Network security & Active Directory lab, and how I run assessments

Results at a glance

• 6VMs: firewall, DC, Windows 10/11, Ubuntu and Kali
• ADdomain with GPOs and hybrid Azure AD sync
• GVMautomated vulnerability scans with remediation tracking
• 1:1pentest training for students in four regions

The lab

• pfSense as the edge firewall: NAT, DHCP, DNS, segmentation between networks, and full logging and monitoring.
• Windows Server as a domain controller running Active Directory, with template user accounts, Group Policy Objects, and Azure AD Connect for hybrid join with password-hash sync.
• Windows 10 / 11 and Ubuntu clients joined to the domain, as realistic targets.
• Kali Linux for scanning, enumeration and exploitation, with OpenVAS / GVM for scheduled vulnerability scans and tracking fixes.

Firewall rules and segmentation are part of the exercise: I check that what should be blocked really is blocked, from the attacker's side.

Windows Server 2016 lab

The Active Directory side started as a dedicated Windows Server 2016 lab in VirtualBox, built with linked clones to save space:

• Windows Server 2016 as the domain controller, with the server name, TCP/IP settings and Remote Desktop configured.
• Windows 10 clients joined to the domain.
• Active Directory template user accounts, so new users get the right settings from the start.
• Group Policy Objects created and linked to enforce settings across the domain.
• Azure AD Connect with password-hash sync for hybrid Azure AD join and seamless single sign-on.

How I run a client assessment

1. Scope and permission in writing. Targets, time window, what's out of bounds, and who to call if something breaks.
2. Reconnaissance and enumeration. Map what is exposed before touching anything.
3. Testing. Web: authentication, access control, injection and misconfiguration, guided by OWASP. AD: weak credentials, excessive privileges, Kerberos and delegation issues. Tools include Nmap, OpenVAS, Nessus, Nikto, OWASP ZAP and Metasploit, plus manual verification so the report has no false positives.
4. Report. Every finding has severity, evidence, business impact and a clear fix. Failed attempts are listed too, because they show what is already working.
5. Retest after fixes, to confirm they hold.

Hardening what I build

The same thinking goes into my infrastructure work: iptables policies that default to deny, SSH keys only, regular patching, and scanning with Nessus, Vuls, OpenVAS and Nikto. Firewall experience comes from Cisco ASA/ASAv, Huawei NGFW, WSA, ESA and WAF.

Teaching

Most of my Fiverr reviews come from one-to-one penetration testing lessons with Kali Linux, for students in the US, UK, Poland and the Gulf. Teaching forces me to explain why an attack works, not just which button to press.