A resume-grade Hyper-V home lab for administering Active Directory, delivering Windows through PXE, and operating a small Configuration Manager site. It is deliberately built in two layers: PowerShell creates the isolated host and base operating systems; the runbooks then use the management consoles (with PowerShell equivalents) for AD DS, GPO, WDS, and Configuration Manager.
The lab is sized for a host with roughly 32 GB available to virtual machines, while keeping at
least 4 GB for the host. It uses the isolated LabSwitch subnet 10.0.100.0/24, the
hufflab.internal forest, and separate DC01, WDS01, and CM01 roles. The important operational
rule is that a subnet has exactly one PXE responder: WDS01 first, then CM01 only after WDS01 is
disabled and powered off.
flowchart LR
Host["Hyper-V host\nLabNAT · 10.0.100.1"] --- Switch{{"LabSwitch\nInternal vSwitch"}}
Switch --- DC["DC01\nAD DS · DNS · DHCP\n10.0.100.10"]
Switch --- WDS["WDS01\nStandalone WDS PXE\n10.0.100.20"]
Switch --- CM["CM01\nSQL · ConfigMgr · DP/PXE\n10.0.100.30"]
Switch --- Clients["CL01 · CL02 · REF01"]
WDS -. "Phases 04–06 / 09" .-> Clients
CM -. "Phase 10, after WDS01 is off" .-> Clients
See the full architecture, IP plan, and the rationale behind each major choice in the architecture decisions.
- AD administration: a domain controller with DNS and DHCP, an intentional OU and AGDLP design, users and groups, and workstation/user policy.
- PXE imaging: standalone WDS deployment to CL02, a sysprepped Win11 reference image, and a
captured
HUFFLAB-Win11-Golden.wimdeployed to CL01. - Configuration Manager operations: a Current Branch 2509 evaluation site with application deployment, software updates, a compliance baseline, reporting, and an OSD task sequence.
- Read conventions, then obtain and record the required media in the ISO checklist.
- On the Hyper-V host, use the Stage 1 execution handoff as the operator overview and complete the authoritative Phase 01 runbook. Scripts create only the foundation and base OS; they do not configure product roles.
- Work through Phases 02–10 in order, taking the named Hyper-V checkpoint before each phase and recording results in the lab notebook.
- Keep WDS01 as the sole PXE responder through the WDS and golden-image work. In Phase 10, first disable and power it off, prove PXE times out, and only then enable CM01 PXE.
- Repeat the AD operations drills and retain screenshots, command output, and troubleshooting notes as evidence.
Credential note: the runbooks use
LabP@ss2026!only as an example. Replace it with your own strong lab password; scripts prompt for secrets and do not hardcode it.
| Phase | Runbook | Resume bullet | Outcome to retain |
|---|---|---|---|
| 00 | Conventions | — | Naming, credential, checkpoint, and evidence discipline |
| 01 | Host prep & lab foundation | Infrastructure | Host readiness, LabSwitch, and LabNAT |
| 02 | DC01: AD DS, DNS, DHCP | #1 | Patched, authorized domain services and DHCP scope |
| 03 | AD structure: OUs, users, groups, AGDLP | #1 | OU design and HR share AGDLP chain |
| 04 | WDS standalone PXE → CL02 | #2 | Interactive WDS PXE deployment and domain-joined client |
| 05 | GPO suite | #1 | Workstation baseline and targeted drive map |
| 06 | Golden image: REF01 → capture → CL01 | #2 | Captured and deployed golden WIM |
| 07 | CM01 prerequisites | #3 | Schema, SQL, ADK, WSUS, and delegation prerequisites |
| 08 | SCCM site install & client onboarding | #3 | HUF site, discovery, boundary, collections, and client |
| 09 | SCCM ops: apps, patching, compliance | #3 | Application, update, and compliance evidence |
| 10 | OSD & the WDS→ConfigMgr PXE handoff | #2 + #3 | WDS-off negative test and ConfigMgr OSD deployment |
| Recurring | AD operations drills | #1 | Recoverability and AD health evidence |
This design takes useful mechanics from MSLab (parent disks, NAT/private networking, declarative settings), AutomatedLab (phase-oriented role decomposition), and established manual guides (a proven DC01/CM01 separation). It intentionally avoids their weak points: it does not hide AD work behind a framework, combine SCCM with a domain controller, or depend on MDT, which was retired in October 2025. Standalone WDS is used only as a learning-stage PXE transport: the WDS boot image is a custom ADK WinPE image, and WinPE launches Windows Setup from a read-only network share. The design avoids the unsupported standalone-WDS install-image workflow before moving to Configuration Manager OSD. See Microsoft's WDS documentation.
This is a learning lab, not a production blueprint. Evaluation media expires, SCCM is co-located with SQL and WSUS on CM01 to fit the budget, and the same-subnet design needs neither DHCP options 60/66/67 nor IP helpers. The decisions document those tradeoffs.
- Docs: architecture, IP plan, decisions, ISO checklist, Stage 1 execution handoff, and lab notebook.
- Runbooks: conventions, Phases 01–03, 04, 05, 06, 07, 08, 09, 10, and recurring drills.
- Automation: lab configuration, host readiness, switch/NAT, parent disk, VM creation, teardown, and the server unattend template.