Lab: Create an Active Directory domain and its accounts with correction

What you will learn in this TP

• Install AD DS and promote a domain controller
• Create OUs, users and groups with PowerShell
• Link a GPO and check that it applies

Introduction #

What you will learn in this section

• Install AD DS and promote a domain controller
• Create OUs, users and groups with PowerShell
• Link a GPO and check that it applies

Context. A 30-person company wants to centralize its accounts. You set up the lab domain corp.lab and prepare for users to arrive.

Prerequisites: a Windows Server 2025 VM with a static IP (a second Windows VM to test domain join is a plus)  ·  Estimated duration: 60 min

The corp.lab domain, its OUs, 5 users, AGDLP groups and a GPO checked with gpresult.

Setup #

Guided steps, with their solution.

1. 1. Prepare the server

   Why? A domain controller needs its final name and a static IP before promotion.

   Rename the server SRV-DC01, give it a static IP and point its DNS to itself, then restart.
   See the correction

   Get-NetIPConfiguration
   New-NetIPAddress -InterfaceAlias 'Ethernet' -IPAddress 192.168.50.10 -PrefixLength 24 -DefaultGateway 192.168.50.1
   Set-DnsClientServerAddress -InterfaceAlias 'Ethernet' -ServerAddresses 127.0.0.1
   Rename-Computer -NewName SRV-DC01 -Restart

2. 2. Create the forest

   Why? Install-ADDSForest installs AD DS and integrated DNS in one command.

   Install the AD DS role then create the corp.lab forest (NetBIOS CORP). The server restarts.
   See the correction

   Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
   Install-ADDSForest -DomainName 'corp.lab' -DomainNetbiosName 'CORP' -InstallDns `
       -SafeModeAdministratorPassword (Read-Host -AsSecureString 'Mot de passe DSRM') -Force
   # après redémarrage, se connecter en CORP\Administrateur
   Get-ADDomain | Select-Object DNSRoot, NetBIOSName, PDCEmulator
   dcdiag /q

3. 3. Structure with OUs

   Why? OUs are for delegation and GPO targeting, not for copying the org chart.

   Create OU=CORP with the sub-OUs Utilisateurs, Groupes, Postes and Serveurs.
   See the correction

   $base = 'DC=corp,DC=lab'
   New-ADOrganizationalUnit -Name CORP -Path $base
   'Utilisateurs', 'Groupes', 'Postes', 'Serveurs' | ForEach-Object {
       New-ADOrganizationalUnit -Name $_ -Path "OU=CORP,$base"
   }
   Get-ADOrganizationalUnit -Filter * | Select-Object Name, DistinguishedName

4. 4. Import users

   Why? Bulk creation from a CSV avoids typing mistakes.

   Create a CSV of 5 people (first name, last name, login, department) and import them into the Utilisateurs OU, with password change at first logon.
   See the correction

   @'
   Prenom;Nom;Login;Service
   Jeanne;Dupont;jdupont;Compta
   Karim;Benali;kbenali;Compta
   Lea;Martin;lmartin;RH
   Hugo;Bernard;hbernard;IT
   Sara;Lopez;slopez;IT
   '@ | Set-Content C:\TP\arrivees.csv -Encoding UTF8
   $mdp = ConvertTo-SecureString 'Tp-Corp!2026' -AsPlainText -Force
   Import-Csv C:\TP\arrivees.csv -Delimiter ';' | ForEach-Object {
       New-ADUser -Name "$($_.Prenom) $($_.Nom)" -GivenName $_.Prenom -Surname $_.Nom -SamAccountName $_.Login `
           -UserPrincipalName "$($_.Login)@corp.lab" -Department $_.Service -Path 'OU=Utilisateurs,OU=CORP,DC=corp,DC=lab' `
           -AccountPassword $mdp -Enabled $true -ChangePasswordAtLogon $true
   }
   Get-ADUser -Filter * -SearchBase 'OU=Utilisateurs,OU=CORP,DC=corp,DC=lab' -Properties Department | Select-Object Name, SamAccountName, Department

5. 5. AGDLP groups

   Why? Rights go to resource groups, which contain business groups.

   Create global groups GG_Compta, GG_RH, GG_IT filled by department, and the domain local group DL_Partage_Compta_M containing GG_Compta.
   See the correction

   $ou = 'OU=Groupes,OU=CORP,DC=corp,DC=lab'
   foreach ($s in 'Compta', 'RH', 'IT') {
       New-ADGroup -Name "GG_$s" -GroupScope Global -GroupCategory Security -Path $ou
       Get-ADUser -Filter "Department -eq '$s'" | ForEach-Object { Add-ADGroupMember "GG_$s" -Members $_ }
   }
   New-ADGroup -Name DL_Partage_Compta_M -GroupScope DomainLocal -Path $ou
   Add-ADGroupMember DL_Partage_Compta_M -Members GG_Compta
   Get-ADGroupMember DL_Partage_Compta_M -Recursive | Select-Object Name

6. 6. A first GPO

   Why? A GPO linked to an OU configures every machine it contains.

   Create the GPO SEC - Verrouillage écran (password-protected screen saver after 10 minutes), link it to the Utilisateurs OU, then check with gpresult by logging on as a test user.
   See the correction

   $g = New-GPO -Name 'SEC - Verrouillage écran'
   $k = 'HKCU\Software\Policies\Microsoft\Windows\Control Panel\Desktop'
   Set-GPRegistryValue -Name $g.DisplayName -Key $k -ValueName ScreenSaveActive -Type String -Value 1
   Set-GPRegistryValue -Name $g.DisplayName -Key $k -ValueName ScreenSaverIsSecure -Type String -Value 1
   Set-GPRegistryValue -Name $g.DisplayName -Key $k -ValueName ScreenSaveTimeOut -Type String -Value 600
   New-GPLink -Name $g.DisplayName -Target 'OU=Utilisateurs,OU=CORP,DC=corp,DC=lab'
   # sur un poste joint (Add-Computer -DomainName corp.lab -Restart), session jdupont :
   gpupdate /force
   gpresult /r /scope user

Difficulty level : ●●○○○ (2/5)