Directory and Identities

Active Directory from Zero · Lab 2

Directory and Identities

Ironwood Manufacturing is onboarding Maya Chen, transferring her to another department, and preparing a departure workflow. Build a directory structure that keeps those changes clear and verifiable.

Isolated Azure lab · ad.ironwood.test

DC01

10.40.0.4

Directory, DNS, and domain authentication

snet-lab

10.40.0.0/24
Private network traffic

MEMBER01

10.40.0.5

Domain member used to test employee access

Connect using RDP to each VM’s public IP, restricted to your public IPv4 /32. Domain traffic uses the private addresses above. Both machines run Windows Server 2025 Desktop Experience; MEMBER01 is a member server, not another domain controller.

What you will practice

  • Design for people and computers.
  • Create a standard user account and understand the difference between signing in and accessing company resources.
  • Move and rename an existing identity without recreating it.
  • Disable and re-enable an account, then inspect computer identities and solve a deliberate fault.

Before you start

Complete Active Directory Basics or bring equivalent experience creating a domain and joining a computer. A free site account is required for published lesson steps.

Allow about 90 minutes for the lesson. For a fresh Azure environment, allow about 5 minutes to submit the setup template or about 30 minutes to create the resources manually, plus Azure provisioning time. Domain configuration follows resource setup. Windows Server 2025 Desktop Experience, an Azure subscription with resource-creation permissions, and two small VMs are required.

The lesson includes copyable commands, self-checks, a five-question quiz, and verified cleanup. Use the Terms and Notes tabs on the side whenever you need them. Linked terms open their definitions.

On the Prepare Azure page, choose the downloadable deployment template or build the resources manually. The template runs through the Azure portal with no local tools to install. Domain configuration is still part of the hands-on setup.

What this may cost

Rough estimate: $3-$10 if you finish in one sitting; more if the two Windows Server VMs stay running. Actual Azure pricing varies by region, VM size, subscription, credits, and how long you leave the lab running.

  • Two Windows Server 2025 VMs, DC01 and MEMBER01
  • Two Standard SSD OS disks
  • A virtual network, subnet, network interfaces, and a network security group
  • Two Standard public IPv4 addresses for RDP, restricted to your public IPv4 /32

This lab often spans two sittings. Signing out of Windows does not deallocate a VM. Disks and public IPs still cost money while VMs are deallocated. Remove the RDP allow rule when pausing; for longer breaks, detach and delete the lab public IPs too.

How to stop billing

  1. In the Azure Portal, stop each VM and confirm the status is Stopped (deallocated).
  2. When you are finished with the lab, delete the entire rg-jtl-ad-identities resource group.
  3. Verify the resource group, VMs, disks, public IPs, and network interfaces are gone.

Deallocating stops VM compute charges. Deleting the resource group is the cleanest way to remove disks, public IPs, and other billable resources.

Start lab →