Windows Server Active Directory Home Lab

Overview

I built a small Active Directory (AD) environment from scratch using VirtualBox, to get hands-on practice with the tools most help desk and junior sysadmin roles use daily: domain controllers, organizational units, Group Policy, and file share permissions.

Environment: 1x Windows Server 2022 VM promoted to a Domain Controller for lab.local, plus 2x Windows 11 client VMs joined to the domain, all on an isolated internal network.

Tags: Windows Server 2022 Active Directory Group Policy DNS VirtualBox

What I Built

Domain Controller setup

Installed Windows Server 2022, configured a static IP, and promoted it to a Domain Controller running AD DS and DNS for a new forest, lab.local.

Organizational Units and Group Policy

Created two OUs — IT and Sales — each with a test user account. I built a Group Policy Object scoped only to the IT OU that pushes a custom desktop wallpaper, and confirmed with gpresult /r and side-by-side login tests that the policy applied to the IT user and correctly did not apply to the Sales user.

Active Directory Domain Services Configuration Wizard showing new forest setup for lab.local — Promoting the server to a domain controller for a new forest, lab.local

gpresult output confirming the IT Desktop Background GPO applied to the IT user — `gpresult /r` confirming the "IT - Desktop Background" GPO applied correctly, scoped only to the IT OU

Security groups and file share permissions

Created IT-Group and Sales-Group security groups, separate from the OUs — OUs organize and apply policy, groups grant access. Set up a shared folder with a nested subfolder, and configured distinct Share and NTFS permissions so each group could access the shared folder, but only IT-Group could access the IT-specific subfolder.

Problems I Ran Into (and How I Fixed Them)

Documenting the troubleshooting was, honestly, more valuable than the happy path:

Windows Home edition can't join a domain. My client VM's install refused to join lab.local. Windows 10/11 Home doesn't support domain join — only Pro, Enterprise, or Education do. Upgraded in place using Microsoft's public generic Pro key, avoiding a reinstall.
A dropped virtual network adapter. After a few days away, the server's network adapter showed as Not Present, and anything touching the domain threw a "Server Down" error. Diagnosed with ipconfig /all and Get-NetAdapter, then resolved by switching the VM's virtual NIC type in VirtualBox and reconfiguring the static IP, since the "new" adapter didn't retain the old settings.
Permission inheritance. After granting Sales-Group access to the parent shared folder, they could also access the IT-only subfolder — NTFS permissions inherit downward by default. Fixed by disabling inheritance on the subfolder and setting explicit permissions.

PowerShell output showing Get-NetAdapter with status Not Present — `Get-NetAdapter` showing the virtual network adapter as "Not Present" — the root cause of a string of downstream errors

What This Demonstrates

Installing and configuring Windows Server, promoting to a Domain Controller
Structuring an AD environment with OUs vs. security groups, and why they're separate
Building and scoping Group Policy Objects, and verifying results
Configuring Share + NTFS permissions and understanding inheritance
Network troubleshooting inside a virtualized lab environment