~/work / enterprise-it-lab

Enterprise IT Lab

An Active Directory environment built and documented step by step, run the way an enterprise would run it, as the baseline for a later move to Entra ID and Intune.

Why build it

Most organisations still run hybrid. A clean move to Intune starts from a known, documented on-prem baseline: the Group Policy, LAPS and BitLocker configuration you are going to migrate. The lab is that baseline, built from scratch so every decision is mine and written down.

The full documentation and scripts are public: Enterprise-IT-Lab on GitHub.

What is in it

• A domain controller running AD DS and DNS, and a domain-joined Windows 11 workstation.
• One OU root split by object type, so policies can target computers and users separately, with new computers redirected to the Workstations OU.
• Group Policy for a logon banner, a Control Panel lockdown filtered to the Sales group only, and Remote Desktop limited to IT through Group Policy Preferences.
• Windows LAPS: every workstation gets a unique, encrypted, rotating local admin password stored in AD, readable and decryptable only by one dedicated group.

Every control is tested twice: as a user who should be allowed and as one who should be denied.

Decisions worth explaining

• Security filtering after MS16-072. User policies are read in the computer’s context, so the filtered GPO keeps Authenticated Users with Read but not Apply. Remove it and the GPO silently applies to nobody.
• Preferences Update instead of Restricted Groups. Restricted Groups replaces local group membership and can wipe existing members across the fleet. Update only adds.
• LAPS decryptor scope. The authorised decryptor replaces Domain Admins rather than adding to them, and it is fixed when the password is encrypted. A dedicated group holding both IT and Domain Admins avoids locking out recovery.
• Changing group scope keeps the SID. Converting the LAPS reader group from Global to Domain Local in place keeps every permission and every encrypted password valid. A new group would mean re-granting and re-encrypting everything.

PowerShell

The build scripts read their values from a config file, support -WhatIf, stop on the first error and skip anything already in place, so they can be re-run against a live domain. A guard stops them from running against the wrong domain, and PSScriptAnalyzer lints every change in CI.

What is next

Separate admin accounts so that everyday accounts lose admin rights, a delegated domain-join account with the machine account quota set to zero, BitLocker with recovery keys in AD, then Entra Connect, hybrid join and Intune.