Lab: Create an Active Directory domain and its accounts

What you will learn in this TP

• Install AD DS and promote a domain controller
• Create OUs, users and groups with PowerShell
• Link a GPO and check that it applies

Introduction #

What you will learn in this section

• Install AD DS and promote a domain controller
• Create OUs, users and groups with PowerShell
• Link a GPO and check that it applies

Context. A 30-person company wants to centralize its accounts. You set up the lab domain corp.lab and prepare for users to arrive.

Prerequisites: a Windows Server 2025 VM with a static IP (a second Windows VM to test domain join is a plus)  ·  Estimated duration: 60 min

The corp.lab domain, its OUs, 5 users, AGDLP groups and a GPO checked with gpresult.

Setup #

Guided steps, with their solution.

1. 1. Prepare the server

   Why? A domain controller needs its final name and a static IP before promotion.

   Rename the server SRV-DC01, give it a static IP and point its DNS to itself, then restart.

2. 2. Create the forest

   Why? Install-ADDSForest installs AD DS and integrated DNS in one command.

   Install the AD DS role then create the corp.lab forest (NetBIOS CORP). The server restarts.

3. 3. Structure with OUs

   Why? OUs are for delegation and GPO targeting, not for copying the org chart.

   Create OU=CORP with the sub-OUs Utilisateurs, Groupes, Postes and Serveurs.

4. 4. Import users

   Why? Bulk creation from a CSV avoids typing mistakes.

   Create a CSV of 5 people (first name, last name, login, department) and import them into the Utilisateurs OU, with password change at first logon.

5. 5. AGDLP groups

   Why? Rights go to resource groups, which contain business groups.

   Create global groups GG_Compta, GG_RH, GG_IT filled by department, and the domain local group DL_Partage_Compta_M containing GG_Compta.

6. 6. A first GPO

   Why? A GPO linked to an OU configures every machine it contains.

   Create the GPO SEC - Verrouillage écran (password-protected screen saver after 10 minutes), link it to the Utilisateurs OU, then check with gpresult by logging on as a test user.

Difficulty level : ●●○○○ (2/5)