EngineerCode / policy labScenario sim

Active Directory Home Lab: Building Hexaguard from Scratch

Build a full company domain for Hexaguard in VirtualBox: one Windows Server domain controller and two Windows 11 clients. Learn DNS, DHCP, OUs, users, groups, domain join, Group Policy, troubleshooting and access reviews, with a live practice console and graded labs.

420 min 1000 XPSkills: VirtualBox lab building, Active Directory, DNS and DHCP, Users, groups and OUs, Group Policy and troubleshooting, Access reviews and evidence

What you'll be able to do

›Build a three-machine Windows domain for Hexaguard in VirtualBox from empty disks
›Configure DNS and DHCP so workstations find the domain and get addresses
›Design OUs and give access through groups with AGDLP
›Join workstations and roll out password rules and a security baseline with Group Policy
›Troubleshoot Group Policy and run a joiner, leaver and access review with evidence

Loading the lessons...

Labs

480 bonus XP

Hands-on work. You edit the artefact, the server runs the checks: the expectations and the reference solution never reach your browser.

Lab 1 · Domain console lab

Prepare the server for promotion

Briefing 40 XP

You have a freshly installed Windows Server. Give it its name, fixed address and DNS setting, then install the Domain Services role.

Type the commands in the Hexaguard domain console below. The checks replay your commands on a fresh copy of the lab domain, so typing order matters. Press Reset to start again.

The lab domain

Server name now: WIN-7GQ2L0D (random)
Wanted:
  name            HG-DC01 (restart after renaming)
  address         10.0.20.10/24, gateway 10.0.20.1, interface Ethernet
  DNS             the server itself (127.0.0.1)
  role            AD-Domain-Services with management tools
  check           ipconfig

Hexaguard domain console · 0 command(s)

Type help to list commands. Up and down arrows recall earlier commands.

PS HG-DC01>

Checks

Renamed to HG-DC01 and restarted
Fixed address and gateway
DNS points at itself
Domain Services role installed
Settings checked

Lab 2 · Domain console lab

Create the forest and hand out addresses

Briefing 50 XP

HG-DC01 is ready. Promote it into the Hexaguard forest, prove DNS works, then set up DHCP so the clients get proper addresses.

Type the commands in the Hexaguard domain console below. The checks replay your commands on a fresh copy of the lab domain, so typing order matters. Press Reset to start again.

The lab domain

Wanted:
  forest          hexaguard.local, short name HEXAGUARD
  DNS check       look up hg-dc01.hexaguard.local
  DHCP            install, authorize in AD
  scope           "Hexaguard Clients" 10.0.20.100 to 10.0.20.200, mask 255.255.255.0
  options         DNS server 10.0.20.10, router 10.0.20.1
  check           a client's address (Get-NetIPConfiguration -ComputerName HG-WS01)

Hexaguard domain console · 0 command(s)

Type help to list commands. Up and down arrows recall earlier commands.

PS HG-DC01>

Checks

Forest created
DNS proved
DHCP installed and authorized
Scope range
DNS and router options
Client lease checked

Lab 3 · Domain console lab

Build the Hexaguard OU tree

Briefing 40 XP

Create the OU folders Hexaguard needs, all inside one top OU.

Type the commands in the Hexaguard domain console below. The checks replay your commands on a fresh copy of the lab domain, so typing order matters. Press Reset to start again.

The lab domain

Domain: DC=hexaguard,DC=local
Top OU:  Hexaguard
Inside Hexaguard: IT, Finance, HR, Sales, Groups, Workstations, Servers, Leavers

Hexaguard domain console · 0 command(s)

Type help to list commands. Up and down arrows recall earlier commands.

PS HG-DC01>

Checks

Hexaguard top OU
Team OUs
Workstations and Servers
Groups and Leavers
Nothing loose at the domain top

Lab 4 · Domain console lab

Add Finance and Sales staff with AGDLP

Briefing 50 XP

Some staff already exist. Add the three new people and set up Finance folder access the AGDLP way.

Type the commands in the Hexaguard domain console below. The checks replay your commands on a fresh copy of the lab domain, so typing order matters. Press Reset to start again.

The lab domain

New staff (all enabled, with a starting password):
  Amara Okafor  amara.okafor  Finance  Finance Manager
  Tunde Bello   tunde.bello   Finance  Accountant
  Lola James    lola.james    Sales    Sales Rep
Groups (in OU=Groups):
  GG-Finance           Global       members: amara.okafor, tunde.bello
  GG-Sales             exists       add lola.james
  DL-Finance-Share-RW  DomainLocal  members: GG-Finance only

Hexaguard domain console · 0 command(s)

Type help to list commands. Up and down arrows recall earlier commands.

PS HG-DC01>

Checks

Finance staff created
Sales rep created
GG-Finance global group
Lola in GG-Sales
Domain local group nests GG-Finance

Lab 5 · Domain console lab

Join both workstations

Briefing 50 XP

HG-WS01 is ready. HG-WS02 was set up by a contractor and its DNS points at 8.8.8.8. Fix it, then join both into the Workstations OU.

Type the commands in the Hexaguard domain console below. The checks replay your commands on a fresh copy of the lab domain, so typing order matters. Press Reset to start again.

The lab domain

Domain: hexaguard.local, admin HEXAGUARD\Administrator
Target OU: OU=Workstations,OU=Hexaguard,DC=hexaguard,DC=local
HG-WS02 DNS today: 8.8.8.8
Proof: Get-ADComputer -Filter *

Hexaguard domain console · 0 command(s)

Type help to list commands. Up and down arrows recall earlier commands.

