Windows Server 2025 / Capstone Lab: Verify Domain, Permissions, GPO, and Recovery

This Windows Server 2025 capstone connects internal DNS, domain identities, share permissions, Group Policy, and backup. Completion requires ordinary-user access tests, the intended policy result, and verified restored data—not only successful management-console messages.

Confirm the starting state and pass criteria

Use existing isolated servers: DC1 at 172.24.50.10 provides AD and DNS for ad.example.test, FS1 at .20 is a member file server, and CLIENT1 is domain joined. Check replication too if DC2 at .11 exists. Do not recreate already installed roles or the domain.

Prerequisites are labuser1; LabUsers, LabGroups, Workstations, and Servers under the Lab organizational unit (OU); CLIENT1 in Workstations; an NTFS D: data volume and separate E: backup target on FS1. If drive letters already serve other purposes, adapt the preparation before running commands. Two virtual disks on one physical host provide practice, not an independent production backup failure domain.

Use new Capstone folders, share, and groups. Stop if these names already exist. Administrator-only access tests can conceal ordinary-user permission problems.

Record a healthy network and domain baseline

Run these queries on CLIENT1. Confirm FS1 resolves to .20 and domain-controller discovery succeeds. Keep the client on internal DNS; public DNS is not an alternate workaround for a domain-resolution problem.

ipconfig /all
Resolve-DnsName fs1.ad.example.test
Resolve-DnsName -Type SRV _ldap._tcp.dc._msdcs.ad.example.test
nltest /dsgetdc:ad.example.test
whoami

Record role state, server time, and FS1’s D: and E: free space. If DC2 exists, inspect repadmin /replsummary and DNS registration. Correct baseline network or replication failures before adding new policy and permission changes.

Build the group-based permission path

Run in elevated Windows PowerShell on DC1. Use existing labuser1 without putting its password in code. AGDLP means Accounts → Global groups → Domain Local groups → Permissions:

Import-Module ActiveDirectory
$groupOu = 'OU=LabGroups,OU=Lab,DC=ad,DC=example,DC=test'
Get-ADUser -Identity 'labuser1' -ErrorAction Stop | Out-Null
foreach ($name in 'GG_Capstone','DL_FS_Capstone_Modify') {
    if (Get-ADGroup -Filter { Name -eq $name }) { throw ('Group already exists: ' + $name) }
}
New-ADGroup -Name 'GG_Capstone' -GroupScope Global -GroupCategory Security -Path $groupOu
New-ADGroup -Name 'DL_FS_Capstone_Modify' -GroupScope DomainLocal -GroupCategory Security -Path $groupOu
Add-ADGroupMember -Identity 'GG_Capstone' -Members 'labuser1'
Add-ADGroupMember -Identity 'DL_FS_Capstone_Modify' -Members 'GG_Capstone'
Get-ADGroupMember -Identity 'DL_FS_Capstone_Modify' -Recursive

Verify labuser1 appears in the recursive result. Sign out and back in on CLIENT1 to refresh its access token, then inspect whoami /groups. A group query from an administrator’s session does not prove the ordinary user’s token has changed.

Verify both allowed and denied share access

On FS1 with its file-server role installed, open Server Manager → File and Storage Services → Shares → Tasks → New Share. Select SMB Share – Quick and create D:\Capstone with share name Capstone. Do not overwrite an existing folder or share.

1. Retain SYSTEM and administrator Full control in NTFS permissions. Grant AD\DL_FS_Capstone_Modify Modify, reviewing inherited broad permissions and Effective Access for this test folder.
2. Grant the same domain-local group Change in share permissions, retaining administrative management access and removing unintended broad Everyone access.
3. Sign in to CLIENT1 as labuser1, open \\fs1.ad.example.test\Capstone, and save sample.txt containing capstone version A.
4. Sign in as an unrelated ordinary test account outside the Capstone groups and confirm access is denied.

Both share and NTFS permissions must allow the operation. For an unexpected allow, inspect the actual identity, nested groups, inheritance, and other allow entries. Hiding a folder is not access control. If needed, create a separate ordinary account in LabUsers without Capstone membership; an administrator is unsuitable for the negative test.

On FS1, record the created file’s contents, SHA256 hash, and folder access control list (ACL) before backup:

Get-Content -LiteralPath 'D:\Capstone\sample.txt'
Get-FileHash -LiteralPath 'D:\Capstone\sample.txt' -Algorithm SHA256
Get-Acl -LiteralPath 'D:\Capstone' | Format-List

Apply a separate GPO and verify the winning setting

In Group Policy Management on DC1, create and link a new Lab-Capstone Group Policy Object (GPO) to Workstations. Keep existing objects such as Lab-Computer-Message separate. A GPO object and its OU link are distinct configuration items.

1. Edit Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → Security Options.
2. Set Interactive logon: Message title for users attempting to log on to Capstone lab, and its message text to Course verification.
3. Check link order against other GPOs setting the same values.
4. In an elevated CLIENT1 shell, run gpupdate /force and review any sign-out or restart requirement.
5. Run gpresult /r /scope computer, then sign out and check the sign-in message.

If the value differs, inspect computer OU placement, security filtering, link order, and conflicts. Temporarily disabling only the Lab-Capstone link and reprocessing policy lets you compare the prior result. Another GPO can supply a previous value; removing one link does not guarantee a blank setting.

Back up version A and restore to a separate location

Confirm Windows Server Backup is installed on FS1 and E: is the intended separate test target. Retain the version A hash, review source and target in the backup command reference, and read the confirmation before proceeding:

wbadmin start backup -backupTarget:E: -include:D:\Capstone -vssCopy
wbadmin get versions -backupTarget:E:

Record the successful backup’s time and available items. Change only the new sample.txt to capstone version B and preserve B separately. This simulates an unwanted change without deleting business files or breaking a volume.

1. Open Windows Server Backup → Recover and select the actual backup time on E:.
2. Choose Files and folders and confirm D:\Capstone\sample.txt is available.
3. Select another-location recovery into a new, uniquely named empty run folder under D:\CapstoneRestore.
4. Review collision handling and security restoration options, then recover.
5. Find the restored sample.txt and compare content A and its SHA256 hash with the pre-backup record.
6. Confirm the current D:\Capstone\sample.txt still contains B.

The recovery command options likewise require the correct version, item, and destination. Compare restored ACLs and actual access too. Decide whether to replace current data only after validation; this exercise does not automatically overwrite the original.

Record operational evidence and clean up selectively

• Keep one configuration record for addresses, DNS, roles, OUs, groups, share, GPO, and backup version.
• Record the allowed and denied identities, policy result, and restored hash separately.
• Document failures, corrective actions, verification, and recovery time.
• Identify shared host, storage, and power dependencies still present in the lab.

For cleanup, unlink Lab-Capstone first and verify the previous policy result. Decide retention for test share data, restored copies, and backups, then remove only newly created groups and the extra negative-test account if appropriate. Preserve existing LabUsers and LabGroups OUs and unrelated shares.

The pass criteria are the defined ordinary-user access results, the intended policy, and recovery of the verified version. Compare the layers when troubleshooting rather than masking a fault by broadly relaxing firewall, signing, or permission settings.