> For the complete documentation index, see [llms.txt](https://blog.r00t-hunter.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.r00t-hunter.com/ad-lab-built-with-purpose/users-and-active-directory.md). # Users and Active Directory
Eight accounts per domain. The population covers the identity relationships relevant to the attack scenarios: a Domain Admin, an IT account with accumulated local admin rights across all workstations (a realistic condition that develops over years of helpdesk provisioning), departmental standard users, and service accounts with registered SPNs using RC4 encryption. RC4 on the service accounts reflects a real-world condition: AES-only Kerberos requires explicit msDS-SupportedEncryptionTypes configuration that organizations frequently never retroactively apply to older service accounts. The condition is common in environments with accounts predating AES Kerberos enforcement. Important framing: This user population is purpose-built for detection validation. Every misconfiguration and privilege relationship exists intentionally. Real environments have broken SPNs, stale delegation configs, disabled accounts in privileged groups nobody noticed, and conflicting ACLs from ten years of reorganizations. This lab has none of that chaos. That is a limitation, not a feature. ### usa.corp.local — Users | Username | Full Name | Department | Effective Privilege | | ----------- | ------------ | ---------- | ----------------------------------------- | | jsmith | John Smith | Executive | Domain Admin | | lpark | Lisa Park | IT | Local Admin all workstations + DA members | | sjones | Sarah Jones | HR | HR OU, R/W HR share, standard logon | | mchen | Mike Chen | Finance | Finance OU, R/W Finance share, no RDP | | dwilson | David Wilson | DevOps | Dev OU, RDP to WS-USA-04 | | edavis | Emma Davis | Marketing | Standard user, Public share read | | jbrown | James Brown | Sales | Standard user, Public share read | | svc\_backup | BackupSvc | — | SPN registered, RC4 forced | ### india.corp.local — Users | Username | Full Name | Department | Effective Privilege | | -------- | ------------ | ---------- | ---------------------------------- | | rkumar | Rajesh Kumar | Management | Branch lead, Local Admin | | dnair | Deepa Nair | IT | Local Admin all India workstations | | psharma | Priya Sharma | HR | HR OU, HR share R/W | | apatel | Amit Patel | Finance | Finance OU, Finance share R/W | | vsingh | Vikram Singh | Dev | Dev OU, RDP to WS-IND-04 | | agupta | Ananya Gupta | Marketing | Standard user | | srao | Suresh Rao | Support | Standard user | | svc\_sql | SQLService | — | SPN registered, RC4 forced | ### OU Structure (usa.corp.local) ``` DC=usa,DC=corp,DC=local ├── OU=Workstations ← GPO-Workstations, GPO-Audit, GPO-Sysmon │ └── WS-USA-01 through WS-USA-04 ├── OU=Servers ← GPO-Servers (SMB signing required, NTLMv2 only) │ └── FILE-USA, WEB-USA, MAIL-USA ├── OU=Departments │ ├── OU=HR ← sjones │ ├── OU=Finance ← mchen │ ├── OU=IT ← lpark │ ├── OU=DevOps ← dwilson │ └── OU=Marketing ← edavis, jbrown ├── OU=ServiceAccounts ← svc_backup, svc_sql (SPN registered, RC4 allowed) ├── OU=Disabled ← tombstoned accounts for LDAP enumeration realism └── CN=Users ← jsmith (DA), default AD groups ``` ### Group Policy Objects
Group Policy Management Editor on DC-USA Sysmon-Deploy policy enabled, alongside Audit Logon Events, Audit Object Access, Windows Defender configuration, and PowerShell Script Block Logging. This is the actual GPO pushing telemetry to all workstations in OU=Workstations." | GPO | Linked To | Key Settings | | ---------------- | --------------- | -------------------------------------------------------------------------------------------------------- | | GPO-Workstations | OU=Workstations | Sysmon deploy via MSI, PowerShell ScriptBlock logging, USB block, AppLocker baseline | | GPO-Audit | Domain root | Audit logon events, process creation with cmdline, DS object access, privilege use — all Success+Failure | | GPO-Password | Domain root | Min