To practice Module 11, you need a live Active Directory environment you can attack and defend. Two options: build from scratch or use a pre-built lab. Both are free.

Option A — Build It Yourself (Recommended)

Building from scratch gives you real experience with the same steps an AD administrator performs — making you a better defender because you understand what normal looks like.

Step 1 — Download Windows Server 2022 Evaluation ISO
Go to microsoft.com/en-us/evalcenter — 64-bit ISO, no credit card, 180-day free eval.

Step 2 — Create a VM in VirtualBox (free) or VMware
Minimum: 2 vCPU, 4 GB RAM, 50 GB disk.

Step 3 — Install Windows Server 2022 Desktop Experience
Choose Standard Evaluation with Desktop Experience for a GUI. Set the Administrator password.

Step 4 — Install the AD DS Role
Server Manager → Add Roles and Features → Active Directory Domain Services.

Step 5 — Promote to Domain Controller
Click the flag icon → Promote this server to a domain controller → Add a new forest → Domain: lab.local → set DSRM password → reboot.

Step 6 — Create Lab Users and Groups
Active Directory Users and Computers → create 5–10 users at different privilege levels. Create a service account with an SPN set (for Kerberoasting practice). Add one account to Domain Admins.

Step 7 — Join a Windows 10/11 VM to the Domain
System Properties → Change → Member of: Domain → lab.local.

Step 8 — Install Sysmon for Richer Logging
Download from Sysinternals. Use the SwiftOnSecurity config.

Option B — Pre-Built Vulnerable Lab

DetectionLab — Automated build: Windows DC, member server, Splunk, Fleet, and Zeek pre-configured with log forwarding. Best if you want a SOC-ready environment immediately.

GOAD — Game of Active Directory — Multi-domain forest with intentional misconfigurations: ACL abuse, Kerberoastable accounts, AS-REP roasting, DCSync rights. Built for AD attack practice.

Level Up — Forward Your Lab to Splunk

Install the Splunk Universal Forwarder on your Windows Server and point it at your Cover6 First Watch Splunk instance. Your lab attacks will appear in the same Splunk interface where you ran the botsv2 queries. That is the fastest way to build detection intuition.

Get free lab access: cover6solutions.com/product/cover6-first-watch-free-access/

Learning Objective

After this lesson, you have a functioning Active Directory lab environment and can generate and observe the Event IDs from Module 11 in a real Windows environment.

Part of the free Intro to Cyber course by Cover6 Solutions.