Shane Townsend

Active Directory & DNS Lab

A Windows Server 2025 lab, built in VirtualBox, to learn DNS hands-on inside a real Active Directory environment — and to build toward Network+ and a system administrator role.

Goal

Most "Active Directory is broken" tickets are actually DNS problems. This lab builds a domain controller from scratch, breaks things on purpose, and documents the reasoning behind every step — not just the commands.

Environment

  • Hypervisor: VirtualBox
  • Server: Windows Server 2025 Standard (Desktop Experience)
  • Network: isolated NAT + Internal Network (labnet, 192.168.50.0/24) — the domain controller is not exposed to the home network
  • Domain: lab.local, domain controller DC01

What's built so far

  • VM built and Windows Server 2025 installed from the official evaluation ISO
  • Active Directory Domain Services and DNS Server role installed; DC01 promoted to the first domain controller
  • Network isolation corrected: separated outbound internet (NAT) from the actual lab network (isolated Internal Network), after catching the DC sitting directly on the home LAN during verification
  • Static IP and proper hostname (DC01) configured on the isolated network segment
  • Forward lookup zone (lab.local) and reverse lookup zone (50.168.192.in-addr.arpa) confirmed, verified AD's SRV records register correctly against DNS
  • In progress: A, PTR, CNAME and MX record types; forwarders; break-and-fix troubleshooting; PowerShell automation

What I learned

Isolate the domain controller, deliberately. Verifying the setup turned up that the DC had been sitting directly on the home network with a manually-set IP, not the isolated lab segment the plan called for. A domain controller runs DNS, Kerberos, LDAP and SMB — all reachable by anything else on that network if it isn't isolated. Fixed by separating NAT (outbound only) from an isolated Internal Network for the actual domain traffic.

Domain credentials live in Active Directory, not the local SAM. After losing the domain Administrator password with no snapshot to fall back on, the usual offline SAM-edit trick didn't apply — AD's database (ntds.dit) is only mounted while the server is actually running. Recovered by getting a SYSTEM-level prompt at the normal logon screen (via the Ease of Access accessibility swap) after a normal boot, so net user /domain could talk to a live, running AD service — then reverted the swap immediately afterward, since leaving it in place is a known local privilege-escalation technique.

SRV records are how AD actually finds itself. _ldap._tcp.dc._msdcs.lab.local is the record every domain-joined machine queries to locate a domain controller — not a hardcoded IP anywhere. Renaming the DC and re-IP'ing it required no manual DNS edits at all; dynamic DNS re-registered the SRV record automatically within minutes.

Full documentation on GitHub →