In this lab, I built a virtual client-server environment using Windows Server 2025 and Windows 11 to simulate a basic enterprise network.
I configured a domain controller using Active Directory Domain Services (AD DS) and set up DHCP and NAT to support internal network communication. I also joined client machines to the domain, verified connectivity, and performed basic troubleshooting to ensure the environment was functioning correctly.
This repository documents the lab I built and can also be used as a guide for setting up a similar environment.
-
A virtual machine (VM) platform:
- Microsoft Hyper-V (available in Pro, Enterprise, or Education editions of Windows 10 or 11; must be enabled via Windows Features)
- Oracle VirtualBox
- VMware
-
Operating systems used:
- Windows Server 2025 (Standard or Datacenter, Desktop Experience)
- Windows 11 (Pro, Enterprise, or Education edition required to join a domain)
The domain controller is a Windows Server 2025 VM responsible for:
- Managing the domain
- Hosting the internal network
- Storing user accounts
- Add 2 network adapters:
- Adapter 1: NAT
- Adapter 2: Internal Network
When installing the OS, select either Windows Server 2025 Standard (Desktop Experience) or Windows Server 2025 Datacenter (Desktop Experience); if you choose the other editions, you will only get a command-line interface instead of a graphical environment.
After logging into the server, we first want to identify which network adapter is being used for our internal network. The internal adapter should not be set to obtain an IP address automatically from DHCP.
You can view your network adapters by opening Control Panel, navigating to Network and Internet, then Network Connections, or by opening the Settings app, selecting Network & Internet, and choosing Advanced network settings.
Look for an adapter with an IP in the 169.254.x.x range. This is assigned by Automatic Private IP Addressing (APIPA), a Windows fallback feature that automatically gives an IP when no DHCP server is available. Seeing this IP tells us the adapter is for the internal network, while the NAT adapter should already have a valid IP.
Take note of the internal adapter's name and consider renaming it to something like Internal instead of keeping the default Ethernet 2 or similar, which can be confusing.
Open IPv4 properties and set:
| Property | Value |
|---|---|
| IP Address | 172.16.0.1 |
| Subnet Mask | 255.255.255.0 |
| Default Gateway | <empty> |
| DNS Server | 127.0.0.1 |
Note
The default gateway is left blank because the domain controller will act as the gateway.
Note
127.0.0.1 is the loopback address (points to itself). This is preferred over using the NIC IP directly since it continues to work even if the IP changes.
We'll install Active Directory Domain Services (AD DS) and promote the server.
Tip
Rename the server before continuing (instead of WIN-XXXX) to avoid confusion later.
Open Server Manager and select Add Roles and Features. Install Active Directory Domain Services.
After the installation finishes, click the notification flag in Server Manager and choose Promote this server to a domain controller. Select Add a new forest and enter a root domain name, for example MyDomain.lab.
The server will restart automatically once the setup completes.
This allows internal clients to access the internet through the domain controller.
Open Server Manager and select Add Roles and Features, then choose Remote Access. Enable the Routing role service, which automatically includes DirectAccess and VPN.
Go to Tools > Routing and Remote Access, right-click the server, and select Configure and Enable Routing and Remote Access. Choose Network address translation (NAT) and select the external (NAT) adapter.
DHCP automatically assigns IP addresses to client machines.
Open Server Manager, select Add Roles and Features, and install DHCP Server. After installation, open Tools > DHCP, expand IPv4, right-click, and choose New Scope. You can name the scope anything you like, but it's often helpful to name it after the IP range it will assign, for example 172.16.0.100-200. Then, after clicking Next, set the start IP to 172.16.0.100 and the end IP to 172.16.0.200.
Additional settings such as exclusions or lease duration can usually remain default for a lab environment.
When prompted, choose to configure DHCP options now. Set the router (gateway) to the domain controller's internal IP, 172.16.0.1, and the domain/DNS to your domain, for example MyDomain.lab.
Activate the scope when prompted, then authorize the DHCP server by right-clicking the server and selecting Authorize and refresh the window if needed.
Finally, configure the router option by going to IPv4 > Server Options, right-clicking, selecting Configure Options..., enabling 003 Router, and entering the domain controller's internal IP, 172.16.0.1. Once that's done, apply all changes by right-clicking the server, selecting All Tasks > Restart to restart the DHCP service.
Your lab is now ready for client machines to join the domain.
To allow users from client machines to log in, we need to create user accounts.
In Server Manager, go to Tools > Active Directory Users and Computers. We can create a new Organizational Unit (OU) to organize our users. To do this, right-click your domain and select New > Organizational Unit. A dialog will pop up to specify a name.
Once the OU is created, right-click it and select New > User. This will open a dialog where you can specify the user's first name, last name, username, and password.
For your client virtual machine, install the operating system as usual. Only one network adapter is needed, and it must be set to Internal Network, not NAT. This allows it to communicate with the domain controller and receive internet access through it.
Important
You cannot join a domain on Home editions of Windows. You must use Pro, Enterprise, or Education editions of Windows 10 or 11.
When installing Windows, it's recommended to create a local user account instead of signing in with a Microsoft account. Windows 11 may try to force this in newer versions; to bypass it, disconnect the virtual machine's network adapter during setup until you reach the desktop.
When you first reach the desktop, open Command Prompt and run ipconfig to verify that the network adapter was configured properly for the internal network.
If everything is set up correctly, the DNS suffix should match your domain, for example MyDomain.lab, and the default gateway should be the domain controller's IP.
To verify DNS and internet access, run ping www.google.com. If it resolves and returns replies, the client is successfully using the domain controller for network access.
Now that we know the client is connected to the internal network, we can join the domain. Right-click the Start button and select System. In the About window, select the Advanced system settings link. In the new window, go to the Computer Name tab and click Change....
You can rename the computer to something more recognizable. Under the Member of: section, select Domain, and enter your domain name, for example MyDomain.lab. Once done, click OK.
You will be prompted to enter the username and password of a domain account with permission to join. After entering the credentials, the machine will join the domain.
You can then sign out and log back in using a domain user account.