Overview and scope
I treated six connected hands-on labs as one infrastructure build instead of six isolated tasks. The environment began with a private virtual network and reusable operating-system templates, then grew into a domain with Windows and Linux members, remote management, storage services, an Apache host, and centralized Linux logging.
This was a controlled lab environment, not a production deployment. The value of the project was learning how the services depend on one another and how to verify each change before adding the next layer.
Environment built
VMware Workstation provided the isolated systems. A pfSense VM separated the private LAN from the VMware NAT network, while linked clones made it possible to expand the environment without rebuilding every operating system.
| System role | Platform | Purpose |
|---|---|---|
| Gateway | pfSense | WAN-to-LAN routing for the isolated virtual network |
| Domain controller | Windows Server 2025 | Active Directory Domain Services, DNS, DHCP, and Group Policy |
| Domain client | Windows 11 | Domain sign-in, policy testing, remote administration, and share access |
| Linux client | Rocky Linux | Cross-platform identity, Git, account management, and Cockpit |
| Service host | Rocky Linux | Storage, SMB/NFS, Apache, scheduled jobs, and centralized logging |
I assigned hostnames and static addressing where required, configured the pfSense LAN gateway, and validated local and external connectivity before installing roles.
Domain services and policy
On Windows Server, I installed AD DS, DNS, DHCP, and Group Policy Management, created a new forest, and promoted the server to a domain controller. I configured and authorized a DHCP scope with exclusions, gateway, DNS server, and domain options so clients received the information required to locate the domain.
- Created organizational units, users, and groups in Active Directory.
- Joined Windows 11 to the domain and verified that the client received its configuration from DHCP.
- Joined Rocky Linux through realmd and adcli, then verified domain discovery and an Active Directory user sign-in.
- Created and linked Group Policy Objects for user restrictions and desktop configuration.
- Forced policy refresh with gpupdate and generated HTML evidence with Get-GPReport.
Administration and automation
I moved repeated administrative work from the GUI into PowerShell and Bash. Using Windows Admin Center and PowerShell remoting, I queried domain state and created or updated directory objects with commands such as New-ADOrganizationalUnit, New-ADUser, and Set-ADUser.
On Linux, I managed accounts, groups, services, and firewall rules from the shell, used Cockpit for remote administration, and scheduled recurring work with user crontabs. I also configured Git and GitHub CLI, committed a Python connectivity script, and tracked scripts and configuration evidence instead of leaving changes only on individual VMs.
Storage and file services
The storage portion went beyond creating a filesystem. I built XFS volumes, referenced them by UUID in /etc/fstab, and confirmed that mounts survived a reboot. With LVM, I created physical volumes, volume groups, and logical volumes, then expanded a mounted XFS filesystem with lvextend and xfs_growfs.
- Created software RAID arrays with mdadm.
- Simulated a disk failure, verified degraded operation, replaced the member, and monitored the rebuild through /proc/mdstat and mdadm --detail.
- Used rsync with dry runs, exclusions, deletion control, and logging to make file-copy behavior reviewable before execution.
- Configured Samba and NFS shares for Windows and Linux clients, including group-based write access, service startup, host firewall rules, and persistent client mounts.
Web services and centralized logging
I deployed Apache on Rocky Linux, hosted multiple name-based virtual sites from one server, and connected them to Windows DNS with A and CNAME records. I generated a private key, certificate signing request, and self-signed certificate with OpenSSL, then configured an HTTPS virtual host for the lab.
For observability, I configured one Rocky Linux system as an rsyslog collector and another as a forwarding client. Firewall rules allowed the chosen logging traffic, logger generated test events, and tail -f confirmed that the central server received messages containing the client hostname. A cron job repeated the event on a schedule to validate both automation and log delivery.
Validation and troubleshooting
I used service-specific checks rather than assuming that a successful install meant a working environment. Examples included Get-ADDomain, Get-DhcpServerv4Scope, realm list, nslookup, testparm, smbclient, and systemd service status.
When a service failed, I checked the dependency chain in order: addressing and routing, DNS resolution, service state, firewall rules, access permissions, and SELinux context. I also used Wireshark to inspect SMTP and IMAP exchanges in the lab, connecting application behavior to the traffic moving between clients and the server.
Security judgment
Some exercises were useful for understanding protocols but should not be copied directly into production. A real deployment should use supported operating systems, CA-issued certificates, encrypted mail protocols, least-privilege access tokens, restrictive NFS export options, and SELinux in enforcing mode. Anonymous or unencrypted legacy services should be removed rather than treated as portfolio strengths.
The durable security lessons were centralized identity, group-based authorization, controlled firewall openings, configuration validation, resilient storage, centralized logs, and repeatable administration with version-controlled scripts.