How can I setup a practice active directory lab on my current LAN?

DrPcKen
DrPcKen used Ask the Experts™
on
I'm getting ready to start studying for my MCITP Enterprise Admin certificate.  I've been working with Active Directory environments for years so it isn't something new to me.  However, I've never had a lab to practice deployments with and study.  I have my current company LAN which is on 1gb switches.  I also have 3 beefy retired servers I can use at my disposal.  My idea is to use one server for my Active Directory server, and another one as a virtual server to create a few workstations.

Now I know I can put these machines on an isolated switch, seperate from my current LAN, but how would I get internet access to them?  What are the best practices for labs like this?  Also, are there free virtual server applications I can use or do I have to pay for VMWare?  Thank you!
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Top Expert 2013

Commented:
Without knowing your LAN I'd say as long as your AD/DNS server in the lab can get out then you can access the internet (the DC will be your DNS server in the lab and can use root hints)

VMware workstation is nice but like you said it is not free.

Since you are going with 2008 then you already get Hyper-V with that (Microsoft's virtualization product)

There is also virtualbox from Oracle but in your case I'd go with Hyper-V

Thanks

Mike

Author

Commented:
LAN is pretty simple.  A single subnet going to a our firewall.

Commented:
I would just create a new IP subnet for the lab. Say if your IP scope in the office is 192.168.1.0/24 then maybe just create the new domain with 172.16.1.0/24 and give them the existing gateway so that they have internet access. The other thing that you could do is configure an entire new network with a seperate router that uses your existing gateway for internet access. VMWare has a 30 day trial of their software that is fully functional that you can play around with and create virtual machines etc.

Kenny
Exploring ASP.NET Core: Fundamentals

Learn to build web apps and services, IoT apps, and mobile backends by covering the fundamentals of ASP.NET Core and  exploring the core foundations for app libraries.

Adam BrownSenior Systems Admin
Top Expert 2010

Commented:
On the networking side, you can set up a separate VLAN on a switch that can communicate with the Internet. You'll have to get it trunked through to the router, but once that's done you should be able to have Internet Access. Of course, if your company doesn't have any managed switches, things get a *lot* tougher. I have my practice network at home and am able to use the company's management software to remote in to my server with a network Agent. And that's really handy, but I imagine your company doesn't want to just hand over the outdated servers. You *might* be able to segregate your network with a separate Subnet and Mask than the one used by your company if you don't have managed switches.

As for Virtualization, All versions of Windows 2008 come with Hyper V (unless you bought the version that *doesn't*) that is great for running a little test virtual network. I have about 10 VMs of varying OSes that I use on my network on a single server. Works great.

Also, if you haven't done so yet, I very very highly recommend getting a Technet Subscription. http://technet.microsoft.com/en-us/subscriptions/default.aspx has info on that. Depending on what level of subscription you get, you will have access to ISOs and Demonstration licenses of just about everything Microsoft makes. Those licenses cannot be used in a production environment, but they allow unlimited usage in a test/training environment.
Network Engineer
Commented:
If you can't reengineer the network with a new subnet, you can just put them on your existing subnet. you will probably need to statically assign IP addresses so you can find the correct DNS servers, or use your existing DNS/DHCP infrastructure and put in dedicated forwarders to your new domain on your existing DNS servers.
Depending on the processors of your retired servers, they may not support Hyper-V. If they don't, I would recommend VMware Server because the performance will be better than Virtual Server 2005 R2. You can also try VirtualBox.
 

Author

Commented:
This was part of my question as well:  If I have two completely separate domains on the same subnet and lan, it wont' cause any problems?  I figure as long as my lab is pointing to the right dns server there shouldn't be a problem right?

Thanks!
Top Expert 2013

Commented:
You could potentially run into issues with DHCP (broadcast based).  Are these domains in different forests?
 

Author

Commented:
Yes different forests
kevinhsiehNetwork Engineer

Commented:
Don't run two DHCP servers, but you can run two different forests on the same LAN segment. It's easier to run different DNS, but you can use the same DNS servers is you statically created the entries for your test domain on your existing DNS server. It would be like running an AD environment and you were using BIND for DNS.
 

Commented:
Hi

Download VMWare server for free.
http://downloads.vmware.com/d/info/datacenter_downloads/vmware_server/2_0
Install it on one of your machines and create your virtual  test environment as Virtual machines. Configure your VMWare network to bridge or nat your host to access internet.

you could also use AD Lightweight if you want only to play with LDAP queries
http://msdn.microsoft.com/en-us/library/bb897400.aspx


Thanks
Jose



My take will be:
1. download a virtual client software just like these gentelman suggested. Secondly, create a VM. Third, add the VM to your existing AD as a member of your Forest. Fourth, disconnect VM and cleanup your AD Schema, AD settings to reflect the removal of the machine you just removed. you can also create a vlan and plug your VM and your computer to play with it.
2. If you don't want to go through the trouble, or have a similar machine to play with, then simply backup your system state.  In new system, install windows and all the patches like the other machine. Then apply a restore to it and you will have a copy with all the information on your AD including FSMO roles, Global catalogs, etc...
3. report to us if that helped you.
I forgot, vmware player is free.
microsoft virtual pc is also free.
If you are testing, use them. If you need them for more, I would suggest vmware full blown server software.  
 
Good luck.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial