following VMs (summary): DC-RED-01, DC-RED-02, FS-RED-01, RRAS-ROUTER,

BR1-DC, BR2-DC, BR3-DC, YEL-DC-01, GRN-DC-01, CLIENT-01.

Step 5 — Configure VM NICs & Virtual Switches

For each VM, open Settings → Network Adapter → select the appropriate virtual switch for
the VM’s site. Example:

- DC-RED-01: connect to 'HQ-LAN'.

- BR1-DC: connect to 'BR1-LAN'.
- RRAS-ROUTER: add 2 NICs → one to 'WAN', another to 'HQ-LAN'.
- YEL-DC-01: connect to 'YEL-LAN'.
- GRN-DC-01: connect to 'GREEN-LAN'.

If your host has limited RAM/CPU, consider creating fewer VMs or stopping nonessential
VMs while configuring others.

Step 6 — First boot & Basic Windows configuration

Boot each VM and perform the following on each server VM:

1. Set Administrator password to a strong known value for lab (e.g., P@ssw0rd!23) – change
later.
2. Set time zone and correct time; enable NTP if internet is available.
3. Rename the server: System → Rename this PC → use hostnames in the table.
4. Configure Server Manager features: Install Windows Updates (optional depending on
time).
5. Configure network IP settings (IPv4 static) — detailed in next step.

Step 7 — Configure Static IPs & DNS settings

Important: Set static IPs on the server NICs prior to promoting to DC to avoid DNS
registration issues. Use the addresses from the IP Plan table.
Example for DC-RED-01 (GUI): Control Panel → Network and Sharing Center → Change
adapter settings → Right-click Ethernet → Properties → Internet Protocol Version 4 →
Properties → Use the following IP address:
- IP address: [Link]
- Subnet mask: [Link]
- Default gateway: [Link] (RRAS router in HQ)
- Preferred DNS server: [Link] (point to itself initially)

PowerShell example (run as Administrator on the VM):

```powershell
New-NetIPAddress -InterfaceAlias 'Ethernet' -IPAddress [Link] -PrefixLength 24 -
DefaultGateway [Link]
Set-DnsClientServerAddress -InterfaceAlias 'Ethernet' -ServerAddresses [Link]
```

Step 8 — Promote DC-RED-01: Create new forest [Link]

On DC-RED-01: Install AD DS and DNS, then create a new forest '[Link]'. You can do this
via Server Manager or PowerShell.

Server Manager (GUI) steps:

1. Server Manager → Add roles and features → Role-based or feature-based installation →
Select the local server → Choose 'Active Directory Domain Services' and 'DNS Server' →
Install.
2. After installation, in Server Manager click the flag → Promote this server to a domain
controller → Add a new forest → Root domain name: [Link] → Enter DSRM password →
Continue through defaults (DNS/DNS delegation warnings OK) and install.

PowerShell example (run as Administrator):

```powershell
Install-WindowsFeature AD-Domain-Services, DNS -IncludeManagementTools
Import-Module ADDSDeployment
$SafePass = ConvertTo-SecureString 'P@ssw0rd!23' -AsPlainText -Force
Install-ADDSForest -DomainName '[Link]' -SafeModeAdministratorPassword $SafePass
```

After reboot, log in as RED\Administrator.

Step 9 — Promote DC-RED-02 (additional DC in [Link])

On DC-RED-02: Set static IP ([Link]) and set preferred DNS to DC-RED-01 ([Link]).
Install AD DS role and promote to domain controller in existing domain '[Link]'. Choose
to make it a Global Catalog and place it in the default site. After promotion, verify
replication:

Verification commands (on DCs):

```powershell
repadmin /replsummary
dcdiag /v
Get-ADDomainController -Filter * | ft Name,IPv4Address,IsGlobalCatalog
```

Step 10 — Create Branch Domain Controllers and AD Sites

For each branch server (BR1-DC, BR2-DC, BR3-DC):

1. Set static IPs ([Link], [Link], [Link]) with gateway to RRAS router ([Link]).
Preferred DNS: [Link] (DC-RED-01) during promotion.
2. Install AD DS role and promote as either RODC (recommended for offline branches) or
writable DC. Use the 'Add a domain controller to an existing domain' option.
3. In Active Directory Sites and Services (on DC-RED-01), create Sites named 'Branch1',
'Branch2', 'Branch3', and assign subnets ([Link]/24 etc) to each site so replication is site-
aware.

Step 11 — Create [Link] domain in the same forest

Two options: Add a new domain to the forest (child domain or new domain tree). GUI steps:

1. On a new server (YEL-DC-01), set static IP [Link] and point DNS to DC-RED-01
([Link]).
2. Install AD DS role.
3. Promote server → Add a new domain to an existing forest → Choose 'Create a new domain
in an existing forest' → Domain type: Domain in new tree or child domain as per design →
Enter '[Link]' and provide credentials for an account with permission to add domains
(Enterprise Admins).

PowerShell example for adding a new domain controller to a new domain requires more
complex commands; GUI is recommended for beginners.

Step 12 — Create [Link] (separate forest)

On GRN-DC-01: Set IP [Link] and configure DNS to itself. Install AD DS and promote to
create a new forest '[Link]'. This forest is separate and independent.
Step 13 — DNS configuration
On each DC (for its domain): ensure forward lookup zones exist for [Link], [Link],
[Link]; create reverse lookup zones for each subnet. Configure conditional forwarders:
on Red DCs, add conditional forwarder for [Link] -> [Link]; on Green DC, add
conditional forwarder for [Link] -> [Link].

Verification: Use nslookup to test resolution across domains:

```powershell
nslookup [Link]
nslookup [Link]
```

Step 14 — Configure RRAS (Windows router)

On RRAS-ROUTER VM:

1. Install Remote Access role with Routing and Remote Access service via Server Manager.
2. Open Routing and Remote Access console → Right-click server → Configure and Enable
Routing and Remote Access → Choose 'Custom configuration' → Select 'LAN routing'.
3. Configure NICs: One NIC connected to 'WAN' (acts as backbone) with IP e.g.,
[Link] (or [Link] as HQ gateway). Additional NICs to site virtual switches if
required.
4. Add static routes (if needed) or enable LAN routing and configure NAT for internet
access.

Test routing using ping from a server in Branch1 to a server in HQ. If ping fails, check
firewall rules and ensure RRAS is started.

Step 15 — DHCP configuration

Install DHCP Role on a server (can be FS-RED-01 or a dedicated DHCP server). Steps:

1. Server Manager → Add Roles and Features → DHCP Server → Install.

2. After install, authorize DHCP in Active Directory (DHCP console → Right-click IPv4 →
Authorize).
3. Create scopes for each subnet: e.g., HQ scope [Link]–[Link]; Branch1 scope
[Link]–[Link], etc.

Static reservations: Reserve IPs for servers and network devices (routers) outside scope
ranges.
Step 16 — File Services & DFS
On FS-RED-01 (File Server):

1. Install 'File Server' and 'DFS Namespaces' and 'DFS Replication' roles/features.
2. Create shared folders for Departments: D:\Shares\Finance, D:\Shares\HR, D:\Shares\IT.
3. Set NTFS permissions: Finance_Admins = FullControl, Finance_Edit = Modify,
Finance_Read = Read.
4. Create a domain-based namespace: \[Link]\Shares, add folder targets pointing to FS-
RED-01 (and later to DFS targets on branch file servers if you add them).
5. Configure DFS Replication group: Add members (FS-RED-01 and branch file servers) and
configure schedules and bandwidth throttling.

Verification: Create a file in the namespace target on FS-RED-01, then check other replicated
targets after replication window.

Step 17 — Group Policy creation & key settings

Open Group Policy Management Console (GPMC) on a Domain Controller. Recommended
GPOs:

1. Default Domain Policy: Configure Password Policy and Account Lockout (Min length 12,
Complexity enabled, Expiration 90 days, Lockout 5 attempts).
2. OU-level GPO: 'Workstation Security' — disable USB storage, configure Windows Firewall
rules, enforce screensaver lock.
3. 'FolderRedirection' GPO — redirect Documents to \[Link]\Shares\Profiles\
%USERNAME%.
4. 'DriveMapping' GPO — Preferences → Windows Settings → Drive Maps to map \[Link]\
Shares\Finance to \drive F: for Finance group.

Use 'gpupdate /force' on client VMs and 'gpresult /r' to verify policy application.

Step 18 — Create Trusts between Forests

On a RedForest Enterprise Admin account: Active Directory Domains and Trusts → Right-
click [Link] → Properties → Trusts → New Trust → Follow wizard: enter '[Link]' →
Two-way → Forest trust → Provide credentials for [Link] admin when prompted.

