Break It. Detect It. Fix It.
Hands-on Active Directory labs for Cybertection Training Center students. Build a Windows domain, attack it the way real intruders do, then write the detections and hardening that stop them.
What you will learn
Run a real domain
Domain controllers, DNS, OUs, groups, Group Policy, and file shares, the way enterprises run them.
Think like an intruder
Password spraying, Kerberoasting, AS-REP roasting, pass-the-hash, DCSync, and golden tickets.
Read the evidence
Windows event IDs, Sysmon, and SIEM searches that show every attack you ran.
Close the gaps
Tiered administration, LAPS, Protected Users, and fixing the misconfigurations you exploited.
The lab network
One fictional company, cybertection.lab, with five machines on an isolated virtual network.
DC01
Windows Server domain controller. Holds the domain, DNS, and every secret you want to steal.
FS01
File server with departmental shares. Where sensitive data lives.
WS01 / WS02
Windows 11 workstations joined to the domain. Where users log in and where attackers land first.
KALI
Your attacker box with the offensive tools from the Downloads page.
How the lab works
- Download the VM images and tools from the Downloads page.
- Run the setup script on DC01 to build the domain, users, and deliberate weaknesses.
- Work through the modules in order. Each one has objectives, hints, and a check of your work.
- Snapshot before you attack. Revert to a clean snapshot any time you break the lab.
Before you start
What do I need?
A PC with 16 GB RAM (8 GB minimum), about 60 GB free disk space, and virtualization enabled in BIOS. Basic Windows administration and command-line experience helps, but the modules start from the basics.
Can I do this on a Mac?
Partly. Windows Server 2022 is x64 only, so the domain controller needs an Intel Mac, or a Windows or Linux host. The workstations and Kali can run on Apple Silicon with VMware Fusion or UTM, using ARM builds.
Do I need to break the lab on purpose?
Yes. The weak accounts and misconfigurations are the teaching material. Snapshot before each module, and revert when you want a clean start.
Where does my progress go?
The lab path page saves checkboxes in your browser only. Clearing site data resets it, and your instructor cannot see it.
Is this safe to run on my home network?
Keep the lab on its own isolated virtual network. Never bridge it to your home or work network, and never point these tools at systems you do not own.