Corporate Active Directory Lab

Project Overview

I built a small corporate Active Directory environment designed around real IT support and systems administration tasks. The lab consists of a Windows Server domain controller hosted in Microsoft Azure and a Windows 11 client computer running locally in VMware Fusion.

Because the two systems were running on completely separate networks, I configured a WireGuard VPN tunnel between them so the local virtual machine could securely communicate with the Azure environment. Once connectivity was established, I configured Active Directory, DNS, organizational units, security groups, user accounts, and joined the VMware workstation to the domain.

Environment

I created a fictional company environment using the domain corp.gilmartintech.test. The Azure-hosted domain controller was configured as DC01, and the local VMware workstation was configured as CLIENT01.

I created organizational units to separate employees and computers by purpose and department, including IT, Sales, Operations, Finance, and HR. I also created corresponding Active Directory security groups so users could be assigned permissions by department instead of managing permissions individually.

Building the Azure Domain Controller

I deployed a Windows Server virtual machine in Microsoft Azure and configured it as the primary domain controller for the lab. The server was given a private Azure network address and configured with the Active Directory Domain Services and DNS Server roles.

I then promoted the server to a domain controller and created the new Active Directory forest corp.gilmartintech.test. After the domain was operational, I used Active Directory Users and Computers to build the organizational structure for the simulated company.

Creating Users and Groups

One of my goals was to practice both traditional GUI-based administration and PowerShell automation. I initially created several employee accounts manually using Active Directory Users and Computers so I could understand the individual steps involved in creating accounts, assigning users to organizational units, and managing group membership.

After becoming comfortable with the manual process, I used PowerShell to automate the creation of roughly 20 additional employee accounts. Users were assigned to department-specific groups such as GG_IT, GG_Sales, GG_Operations, GG_Finance, and GG_HR.

I verified group membership through both PowerShell and Active Directory Users and Computers. This part of the project demonstrated how scripting can make repetitive administrative work significantly faster and more consistent.

Connecting Azure to VMware

One of the more challenging parts of the project was connecting the Azure environment to my locally hosted Windows 11 virtual machine. DC01 existed inside an Azure virtual network, while CLIENT01 was running inside VMware Fusion on my local computer.

To securely connect the two environments, I configured a site-to-client style WireGuard VPN connection. I assigned WireGuard tunnel addresses of 10.200.0.1 for DC01 and 10.200.0.2 for CLIENT01. I also configured Azure Network Security Group rules to allow the WireGuard UDP traffic while restricting access appropriately.

Troubleshooting the VPN Connection

The WireGuard configuration required significant troubleshooting. Initially, CLIENT01 was sending traffic but receiving no response. I used several tools to identify where communication was failing.

Using Windows Packet Monitor, I confirmed that WireGuard packets from my local network were successfully reaching the Azure server. WireGuard logs then showed Invalid MAC of handshake, which narrowed the problem down to the WireGuard peer configuration rather than Azure networking or Windows Firewall.

I compared the active WireGuard public keys on both systems and corrected the peer configuration. Once the keys matched properly, the tunnel successfully completed its handshake and began transferring traffic in both directions.

Configuring Active Directory DNS

After establishing the VPN, I encountered another issue when attempting to locate the domain controller. DNS queries initially pointed CLIENT01 toward the Azure-only address of the domain controller, 172.16.0.4. CLIENT01 could not directly reach that address through the local VMware network.

I configured DNS so the domain controller could also be reached through its WireGuard address, 10.200.0.1. I then verified Active Directory DNS records and the LDAP service record.

The final domain controller test successfully located \\DC01.corp.gilmartintech.test.

Joining CLIENT01 to the Domain

After networking and DNS were working correctly, I joined the VMware Windows 11 workstation to corp.gilmartintech.test. I restarted CLIENT01 and logged into Windows using one of the Active Directory employee accounts instead of the local Windows account.

To verify successful authentication, I ran whoami, which returned corp\amorgan. This confirmed that the workstation was successfully joined to the domain and that Active Directory authentication was functioning across the WireGuard VPN connection.

What I Learned

• Deploying and managing a Windows Server VM in Azure.
• Installing and configuring Active Directory Domain Services.
• Configuring Active Directory-integrated DNS.
• Creating organizational units and security groups.
• Provisioning users manually and through PowerShell automation.
• Managing group membership with PowerShell.
• Configuring Azure Virtual Networks and Network Security Groups.
• Building a WireGuard VPN between Azure and a local VMware environment.
• Troubleshooting VPN handshakes, routing, DNS, and firewall behavior.
• Using packet captures to troubleshoot network traffic.
• Joining Windows workstations to an Active Directory domain.
• Authenticating Windows users with domain credentials.