03 · Enterprise IT — Windows Server & Active Directory
A Windows domain, built end to end.
A simulated small-business domain built end to end — directory, policy, mail, print, imaging, backup — and run the way a real IT department would run it.
Directory & core services 7
- Active Directory forest with two domain controllersNew forest on the first DC, second DC joined and promoted; static addressing and naming for every server; DHCP clients for workstations.
- DHCP serverRole installed and authorised in AD, scope with gateway and AD-DNS options, dynamic DNS registration verified against domain-joined clients.
- 500 users provisioned by PowerShellCSV-driven, idempotent: department OUs and security groups created on the fly, first.last usernames de-duplicated, group membership assigned, warnings logged.
- File server: public, private and department sharesOne DATA share with a public area, per-user private folders locked to their owner, and department folders — permissions by group, not by person.
- PDC emulator as the time sourceFSMO located, PDC pointed at external NTP, hypervisor time-sync disabled on every DC VM, resync verified in the event log.
- Delegated controlOU-scoped delegation so helpdesk-level admins can do their job without domain-admin rights.
- Root certificate deploymentTrusted-root install through the local-computer certificate store so internal TLS is trusted.
Group Policy & endpoints 7
- Password and lockout policyDomain password policy and account lockout thresholds set and verified through GPO.
- Mapped drives, wallpaper, firewall, logon hoursGroup Policy Preferences map departmental drives; wallpaper and firewall policy enforced; logon hours restricted for one department.
- RDP inside the domainRemote Desktop enabled by GPO with NLA, group membership, firewall rule — and a hardened variant on a non-default port with registry and port-forward changes.
- Print server and printer deploymentPrint & Document Services role, shared network printer, driver hosting, and automatic installation on domain PCs by Group Policy.
- PC imaging with Windows Deployment ServicesReference image captured and deployed by PXE — boot.wim / install.wim, DHCP dependency, NTFS volume, standalone or domain-joined.
- Google Chrome by Group PolicyEnterprise MSI on a share, assigned to the device OU, installed at startup — gpupdate does not install it, a reboot does.
- BitLocker recoveryLocating and verifying a recovery key by identifier when a device is stuck at the BitLocker prompt.
Exchange Server 2019 6
- Exchange 2019 deployment in ADPrerequisites, schema and domain preparation, Mailbox role install, EAC and EMS verified.
- Mailbox databasesDatabase and log paths defined, database mounted, ready for provisioning.
- Inbound routingReceive connectors, accepted domains, MX — how mail from outside reaches the right mailbox.
- Outbound relay through MailgunSend connector through an SMTP relay so mail leaves the building even where port 25 is blocked upstream; extra accepted domain added.
- Distribution groups and transport rulesStatic and dynamic groups with sender restrictions; a rule that drops mail by subject; an automatic disclaimer.
- Journaling, room mailboxes, Outlook clientsJournal every message to a mailbox; a room mailbox that rejects double bookings; Outlook deployed to domain PCs.
Backup & recovery 2
- Veeam Backup & Replication on RAID 5Four disks in RAID 5 as the repository, backup job against a domain controller, deleted files restored — practised end to end.
- Veritas Backup ExecFile server backed up to the web/backup server: devices, jobs, schedule, restore wizard.
Domain names, addresses and hostnames are deliberately absent from these pages.