build-lab 2.0 is out. The PowerShell script I published to build a lab AD domain controller from a Windows…
Daniel O. — Senior Cybersecurity Consulting Engineer | EDR/XDR · Zero Trust · Architecture & Engineering | CISSP · CCSP · GIAC
build-lab 2.0 is out. The PowerShell script I published to build a lab AD domain controller from a Windows Server ISO now builds domain-joined member servers too. No GUI, no clicking Next, nothing outside what Microsoft and VMware ship.
Version 1.0 built one DC. It was a nice start, but I finally had time to expand it. OK, fine, I needed more functionality for a project.
Tell the script how many member servers you want and it builds SRVR-01, SRVR-02 and so on once the DC checks out, then joins them to the domain. Already have a DC from last week? Point -AddMemberServers at it and it adds members without touching the DC.
I also fixed some of the compromises that "worked" but didn't make me happy in 1.0. The script decided promotion had succeeded by watching for ntds.dit to appear, waiting a bit, and calling it good. That was optimistic. Promotion reboots the guest out from under vmrun, so there is no exit code to read, and a database file on disk is a long way from a working DC.
Now the DC also has to reboot and come back reporting itself as a domain controller in the domain you asked for. Miss any of that and the run fails and tells you which check it missed. Some builds that used to "succeed" will now fail. That is the point.
A few smaller fixes came out of reviews and live runs.
- Static addresses are pinged before use, and invalid NAT addresses are rejected before the build starts
- Every vmrun call has a time limit, so a stuck call cannot hold the run open forever
- The -SkipVmBuild switch now stops if the VM is already a domain controller, before it can delete the deployment logs
The rest are in the README.
It is still a lab tool, and it still makes lab-grade security trades that the README spells out. You also still have to log in once as Administrator to kick off directory population. I haven't changed my mind on that one yet, but it is annoying me.
Would you believe some people don't have 100% Windows Server 2025 estates? Apparently so. That's on the list.
The repo is in the first comment.
4 reactions · 1 comments
Comments
Daniel O.: build-lab 2.0 is on GitHub, along with the README and the full list of what changed since 1.0. https://github.com/0x44616e69656c/build-lab It drives two sibling projects, and you will need both of them next to it on disk. https://github.com/0x44616e69656c/New-VMwareWorkstationVM https://github.com/0x44616e69656c/new-AdDomain