11 – Active Directory Administration Fundamentals: Deploying Enterprise Identity Infrastructure

Focus: Microsoft Infrastructure Administration, Active Directory, Windows Server, Enterprise Identity, PowerShell Administration

Technology: Windows Server 2025 Standard Evaluation | Oracle VirtualBox | Windows PowerShell | Active Directory Domain Services (AD DS)

Domain: Microsoft Infrastructure Administration | Identity and Access Management | Enterprise Security Foundations

Objective

Following the successful administration and validation of a standalone Windows Server 2025 environment, this laboratory focused on deploying Active Directory Domain Services (AD DS) and transforming the server into an enterprise identity platform.

Where the previous laboratory concentrated on understanding Windows Server itself, this exercise introduced Microsoft’s traditional identity infrastructure, establishing the foundation upon which authentication, authorisation and enterprise identity management operate.

The objectives of this laboratory were to:

• Install Active Directory Domain Services (AD DS).
• Promote Windows Server 2025 to a Domain Controller.
• Create a new Active Directory forest.
• Configure Active Directory-integrated DNS.
• Validate domain and forest creation.
• Confirm Domain Controller functionality.
• Verify FSMO role ownership.
• Validate Active Directory services.
• Test DNS functionality and service discovery.
• Review default Active Directory users and security groups.
• Validate Windows Firewall configuration after deployment.
• Review Windows Security Events.
• Continue developing an evidence-based administration methodology using PowerShell.

This laboratory represents the transition from Windows Server administration into enterprise identity administration.

Environment Overview

Platform: Oracle VirtualBox

Operating System: Windows Server 2025 Standard Evaluation

Administration Method: Windows PowerShell

Phase: Phase 2 — Microsoft Infrastructure Administration Foundations

Server Configuration

Unlike the previous laboratory, the server no longer operated within a standalone WORKGROUP configuration.

Following Active Directory deployment, it became the first Domain Controller of the newly created corp.lab forest, providing centralised identity and authentication services.

Active Directory Administration Activities

A structured deployment and validation workflow was performed entirely through PowerShell.

Rather than relying solely on graphical administration tools, every major infrastructure component was independently verified using command-line administration, reflecting enterprise operational practices.

The laboratory focused on understanding how Active Directory transforms Windows Server into an enterprise identity platform.

The following administrative areas were examined:

• Active Directory Domain Services installation.
• Domain Controller promotion.
• Forest creation.
• Domain creation.
• Active Directory-integrated DNS.
• Domain Controller validation.
• FSMO role validation.
• Active Directory services.
• Replication health.
• DNS service discovery.
• Default Active Directory users.
• Default security groups.
• Windows Firewall.
• Windows Security Events.

Rather than simply installing Active Directory, every stage of the deployment was validated before progressing to the next administrative task.

Validation Findings

Environment Validation

Before deploying Active Directory, PowerShell was used to verify the administration environment.

Validation confirmed:

• Windows PowerShell 5.1.
• Windows Server 2025 Standard Evaluation.
• Correct server identity.
• Administration performed within the virtual machine rather than the Windows 11 host.

This ensured that all subsequent administrative actions were performed against the intended environment.

Active Directory Deployment

PowerShell confirmed that the Active Directory Domain Services role was available before installation.

Following successful installation of AD DS and the associated management tools, the server was promoted to become the first Domain Controller of a new forest named corp.lab.

During promotion, Windows Server automatically configured:

• Active Directory Domain Services.
• DNS Server.
• Global Catalog.
• SYSVOL.
• Authentication services.
• Enterprise identity infrastructure.

The server restarted automatically following successful deployment.

This marked the transition from standalone server administration to enterprise identity administration.

Domain and Forest Validation

Following reboot, PowerShell validated the successful creation of the new Active Directory environment.

Validation confirmed:

• Domain name.
• Forest name.
• Windows Server 2025 functional levels.
• Active Directory database structure.
• Global Catalog configuration.
• Domain Controller registration.

These checks verified that the identity infrastructure had been successfully established and was operating correctly.

Domain Controller Validation

PowerShell confirmed that the server was operating as a fully functional Domain Controller.

Validation included:

• Correct domain membership.
• Correct DNS hostname.
• Writable Domain Controller status.
• Global Catalog enabled.
• Correct IPv4 addressing.
• Windows Server 2025 operating system.

These findings confirmed that the server was capable of providing enterprise authentication and directory services.

FSMO Role Validation

PowerShell was used to validate ownership of the five Flexible Single Master Operations (FSMO) roles.

Validation confirmed that the newly promoted Domain Controller owned all FSMO roles within the corp.lab forest.

The following roles were verified:

• Schema Master.
• Domain Naming Master.
• PDC Emulator.
• RID Master.
• Infrastructure Master.

This configuration is expected within a single Domain Controller laboratory environment and confirms the successful deployment of the Active Directory infrastructure.