PS HG-DC01>

Checks

HG-WS02 uses HG-DC01 for DNS
Both clients joined and restarted
Both in Workstations
Join proved

Lab 6 · Domain console lab

Roll out the Hexaguard baseline

Briefing 60 XP

Set the domain password rules, build the workstation baseline and the staff screen lock, then prove both clients received them.

Type the commands in the Hexaguard domain console below. The checks replay your commands on a fresh copy of the lab domain, so typing order matters. Press Reset to start again.

The lab domain

Password rules: min length 12, complexity on, lockout after 5 for 15 minutes, max age 90 days
GPO "HG Workstation Baseline" (computer settings), linked to OU=Workstations only:
  Deny_All 1, EnableFirewall 1, AuditLogon "Success,Failure"
GPO "HG Staff Screen Lock" (user setting), linked to OU=Hexaguard:
  ScreenSaveTimeOut 600
Refresh HG-WS01 and HG-WS02, then gpresult for amara.okafor on HG-WS01

Hexaguard domain console · 0 command(s)

Type help to list commands. Up and down arrows recall earlier commands.

PS HG-DC01>

Checks

Domain password rules
Baseline settings
Baseline linked to Workstations only
Screen lock for all staff
Both clients refreshed
Result proved

Lab 7 · Domain console lab

Fix the Group Policy that will not apply

Briefing 60 XP

Finance staff do not get drive S:, and HG-WS02 is missing the baseline. Find the three faults, fix them and prove the result.

Type the commands in the Hexaguard domain console below. The checks replay your commands on a fresh copy of the lab domain, so typing order matters. Press Reset to start again.

The lab domain

Complaints:
  1. amara.okafor (Finance) has no S: drive on HG-WS01. GPO: "HG Finance Drive".
  2. HG-WS02 does not block USB sticks. GPO: "HG Workstation Baseline".
Rules: only Finance should get S:. Do not link anything to the whole domain.
Tools: gpresult, Get-GPOReport, Get-ADComputer, Get-GPInheritance

Hexaguard domain console · 0 command(s)

Type help to list commands. Up and down arrows recall earlier commands.

PS HG-DC01>

Checks

Finance drive linked in the right place
Security filtering fixed
HG-WS02 in the right OU
Fixes proved after a refresh

Lab 8 · Domain console lab

Capstone: joiner, leaver and access review

Briefing 80 XP

Process this week's HR ticket and the quarterly access review on the Hexaguard domain.

Type the commands in the Hexaguard domain console below. The checks replay your commands on a fresh copy of the lab domain, so typing order matters. Press Reset to start again.

The lab domain

HR ticket HG-114:
  Joiner: Zainab Musa, zainab.musa, HR Officer, department HR, needs GG-HR
  Leaver: Tunde Bello (tunde.bello) left on Friday. Keep the account for 90 days.
Access review:
  Approved Domain Admins: Administrator, kemi.adebayo
  Policy: disable any user or computer unused for 90 days or more
Evidence: the Domain Admins list and the inactive account list

Hexaguard domain console · 0 command(s)

Type help to list commands. Up and down arrows recall earlier commands.

PS HG-DC01>

Checks

Joiner set up
Leaver closed safely
Domain Admins cleaned
Inactive accounts disabled
Review evidence produced

Lab 9 · Review lab

Judge the Hexaguard audit evidence

Briefing 50 XP

Daniel prepared six evidence items for the auditor. Accept the items that fully prove their claim. Reject the rest with one reason code.

Reason codes: intent-only means the proof shows what was set, not what applied. Stale means it is older than the change it claims. Sample-only means it covers fewer machines than claimed. Wrong-scope means the setting reaches the wrong people.

Verdicts are accept or reject. Every rejection needs one reason code from: intent-only | stale | sample-only | wrong-scope.

Evidence pack, November

HG-1 | Claim: Domain password rules meet policy. Proof: Get-ADDefaultDomainPasswordPolicy output dated 3 Nov: MinPasswordLength 12, LockoutThreshold 5, MaxPasswordAge 90.
HG-2 | Claim: USB storage is blocked on all workstations. Proof: screenshot of the GPO editor showing Deny_All enabled.
HG-3 | Claim: The screen lock is 600 seconds. Proof: gpresult from 12 Oct. The value was changed from 900 to 600 on 1 Nov.
HG-4 | Claim: Both workstations receive the baseline. Proof: gpresult /r from HG-WS01 only, dated 3 Nov.
HG-5 | Claim: Only approved admins are in Domain Admins. Proof: Get-ADGroupMember "Domain Admins" dated 3 Nov showing Administrator and kemi.adebayo, matched to the signed approval list.
HG-6 | Claim: Only Finance gets the S: drive. Proof: Get-GPOReport dated 3 Nov showing HG Finance Drive linked at DC=hexaguard,DC=local with Authenticated Users filtering.

Checks

Every line in the fixture carries a verdict
Accept and reject land on the right lines
Each rejection cites a valid reason code

Next on your path · IT Fundamentals

Git and Pipelines

Follow a change from local Git history through review and a safe, evidence-backed pipeline deployment.

Recruit 55 min 230 XP

Start next room

Community

Discussion & writeups

Share how you approached the room or ask where you got stuck. Never paste task answers or full lab solutions: write the reasoning, not the key.

Loading discussion…

View the IT Fundamentals path