Skip to main content
AD Academy

Lab domain script

One PowerShell script builds a lab.local domain from scratch: AD DS role, OUs, groups and 20 users. Lab only!

⚠️ Lab only — never run on a production network

What the script does

  1. 1

    Prepare the server

    Windows Server 2022/2025, static IP, computer name DC1. Without a static IP, DNS will break.

  2. 2

    Install AD DS and promote to DC

    The script installs the role and promotes a new forest lab.local. Keep the DSRM password — no recovery without it.

  3. 3

    OU structure

    Workstations, Servers, Users, Admins, Service Accounts — the base for GPOs and a Tiering model.

  4. 4

    Users and groups

    20 dummy users + Helpdesk and IT groups. One initial password, must be changed at first sign-in.

  5. 5

    Verify

    dcdiag, repadmin /replsum and Get-ADDomain — three checks that the domain is alive.

lab-domain.ps1
# ============================================================
#  AD Academy — учебный домен lab.local
#  Запускать от администратора на свежем Windows Server.
#  ТОЛЬКО для лаборатории — не для рабочей сети!
# ============================================================

# --- Шаг 1. Имя и статический IP (подправьте под свою сеть) ---
Rename-Computer -NewName "DC1" -Force
New-NetIPAddress -InterfaceAlias "Ethernet" `
  -IPAddress 192.168.10.10 -PrefixLength 24 -DefaultGateway 192.168.10.1
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" `
  -ServerAddresses 127.0.0.1
Restart-Computer   # после перезагрузки продолжайте

# --- Шаг 2. Роль AD DS и новый лес lab.local ---
Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
$dsrm = Read-Host "Пароль DSRM" -AsSecureString
Install-ADDSForest `
  -DomainName "lab.local" `
  -DomainNetbiosName "LAB" `
  -SafeModeAdministratorPassword $dsrm `
  -InstallDns -Force
# Сервер сам перезагрузится как контроллер домена

# --- Шаг 3. Структура OU ---
$root = "DC=lab,DC=local"
"Workstations","Servers","Users","Admins","Service Accounts" | ForEach-Object {
  New-ADOrganizationalUnit -Name $_ -Path $root -ProtectedFromAccidentalDeletion $true
}

# --- Шаг 4. Группы и 20 учебных пользователей ---
New-ADGroup -Name "Helpdesk" -GroupScope Global -Path "OU=Admins,$root"
New-ADGroup -Name "IT"       -GroupScope Global -Path "OU=Admins,$root"

$pass = ConvertTo-SecureString "P@ssw0rd!Lab" -AsPlainText -Force
1..20 | ForEach-Object {
  $u = "student{0:d2}" -f $_
  New-ADUser -Name $u -SamAccountName $u `
    -Path "OU=Users,$root" `
    -AccountPassword $pass -Enabled $true `
    -ChangePasswordAtLogon $true
}
Add-ADGroupMember -Identity "Helpdesk" -Members student01,student02

# --- Шаг 5. Проверка ---
dcdiag /v
repadmin /replsum
Get-ADDomain lab.local
Get-ADUser -Filter * -SearchBase "OU=Users,DC=lab,DC=local" | Measure-Object