PowerShell (example, run on a DC with AD module):

```powershell
New-ADTrust -Name '[Link]' -Source '[Link]' -Target '[Link]' -ForestTransitive -
TrustType 'Forest' -Direction 'Bidirectional'
```
After creating trust, validate with 'Active Directory Domains and Trusts' → 'Validate'. Also
test by creating a resource in [Link] and attempting access by a [Link] user (with
permissions).

Step 19 — Delegation of Administration and Permissions

OU structure (example):
- OU=Red_HQ
- OU=Users
- OU=Computers
- OU=Servers
- OU=Red_Branch1
- OU=Yellow
- OU=Green

Delegation examples:
- Use 'Delegation of Control' wizard on OU=Red_Branch1 to delegate 'Create, delete, and
manage user accounts' to 'Branch1-Admins' group.
- Create security groups: Finance_Edit, Finance_Read, Finance_Admins and apply NTFS
permissions on shares.

Step 20 — Backup & Restore (System State and Files)

Install Windows Server Backup feature on DCs and File Servers. Configure scheduled daily
incremental and weekly full backups to a mounted VHDX or network share (simulate offsite
by using a separate storage VM).

To backup system state with PowerShell example:

```powershell
wbadmin start systemstatebackup -backuptarget:E: -quiet
```

To restore AD system state or perform authoritative restore, follow Microsoft recovery

procedures (this guide lists the high-level steps; test in lab). Always document steps and
test them.

Step 21 — Testing & Demonstration Checklist

- Local login at Branch when WAN simulated down (stop WAN virtual switch or disable
RRAS NIC)

- Local login when WAN up and access to DFS share

- Yellow user accessing Red application share (\FS-RED-01\App)

- Red admin managing Yellow user account (show delegation)

- Green user access via trust (if enabled) or show selective authentication blocking

- DFS replication: create file on FS-RED-01 and verify replication target(s)

- GPO application: gpresult /r on client shows applied GPOs

- DNS resolution across domains using nslookup

- DHCP leases issued per subnet

- Backup restore a test file from Windows Server Backup

Step 22 — Useful PowerShell snippets

Install AD DS & create new forest:

Install-WindowsFeature AD-Domain-Services, DNS -IncludeManagementTools

Import-Module ADDSDeployment
$SafePass = ConvertTo-SecureString 'P@ssw0rd!23' -AsPlainText -Force
Install-ADDSForest -DomainName '[Link]' -SafeModeAdministratorPassword $SafePass

Promote additional DC:

Install-WindowsFeature AD-Domain-Services
Install-ADDSDomainController -DomainName '[Link]' -Credential (Get-Credential) -
InstallDns -NoGlobalCatalog:$false

Set static IP:

New-NetIPAddress -InterfaceAlias 'Ethernet' -IPAddress [Link] -PrefixLength 24 -

DefaultGateway [Link]
Set-DnsClientServerAddress -InterfaceAlias 'Ethernet' -ServerAddresses [Link]

Create forest trust:

New-ADTrust -Name '[Link]' -Source '[Link]' -Target '[Link]' -ForestTransitive -

TrustType 'Forest' -Direction 'Bidirectional'

Check replication:

repadmin /replsummary
dcdiag /v
Step 23 — Troubleshooting Tips
Common problems and fixes:

- DNS issues: Ensure DCs point to local DNS first. Use 'ipconfig /flushdns', 'ipconfig
/registerdns', and 'nslookup' to debug.
- Replication failures: Use 'repadmin /showrepl' and check event logs (Directory Service
log).
- GPO not applying: Run 'gpupdate /force' and 'gpresult /r' to see state. Check scope,
security filtering, WMI filters.
- RRAS routing: Ensure Windows Firewall allows ICMP for ping testing or disable firewall
temporarily for troubleshooting.
- DHCP issues: Verify server is authorized in AD and scopes are active.

Appendix A — Useful Notes & Links

- Keep your ISOs in a single folder for easy access.
- Document all changed passwords and VM snapshots.
- Create checkpoints before major changes (note: checkpoints on DCs can cause USN
rollback; use with caution and only on non-production lab controllers or use export/import
technique).
- Snapshot policy: prefer export/import for DCs; if using checkpoints, document
consequences.