Active Directory Home Lab: A Beginner-Friendly Setup Guide

A home lab turns Active Directory theory into practical experience. This beginner-friendly guide builds a small domain you can use repeatedly for users, groups, DNS, Group Policy and Windows administration practice.

An Active Directory home lab is one of the best ways to learn Windows administration because you can safely create users, break policies, rebuild servers and repeat tasks without affecting a real company. A basic lab needs only a virtualization platform, two Windows Server virtual machines and one or two Windows client VMs.

Keep the lab isolated

Use an internal or otherwise controlled virtual network while building the domain. Add internet access deliberately when you need updates or cloud integration, and understand which virtual adapter provides that access.

What you will learn

Install Windows Server and promote a server to a domain controller.
Understand Active Directory Domain Services and DNS.
Create organizational units, users, groups and computers.
Join Windows clients to the domain.
Apply Group Policy.
Practice administrative delegation and troubleshooting.
Optionally add DHCP, file services, deployment tools or Microsoft 365 integration later.

Plan your computer resources

You do not need enterprise hardware, but virtualization needs RAM and storage. Keep the first lab small. Two domain controllers can each run with modest resources, while Windows 11 clients usually need more memory to remain responsive. Use dynamic memory if your hypervisor supports it and if you understand its behavior.

Design the virtual network

Create a simple internal subnet, for example 10.10.10.0/24. Give servers predictable static addresses and keep a written IP plan. A simple example is DC01 at 10.10.10.10, DC02 at 10.10.10.11 and clients receiving addresses from a later DHCP range.

Network: 10.10.10.0/24
DC01:    10.10.10.10
DC02:    10.10.10.11
Gateway: only if your lab design requires one
DNS:    domain controllers

Create the virtual machines

DC01 — Windows Server.
DC02 — Windows Server for redundancy practice.
WIN11-01 — Windows client.
WIN11-02 — optional second client.

Install operating systems cleanly, apply updates before isolating the network if needed, rename each machine and document passwords used only for the lab.

Build the first domain controller

Set the final computer name, such as DC01.
Configure a static IPv4 address.
Install the Active Directory Domain Services role.
Promote the server to a new forest.
Choose a lab-only domain name, for example lab.example.test or another namespace intended only for your environment.
Restart and sign in with the domain administrator account.

Verify DNS before doing anything else

Active Directory depends heavily on DNS. Make sure the domain controller uses the correct DNS service and that the forward and reverse lookups you need work as expected. Many “domain join” problems are actually DNS configuration problems.

nslookup dc01
nslookup your-lab-domain

Add a second domain controller

Build DC02 with its own static address, join it to the existing domain, install AD DS and promote it as an additional domain controller. Verify that users and DNS information replicate between the servers. This gives you a safe place to learn replication and service continuity.

Join Windows clients to the domain

Configure the client to use the domain DNS server, confirm network connectivity, then join it to the domain. After restart, sign in with a domain account. If the join fails, check DNS and time synchronization before changing random settings.

Create OUs, users and groups

Do not keep everything in the default containers. Create an OU structure that resembles a small company: Users, Workstations, Servers and perhaps departments such as Sales or Support. Create groups for permissions and learn the difference between user placement and access-control groups.

Practice Group Policy

Set a desktop or lock-screen policy in the lab.
Configure a simple security setting.
Map a drive or deploy a shortcut.
Apply a policy only to a test OU.
Use gpupdate and gpresult to understand why a policy did or did not apply.

gpupdate /force
gpresult /r

Add DHCP and other services later

Once the basic domain works, add DHCP and create a scope for clients. Later you can practice file shares, NTFS permissions, Windows Deployment Services, certificate services, remote administration or Microsoft 365 integration. Add one service at a time so you understand what changed.

Use checkpoints carefully

Hypervisor checkpoints are useful before experiments, but they are not a replacement for understanding backup and restore. In multi-DC labs, avoid keeping a confusing chain of old checkpoints. Document when you create one and remove it when the experiment is complete.

Lab exercises to practice

Try these in order

Create five users and two security groups.
Join two Windows clients.
Create departmental OUs.
Apply a GPO to only one OU.
Create a file share and control access through groups.
Disable a user and confirm sign-in behavior.
Move a client to another OU and observe policy changes.
Shut down DC01 and investigate what still works through DC02.
Break client DNS deliberately, observe the failure, then repair it.
Document every change as if you were supporting a real company.

What to learn next

After the on-premises lab is comfortable, extend your learning into Microsoft 365 identity, endpoint management, PowerShell, security monitoring and cloud services. The goal is not to build the largest lab—it is to create a repeatable environment where you can prove that you understand each administrative task.

Build skills by doing the work

Explore the Alpi TEK Resources page for Windows, Microsoft 365 and home-lab learning material.

Explore Resources

Browse More Articles