How to Build an Active Directory Penetration-Testing Lab with PowerShell
Summary
Walkthrough builds an isolated two-VM Active Directory lab on Windows Server 2019 and Windows 10, configures AD DS and AD CS, creates deliberately overprivileged accounts, and disables Defender and the firewall for testing, with a warning not to use those settings in or
Key points
- Builds a Windows Server 2019 virtual machine and promotes it to the Domain Controller for the ignite.local forest.
- Installs and configures Active Directory Certificate Services as an Enterprise Root CA for certificate-based testing, including ESC attack paths.
- Creates domain users with deliberate privilege assignments, including a Domain Admin and a user in Backup Operators and Remote Management Users.
- Joins a Windows 10 client to the domain and verifies authentication using a domain account.
- Disables Defender real-time monitoring and Windows Firewall in the lab to avoid interfering with testing tools; the article warns not to apply these settings in production.
- Frames the environment as a controlled lab for practicing enumeration, credential attacks, lateral movement, Kerberos attacks, and AD CS exploitation.
Article Details
- Topic
- Building an isolated Active Directory penetration-testing lab with VMware Workstation, Windows Server, AD CS, and a domain-joined Windows client.
MITRE ATT&CK
T1003.006 · DCSyncDCSync is identified as an attack exercise targeting the lab's privileged domain account.T1021.006 · Windows Remote ManagementWinRM-based remote access and lateral movement are described as lab exercises.T1550.002 · Pass the HashPass-the-Hash is identified as an attack exercise for the lab environment.T1558.003 · KerberoastingKerberoasting is described as an attack exercise against the intentionally configured lab domain.
Vendors
MicrosoftSet the maximum disk size to 60 GB, which matches Microsoft’s recommended minimum for Windows Server 2019.VMwareThis article provides a step-by-step walkthrough to build a lab Active Directory environment in VMware Workstation Pro 17, from creating a Windows Server 2019 VM to promoting it as a Domain Controller for the
Products
VMware Workstation Pro 17This article provides a step-by-step walkthrough to build a lab Active Directory environment in VMware Workstation Pro 17, from creating a Windows Server 2019 VM to promoting it as a Domain Controller for theWindows 10Windows Server 2019 VM to promoting it as a Domain Controller for the ignite.local domain and joining a Windows 10 client.Windows DefenderDisable Windows Defender Real-Time MonitoringWindows Server 2019to build a lab Active Directory environment in VMware Workstation Pro 17, from creating a Windows Server 2019 VM to promoting it as a Domain Controller for the ignite.local domain and joining a Windows 10
Tools
BloodHoundlateral movement, credential harvesting with Impacket and NetExec, Active Directory enumeration with BloodHound, Kerberos ticket attacks, and AD CS exploitation via Certipy.certipyActive Directory enumeration with BloodHound, Kerberos ticket attacks, and AD CS exploitation via Certipy.Evil-WinRMThe Remote Management Users group grants WinRM access, allowing tools like Evil-WinRM to authenticate as ankur and obtain a remote PowerShell session.ImpacketIn a controlled lab environment, real-time protection frequently blocks Metasploit payloads, Impacket tools, Mimikatz, and other offensive security utilities that are legitimate and necessary for security research.Metasploit FrameworkIn a controlled lab environment, real-time protection frequently blocks Metasploit payloads, Impacket tools, Mimikatz, and other offensive security utilities that are legitimate and necessary for security research.MimikatzIn a controlled lab environment, real-time protection frequently blocks Metasploit payloads, Impacket tools, Mimikatz, and other offensive security utilities that are legitimate and necessary for security research.NetExecexercises covering remote RDP enabling, SMB lateral movement, credential harvesting with Impacket and NetExec, Active Directory enumeration with BloodHound, Kerberos ticket attacks, and AD CS exploitation via