Dami Builds

Windows AD Lab on UTM

By Dami Ola

This lab walks through the steps I took to build a basic Active Directory (AD) lab environment using Windows Server 2022 as the Domain Controller (DC) and Windows 10 as the client. Everything was done inside UTM. In a later post, I will cover joining a Linux client to this Windows server.

Setting up the virtual machines

I downloaded the Windows Server 2022 and Windows 10 Enterprise ISO files from Microsoft Evaluation Center. I used to run this lab on VirtualBox on my 2019 Intel MacBook Pro, but I spilled a glass of margaritas on that computer. VirtualBox does not work well on Apple Silicon, so I switched to UTM. Do not drink near your laptop guys.

Host environment

Creating the domain controller in UTM

  1. Create the DC (Windows Server 2022).
  2. UTM > Create a New Virtual Machine > Emulate. UTM must use Emulate because the M1 Pro ARM chip cannot run x86 Windows Server directly.
  3. Settings:
    • Operating System: Windows
    • Machine: Intel ICH9 based PC (2009, x86_64)
    • Memory: 4 GB (I used 12 GB on a 32 GB host)
    • CPU cores: 2
    • Uncheck “Install Windows 10 or higher”
    • Attach the Windows Server 2022 ISO
    • UEFI Boot
    • Storage: 100 GB
  4. Networking: Settings > Network. Select Shared Network if you want Internet access. Otherwise select Host Only. I used Host Only for this lab. Then start the VM.

Install Windows Server 2022

  1. When you see “Press any key to boot from CD/DVD…”, press Enter or Space.
  2. Select Windows Server 2022 Standard or Evaluation Center. Make sure it is Desktop Experience. Otherwise you will only get a CLI.
  3. Select Custom Install > select the unallocated drive > Next.
  4. After the reboots, set the Administrator password and finish.

The Emulate option is slow on Apple Silicon. Be patient. After install, unlock the server and continue with configuration: promote to a DC (AD DS and DNS), assign static IPs, and so on.

Configuring the server

Server Manager should open on boot. If it does not, open it from search. Local Server > Computer name > Change. I used DC01. Restart when prompted.

Changing computer name to DC01
Changing computer name to DC01.

Assign a static IP

Control Panel > Network and Internet > Network and Sharing Center > Connections: Ethernet > Properties > Internet Protocol Version 4 (TCP/IPv4) > Properties. Enter static IP, subnet mask, and preferred DNS. Reboot if prompted.

IPv4 settings window
IPv4 settings window before assigning a static IP.
Assign static IP to DC01
Assigning a static IP address to DC01.

Install AD DS, DNS, and DHCP

Server Manager > Manage > Add Roles and Features.

Click Next to the end and install. When it finishes, click the flag with the yellow alert to configure the new roles.

Select AD DS, DNS, and DHCP
Selecting Active Directory Domain Services, DNS, and DHCP roles.
Post install configuration
Post installation configuration in Server Manager.

Promote the server to domain controller

  1. Add a new forest and set the root domain. I used damibuilds.com.
  2. Use the same Administrator password.
  3. Run the prerequisite check and install. Ignore delegation warnings if they appear. The system restarts and shows damibuilds\\Administrator at login.
Login after promotion
Login screen after domain promotion and restart.

DHCP configuration

In Server Manager, complete the DHCP post install configuration. Commit and close. Then authorize the DHCP server.

Server Manager > Tools > DHCP > expand server > IPv4 > right click server > Authorize.

Create DHCP scope
Creating a new DHCP scope.

Create a scope

  1. Right click IPv4 > New Scope.
  2. Start IP: 192.168.64.50 > End IP: 192.168.64.100.
  3. Subnet mask: 255.255.255.0.
  4. Skip exclusions. Lease duration: 8 days.
  5. Options: Yes.
  6. Router: leave blank for an isolated lab.
  7. Domain name and DNS server: enter your domain and DNS IP.
  8. Skip WINS. Activate scope now.
DHCP IP range
Configuring the DHCP IP address range.
DHCP domain and DNS options
Adding domain name and DNS server information.
DHCP stats
Verifying the active scope in DHCP statistics.

DNS check

This is mostly set during AD promotion. To verify: Server Manager > Tools > DNS > Forward Lookup Zones > damibuilds.com. Confirm an A record for DC01 points to 192.168.64.10.

A record for DC01
Confirming the A record for DC01 in DNS.

If missing, create a Reverse Lookup Zone for 192.168.64, add a PTR for DC01, then test:

nslookup dc01.damibuilds.com
nslookup result
PowerShell nslookup showing successful DNS resolution.

Wrap up

You now have a Windows Server 2022 Domain Controller with DNS and DHCP configured. Next I will join a Windows client and later a Linux client to this domain and cover file sharing and basic policy.