EngineerCode / policy labScenario sim

Setting up your Mini Enterprise Environment

Build a small company network on your own computer: one Windows Server domain controller and two Windows 11 clients inside VirtualBox, joined to one domain, with users, groups, a Group Policy and the evidence to prove it all works.

180 min 450 XPSkills: VirtualBox networking, Active Directory setup, DNS and DHCP, Domain join, Group Policy evidence

What you'll be able to do

›Create VirtualBox guests on a private NAT Network with a written address plan
›Install Windows Server, promote it to a domain controller and create a domain
›Configure DNS and DHCP so clients find the domain and get addresses
›Join Windows 11 clients and organise users, groups and OUs
›Apply a Group Policy and prove it with gpresult and exported reports

Loading the lessons...

Labs

150 bonus XP

Hands-on work. You edit the artefact, the server runs the checks: the expectations and the reference solution never reach your browser.

Lab 1 · YAML lab

Write your lab build plan

Briefing 50 XP

Before you build, write the plan as YAML Ain't Markup Language (YAML), a simple structured text format. Use numbers for memory sizes and text for names and addresses.

A friend says to use Bridged networking so the lab is easier to reach. The requirements say keep the lab private, so do not follow that advice.

Lab requirements

Domain name: lab.local. Short name: LAB.
Network: VirtualBox NAT Network called LabNet, prefix 10.0.10.0/24, VirtualBox DHCP off.
Domain controller: DC01, fixed address 10.0.10.10, at least 4096 MB memory.
Clients: CLIENT01 and CLIENT02, at least 4096 MB memory each, address from DHCP.
DHCP range on DC01: 10.0.10.100 to 10.0.10.200, DNS option 10.0.10.10.

Checks

Name the domain
Keep the lab on a private NAT Network
Fixed address and enough memory for DC01
Both clients with enough memory
DHCP range and DNS point at DC01

Lab 2 · YAML lab

Prove the build from real output

Briefing 50 XP

Your lab is built. Read the command output below, captured from DC01 and CLIENT01, and copy the facts it proves into the YAML.

One computer in the list is an old leftover from a first attempt. List it as stale, not as a working client.

Output from the lab

PS C:\> Get-ADDomain | Select DNSRoot, NetBIOSName, PDCEmulator
DNSRoot   NetBIOSName PDCEmulator
lab.local LAB         DC01.lab.local

PS C:\> Get-ADComputer -Filter * | Select Name, DistinguishedName
Name      DistinguishedName
DC01      CN=DC01,OU=Domain Controllers,DC=lab,DC=local
CLIENT01  CN=CLIENT01,OU=Lab Computers,DC=lab,DC=local
CLIENT02  CN=CLIENT02,OU=Lab Computers,DC=lab,DC=local
WIN-7Q2K  CN=WIN-7Q2K,CN=Computers,DC=lab,DC=local   (last sign-in 41 days ago)

CLIENT01> ipconfig /all
   IPv4 Address. . . . . . : 10.0.10.101
   Default Gateway . . . . : 10.0.10.1
   DNS Servers . . . . . . : 10.0.10.10

Checks

Domain facts from Get-ADDomain
CLIENT01 network facts from ipconfig
Working clients and the stale leftover

Lab 3 · Review lab

Judge the Group Policy evidence

Briefing 50 XP

You wrote six claims about Finance Desktop Lock for your portfolio. Accept only the claims the evidence fully supports. Reject the rest with one reason code.

Reason codes: wrong-evidence means the proof shows something other than the claim. Sample-only means the proof covers fewer machines than the claim. Wrong-scope means the policy reaches people it should not. Stale means the proof is older than the change it claims to show.

Verdicts are accept or reject. Every rejection needs one reason code from: wrong-evidence | sample-only | wrong-scope | stale.

Claims and their evidence

ME-1 | Amara receives Finance Desktop Lock. Proof: gpresult /r on CLIENT01 today, signed in as amara.okafor, OU=Finance, lists Finance Desktop Lock.
ME-2 | The policy applies to all Finance users. Proof: a screenshot of the GPO editor showing the screen saver settings turned on.
ME-3 | Only Finance staff get the lock. Proof: Group Policy Management shows Finance Desktop Lock linked at lab.local, the top of the domain.
ME-4 | Both clients apply the policy. Proof: gpresult /h from CLIENT01 only.
ME-5 | The 300 second timeout is in force. Proof: gpresult from last Monday; the timeout was changed to 300 on Wednesday.
ME-6 | The policy is defined and applied on both clients. Proof: Get-GPOReport HTML dated today, plus gpresult /h from CLIENT01 and CLIENT02 dated today.

Checks

Every line in the fixture carries a verdict
Accept and reject land on the right lines
Each rejection cites a valid reason code

Next on your path · IT Fundamentals

Git and Pipelines

Follow a change from local Git history through review and a safe, evidence-backed pipeline deployment.

Recruit 55 min 230 XP

Start next room

Community

Discussion & writeups

Share how you approached the room or ask where you got stuck. Never paste task answers or full lab solutions: write the reasoning, not the key.

Loading discussion…

View the IT Fundamentals path