Active Directory Services

Critical Active Directory services were validated to ensure that the identity infrastructure was fully operational.

PowerShell confirmed the successful operation of:

• Active Directory Domain Services (NTDS).
• DNS Server.
• Kerberos Key Distribution Center (KDC).
• Netlogon.

These services provide the core functionality required for:

• Directory storage.
• Authentication.
• Kerberos ticket generation.
• Domain communications.
• Service discovery.

Successful validation demonstrated that the Domain Controller was operating correctly.

DNS Validation

DNS functionality was validated after Domain Controller promotion.

Testing confirmed:

• Successful hostname resolution.
• Correct Domain Controller registration.
• LDAP Service (SRV) record registration.
• Successful Active Directory service discovery.

These results demonstrate the close integration between DNS and Active Directory, highlighting DNS as a critical dependency for enterprise authentication and directory services.

Active Directory Objects

PowerShell was used to review the default identity objects created during forest deployment.

Validation included:

Default users

• Administrator.
• Guest.
• krbtgt.

Default security groups

• Domain Admins.
• Domain Users.
• Domain Computers.
• Domain Controllers.
• Enterprise Admins.
• Schema Admins.
• DnsAdmins.
• Protected Users.

Reviewing these default objects reinforces core identity management concepts including delegated administration, role-based access control and least privilege.

Security Validation

Post-deployment validation confirmed that Windows Firewall remained enabled across all firewall profiles.

Windows Security Event logs were also reviewed.

Observed events included:

• Successful logons.
• Privileged administrative logons.
• User logoff events.

These events provide the operational telemetry relied upon by Security Operations Centres (SOC), SIEM platforms and Detection Engineering teams to monitor authentication activity and investigate security events.

Evidence

All laboratory evidence was collected using PowerShell.

The repository contains command outputs documenting:

• PowerShell version validation.
• Server identity validation.
• AD DS installation.
• Domain creation.
• Forest creation.
• Domain Controller validation.
• FSMO role validation.
• Active Directory services.
• Replication health.
• DNS validation.
• Active Directory users.
• Active Directory groups.
• Windows Firewall.
• Windows Security Events.

GitHub laboratory documentation:

Add your GitHub repository link here.

Operational Interpretation

This laboratory demonstrates the transition from Windows Server administration into enterprise identity administration.

Modern Microsoft enterprise environments build identity services through a layered architecture:

Windows Server

↓

Active Directory Domain Services

↓

Microsoft Entra ID

↓

Hybrid Identity

↓

Enterprise Security

Understanding Active Directory provides the operational knowledge required to administer authentication services, investigate identity-related incidents and support hybrid Microsoft environments.

This knowledge also strengthens future work involving Microsoft Entra ID, Azure administration and identity-focused Detection Engineering.

Key Takeaway

This laboratory reinforced that deploying Active Directory is only the beginning of enterprise identity administration.

Professional infrastructure administration requires systematic validation of every component involved in authentication, authorisation and directory services.

Key concepts developed include:

• Active Directory administration.
• Domain Controller deployment.
• Forest and domain creation.
• Active Directory-integrated DNS.
• PowerShell administration.
• Identity management.
• Kerberos authentication.
• Role-based access control.
• Enterprise troubleshooting.
• Evidence-based administration.
• Security-focused infrastructure management.

These skills establish the on-premises identity foundation required before progressing towards hybrid identity, Microsoft Entra ID integration and cloud security.

Skills Demonstrated

• Windows Server administration
• Active Directory Domain Services deployment
• Domain Controller promotion
• Forest creation
• Domain creation
• Active Directory-integrated DNS
• PowerShell administration
• Domain validation
• Forest validation
• FSMO role validation
• Active Directory service validation
• DNS service discovery
• Identity management fundamentals
• Kerberos authentication
• Role-based access control
• Enterprise troubleshooting
• Windows Security Event analysis
• Windows Firewall validation
• Evidence-based technical documentation
• Security-focused infrastructure administration

Portfolio Context

This laboratory forms part of:

Phase 2 — Microsoft Infrastructure Administration Foundations

Learning progression:

2.1 Windows Server Administration Foundations

↓

2.2 Windows Server Administration Fundamentals

↓

2.3 Active Directory Administration Fundamentals

↓

2.4 PowerShell Administration Fundamentals

↓

2.5 Windows Server Security Fundamentals

This phase develops the infrastructure knowledge required for:

• Windows Server administration.
• Active Directory administration.
• Hybrid identity.
• Microsoft Entra ID integration.
• Microsoft 365 administration.
• Azure administration.
• Identity security.
• Detection Engineering.

This laboratory establishes the core on-premises identity infrastructure required for modern Microsoft enterprise environments and provides the practical foundation for future work involving Group Policy, organisational units, hybrid identity and cloud-based identity management.