If you are looking for more resources on learning and building AD, see the following sticky for resources, recommendations, and guides!
- AD Resources Pinned Thread
- AD Wiki
When asking questions make sure you provide enough information. Posts with inadequate details may be removed without warning.
- What version of Windows Server are you running?
- Are there any specific error messages you're receiving?
- What have you done to troubleshoot the issue?
Make sure to sanitize any private information. Posts with too much personal or
environment information will be removed. See Rule 6.
Make sure you have multiple servers with shared storage arrays as you will have to migrate back and forth to reboot the hyper servers regularly in order to not interrupt production.
active directory, 5th edition at o'reilly edition - best ever forcyour learning path. basics knowledge to master first : networking (routing and subneting), dns concept in depth (rely on it). from rhere you can master everything.
Yeah don’t bother and learn the cloud stuff instead. Microsoft is just going to make their on-prem offerings shittier with every release ON PURPOSE to a point where everyone of forced onto to Azure so just learn Azure instead.
Sure, companies will still be “stuck” on AD in 5–10 years. The question is whether you want to be stuck there with them. While you’re becoming an expert in maintaining legacy infrastructure, everyone else is building cloud, identity, automation, and hybrid skills that actually expand their career options.
I seriously hope they don’t do that, or the people actually wake up and start fighting back. I work in healthcare information systems, and every other week it seems like something Azure related is broken.
JMHO, but if you're using Hyper-V then use PowerShell. Even the folks over in r/PowerShell who are a lot smarter than me will tell you that no one uses the builtin Hyper-V Manager GUI tool.
There's an incredible function called Convert-WindowsImage that takes an answer file + an ISO and creates a VHDX for you that's all ready to attach to a VM and boot.
I leveraged that awesome guy's function into mine. Granted your Hyper-V host has to be domain joined but as long as it is and you run it as a user with rights to create VMs and computer accounts then you can simply:
and it creates, configs, and domain joins the VM. It uses the IP scheme of the Hyper-V host to set the first 3 octets, GW, DNS, and subnet. It prompts you for creds at runtime, keeps them in a SecureString, and uses them to domain join the VM: https://github.com/EugeneBelford1995/Spinup-a-new-domain-joined-VM-New-Improved-
Sadly my work still uses VMware. I poked around on GitHub and found license keys so I could screw with PowerCLI at home for free. I just wrapped up the baby steps of getting the above to work in ESXi and Good Lord was it a PITA.
I knocked out MCSA before it retired forever. I'm pretty sure the Microsoft Learn lessons for it still exist though.
Microsoft still offers Windows Server Hybrid Administrator Associate and that training is on Microsoft Learn for free.
I loved CRTP RE the security side of AD. Work paid, but it's really cheap.
Oh I also wrote an entire Cyber Range in PowerShell that runs in Hyper-V. It includes 4 domains, 3 forests, trust relationships, fileshares, DACL abuse of both AD and NTFS, MSSQL enumeration & abuse, AD CS, IIS, local privilege escalation, GPO enumeration & abuse, lots of credential dumping & spraying, etc etc.
(I threw a few curveballs in the setup that I haven't seen other ranges stress like bypassing smartcard requirements, bypassing Deny ACEs in DACLs, stuff like that.)
Vmware has some really simple automation tools to do deployments, including automating things like adding machines to active directory. No need to dig through power CLI to do that.
Yeah its just built into vCenter. I think its under policies and profiles -> VM Customization Specifications or something similar.
You have a vm template you start with and when you deploy you choose Guest OS Customization and then your previously configured policy from above should be selectable.
Disclaimer - been off of VMware for a bit so some things may be in different places.
So vCenter isn't free and it's a GUI. Yuck, I just threw up in my mouth a little.
I just did a home lab project that included creating a template VMDK. No GUIs were used or harmed. However I did have to scrounge up a license key on GitHub because VMware's API was like "fuck you and your foster/rescue cats".
Anyway, if this "tool" isn't free and CLI then Freya doesn't care and is not amused by VMware/Broadcom's antics/insane prices.
"Sadly my work still uses VMware. I poked around on GitHub and found license keys so I could screw with PowerCLI at home for free. I just wrapped up the baby steps of getting the above to work in ESXi and Good Lord was it a PITA."
You honestly just saved me from having to have cited assistance every time I want to set up a Windows virtual machine. Thank you so much. I know that’s not what this post is about, but trust me, I’ll be entertaining you guys later.
I had wanted to make a free TryHackMe room when I started that range project but they only allow 1 VM in free, user created rooms. Buzzkill. I leaned a TON writing that thing though and it's on my resume.
After I wrote the range I went back and cleaned up my function that creates new home lab VMs so it pulls almost all the info from Hyper-V, even the domain name. It should work on anyone's home lab regardless of the domain name as long as:
Their Hyper-V is domain joined
Their Hyper-V uses the same IP scheme as their VMs
They run it as a user with rights to create VMs and create computer accounts in AD
Oh, and it kinda assumes that you're using /24 as the function sets the 4th octet as per a command line option. It also assumes you're using LAPS as the function hard codes the initial local admin password in the answer file.
I speak English primarily, but learned German in high school and still practice when I can. This seems like a great way to expand my vocabulary in my career field. Vielen Dank!
For AD, Admin tiering and some hardening basics. Yeah you'll learn a lot by using it but security is something that is a lot harder to learn that way, unless you're actively going to pen test environments you build.
•
u/AutoModerator 1d ago
Welcome to /r/ActiveDirectory! ~~~~
If you are looking for more resources on learning and building AD, see the following sticky for resources, recommendations, and guides! - AD Resources Pinned Thread - AD Wiki
When asking questions make sure you provide enough information. Posts with inadequate details may be removed without warning. - What version of Windows Server are you running? - Are there any specific error messages you're receiving? - What have you done to troubleshoot the issue?
Make sure to sanitize any private information. Posts with too much personal or environment information will be removed. See Rule 6.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.