length 12, complexity on, max age 90 days, lockout 5 attempts / 15 min | | GPO-Servers | OU=Servers | SMB signing required, NTLMv2 only, RDP restricted to IT group, WinRM HTTPS only | | GPO-LAPS | OU=Workstations | LAPS enabled — randomized local admin password per machine stored in AD | ### File Share Layout (FILE-USA — Samba) | Share | Read | Write | Content | | ------------------ | -------------------- | ------- | -------------------------------------- | | \FILE-USA\HR$ | sjones, lpark | sjones | Hidden; synthetic HR documents | | \FILE-USA\Finance$ | mchen, lpark, jsmith | mchen | Hidden; synthetic financial documents | | \FILE-USA\IT$ | lpark, jsmith | lpark | Admin scripts; canary credential files | | \FILE-USA\Dev$ | dwilson, lpark | dwilson | Source code; synthetic config files | | \FILE-USA\Public | Domain Users | — | Company-wide read; templates | The canary files in IT$ (admin\_creds\_backup.txt, deploy\_keys.zip) are honey files. A read event on these from an unexpected process or account context is a high-confidence indicator. "Samba audit logging and Security Onion correlation for canary file events required significant tuning beyond the share configuration that process is outside the scope of this post. #### IP Address Plan | Segment | Subnet | Gateway | Notes | | ---------- | ------------ | --------- | ----------------------------------------- | | Management | 10.0.0.0/24 | 10.0.0.1 | pfSense, Security Onion, Kali, host admin | | USA Corp | 10.10.0.0/24 | 10.10.0.1 | USA VMs — DHCP from DC-USA | | India Corp | 10.20.0.0/24 | 10.20.0.1 | India VMs — DHCP from DC-INDIA | | VPN Tunnel | 10.99.0.0/30 | — | pfSense OpenVPN endpoints only | #### Proxmox Virtual Bridge Configuration (/etc/network/interfaces — SYS-2) ```bash auto vmbr0 iface vmbr0 inet manual bridge-ports eno1 bridge-stp off bridge-fd 0 auto vmbr1 iface vmbr1 inet manual bridge-ports none bridge-stp off bridge-fd 0 auto vmbr2 iface vmbr2 inet manual bridge-ports none bridge-stp off bridge-fd 0 auto vmbr3 iface vmbr3 inet static address 10.0.0.12/24 gateway 10.0.0.1 bridge-ports none bridge-stp off bridge-fd 0 ``` ### Security Onion SPAN Port (Traffic Mirror) Security Onion's monitor interface receives a copy of vmbr1 and vmbr2 traffic via tc-based mirroring on the Proxmox host. ```bash tc qdisc add dev vmbr1 ingress handle ffff: tc filter add dev vmbr1 parent ffff: protocol all u32 match u32 0 0 \ action mirred egress mirror dev tap501i1 tc qdisc add dev vmbr1 root handle 1: prio tc filter add dev vmbr1 parent 1: protocol all u32 match u32 0 0 \ action mirred egress mirror dev tap501i1 tc qdisc add dev vmbr2 ingress handle ffff: tc filter add dev vmbr2 parent ffff: protocol all u32 match u32 0 0 \ action mirred egress mirror dev tap501i1 tc qdisc add dev vmbr2 root handle 1: prio tc filter add dev vmbr2 parent 1: protocol all u32 match u32 0 0 \ action mirred egress mirror dev tap501i1 ``` Critical: These tc rules do not survive a Proxmox host reboot. Add them to a systemd unit or /etc/rc.local or you will waste time wondering why Zeek stopped seeing traffic after a restart. ### pfSense Firewall Rules | Interface | Source | Destination | Ports | Action | Purpose | | ---------- | ---------------- | ------------ | ----------------------- | --------- | -------------------- | | USA LAN | 10.10.0.0/24 | 10.20.0.0/24 | TCP 88,389,445,135,3268 | Allow | AD trust | | India LAN | 10.20.0.0/24 | 10.10.0.0/24 | TCP 88,389,445,135,3268 | Allow | AD trust | | USA/India | Any | Any | TCP 80,443 | Allow | HTTP/S outbound | | Management | 10.0.0.99 (Kali) | Any | Any | Allow | Attacker routing | | Management | 10.0.0.50 (SOC) | 10.10.0.0/22 | TCP 443,9200,UDP 514 | Allow | Log ingest | | WAN | Any external | Any internal | Any | Block | Default deny inbound | | All | Any | Any | Any | Block+Log | Implicit deny | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://blog.r00t-hunter.com/ad-lab-built-with-purpose/users-and-active-directory.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.