Lab 2 — Active Directory, DNS & DHCP

Goal: promote a domain controller and run the three core directory services. Time: ~3 hours.

Part 1 — Promote DC01

Install-WindowsFeature AD-Domain-Services, DNS -IncludeManagementTools

Reboot, then:

Install-ADDSForest `
  -DomainName "corp.local" `
  -DomainNetbiosName "CORP" `
  -InstallDns:$true `
  -Force

# Verify
Get-ADDomain
Get-ADForest
Get-Service NTDS, DNS

Promote a DC on a VM you can roll back. Promoting in place and then deciding you want to try again means rebuilding the machine.

Part 2 — DNS

The domain is registered automatically. Add records for your servers:

Add-DnsServerResourceRecordA -ZoneName "corp.local" `
  -Name "srv01" -IPv4Address 192.168.10.11
Add-DnsServerResourceRecordA -ZoneName "corp.local" `
  -Name "cli01" -IPv4Address 192.168.10.50

# Reverse lookup — the most commonly forgotten record type
Add-DnsServerResourceRecordPtr -ZoneName "10.168.192.in-addr.arpa" `
  -Name "11" -TargetHost "srv01.corp.local"

Verify:

Resolve-DnsName srv01.corp.local
Resolve-DnsName -Type PTR 192.168.10.11
Resolve-DnsName -Type SRV _ldap._tcp.dc01.corp.local

Part 3 — DHCP

Install-WindowsFeature DHCP -IncludeManagementTools

Add-DhcpServerv4Scope -Name "CorpScope" `
  -StartRange 192.168.10.50 -EndRange 192.168.10.200 `
  -PrefixLength 24 `
  -DefaultGateway 192.168.10.1 `
  -DnsServer 192.168.10.10

Set-DhcpServerv4OptionValue -ScopeId 192.168.10.0 `
  -OptionId 6 -Value 192.168.10.10
Set-DhcpServerv4OptionValue -ScopeId 192.168.10.0 `
  -OptionId 15 -Value "corp.local"

Start-Service Dhcp

Get-DhcpServerv4Scope
Get-DhcpServerv4Lease -ScopeId 192.168.10.0

Part 4 — Join a machine

On SRV01:

Add-Computer -DomainName "corp.local" -Credential (Get-Credential)
Restart-Computer

Verify:

nltest /dsgetdc:corp.local
whoami /all

Part 5 — Break DNS deliberately

This is the point of the lab.

# On DC01, delete the record
Remove-DnsServerResourceRecord -ZoneName "corp.local" `
  -Name "srv01" -Type A -Force

On CLI01:

ipconfig /flushdns
nslookup srv01.corp.local      # fails to resolve
ping 192.168.10.11             # still works — DNS only
ping srv01.corp.local          # fails

Name resolution is independent of IP connectivity. This exact split — ping-by-IP works, ping-by-name doesn't — is one of the most common real tickets, and you can now explain it from experience rather than theory.

Restore the record, then confirm nslookup works again.

Part 6 — Break DHCP deliberately

Set an absurdly short lease so exhaustion happens quickly:

Set-DhcpServerv4Scope -ScopeId 192.168.10.0 -LeaseDuration 00:02:00

Watch it:

Get-DhcpServerv4LeaseStatistics -ScopeId 192.168.10.0

Now release and renew CLI01 repeatedly until it fails:

ipconfig /release
ipconfig /renew

When it fails, ipconfig /all shows 169.254.x.x.

A machine with 169.254.x.x has failed DHCP. That is never a client fault — it points at the server, the scope, the VLAN, or a firewall between them.

Then raise the lease back to 8 days:

Set-DhcpServerv4Scope -ScopeId 192.168.10.0 -LeaseDuration 8.00:00:00

Part 7 — Create users

New-ADUser -Name "Ravi Kumar" -SamAccountName "ravi" `
  -Path "OU=IT,DC=corp,DC=local" `
  -AccountPassword (ConvertTo-SecureString "Passw0rd!2026" -AsPlainText -Force) `
  -Enabled $true -PasswordNeverExpires $false

New-ADGroup -Name "IT Support" -GroupScope "Global" -Path "OU=IT,DC=corp,DC=local"
Add-ADGroupMember -Identity "IT Support" -Members "ravi"

Force a password change on next logon so you can practise the reset flow:

Set-ADAccountControl -Identity "ravi" -ChangePasswordAtLogon $true

Part 8 — Break authentication deliberately

# Lock the account on purpose
net user ravi /active:no

# Then confirm from the DC
net user ravi /active:yes

net user ravi output showing "Account locked out" is worth having in your lab repository. It is the exact output an interviewer wants described.

Verification

0 / 7 complete

corp.local forest created, Get-ADDomain confirms it
Forward and reverse DNS records created and resolving
DHCP scope handing out addresses with the right options
A member server joined to the domain
Deleted a DNS record and proved IP still worked while names failed
Reproduced DHCP exhaustion and saw 169.254.x.x
Locked and unlocked a user account with net user

Hints

Details

Promotion fails

Check the hostname is not a NetBIOS-invalid name, that there is no existing corp.local, and that you rebooted after installing the roles.

Details

Client gets 169.254.x.x

On the DC: is the Dhcp service running? Is the scope active? Does the client reach the DC on UDP 67/68 — check the VM switch and any firewall. Then Get-DhcpServerv4Lease to see whether the request arrived at all.

Solution

Show the core commands

# Promote
Install-WindowsFeature AD-Domain-Services, DNS -IncludeManagementTools
Install-ADDSForest -DomainName "corp.local" -DomainNetbiosName "CORP" `
  -InstallDns:$true -Force

# DNS
Add-DnsServerResourceRecordA -ZoneName "corp.local" -Name "srv01" -IPv4Address 192.168.10.11
Add-DnsServerResourceRecordPtr -ZoneName "10.168.192.in-addr.arpa" `
  -Name "11" -TargetHost "srv01.corp.local"

# DHCP
Add-DhcpServerv4Scope -Name "CorpScope" -StartRange 192.168.10.50 `
  -EndRange 192.168.10.200 -PrefixLength 24 `
  -DefaultGateway 192.168.10.1 -DnsServer 192.168.10.10
Set-DhcpServerv4OptionValue -ScopeId 192.168.10.0 -OptionId 6 -Value 192.168.10.10

# Join
Add-Computer -DomainName "corp.local" -Credential (Get-Credential)

# Diagnose
nltest /dsgetdc:corp.local
Get-DhcpServerv4LeaseStatistics -ScopeId 192.168.10.0
net user ravi

Lab 3 — Group Policy & Delegation.

Was this page helpful?

Part 1 — Promote DC01​

Part 2 — DNS​

Part 3 — DHCP​

Part 4 — Join a machine​

Part 5 — Break DNS deliberately​

Part 6 — Break DHCP deliberately​

Part 7 — Create users​

Part 8 — Break authentication deliberately​

Verification​

Hints​

Solution​

Next​