swm.nc2 — Lab Automation (CSS.LOCAL edition)

PowerShell automation that completes the two-machine Windows lab for the TESDA CSS NC II classroom spec:

• SERVER — Windows Server 2016, already a DC for CSS.LOCAL (NetBIOS CSS)
• CLIENT-1 — Windows 10/11 client

Scripts cover the remaining build phases only (DHCP → domain join → AD objects → share → GPO shell → lightweight RDP). Every script is idempotent, names its target machine in the header, and ends with a verification block.

Using a Mercusys router at the edge? Switch to the mercusys-setup branch — same scripts, plus a Mercusys-specific guide and a readiness probe.

Environment of record (matches the lecture procedure)

Setting	Value
Domain / NetBIOS	css.local / CSS
Subnet	192.168.0.0/24
Router (default gateway)	192.168.0.1 — its own DHCP must be DISABLED
SERVER static	192.168.0.2, DNS points at itself
DHCP scope	.3–.57, exclusion .3–.7 → clients receive .8–.57
Scope options	Router 192.168.0.1 · DNS 192.168.0.2 · domain css.local
AD objects	OU tesda.org; group tesda (DomainLocal/Security); users user1, user2
Share	C:\Shares\FolderRedirection shared as FolderRedirection
GPO	Folder Redirection linked to OU=tesda.org,DC=css,DC=local

Prerequisites (already built — never re-run by these scripts)

Static IP on SERVER (192.168.0.2), hostname set, roles AD-Domain-Services + DNS + DHCP installed, server promoted to domain controller. Router's DHCP disabled.

Run order (exact)

Elevated PowerShell on the machine named per step. If policy blocks scripts:

powershell -ExecutionPolicy Bypass -File .\Phase1-NewDhcpScope.ps1

Step	Machine	Command	Notes
1	SERVER	.\Phase1-NewDhcpScope.ps1	scope .3–.57 + exclusion .3–.7, options, authorizes SERVER in AD
—	SERVER	Set-DnsServerForwarder -IPAddress 8.8.8.8	lets clients resolve internet names through SERVER
2	CLIENT-1	.\Phase2-JoinPc1ToDomain.ps1	verifies lease came from .0.2 first; joins css.local; reboots
3	SERVER	.\Phase3-NewAdObjects.ps1	OU tesda.org, group tesda, users user1/user2
4	SERVER	.\Phase4-NewFolderRedirectionShare.ps1	share + NTFS ACLs
5	SERVER	.\Phase5-NewGpoShell.ps1	GPO shell + link (manual step below)
6	SERVER	.\Phase6-EnableRdpSrv1.ps1	lightweight RDP enablement
7	CLIENT-1	.\Phase7-EnableRdpPc1.ps1	refuses to run if Phase 2 wasn't done

Each phase ends with a === VERIFICATION === block and prints the next step.

The one manual step (by design)

Folder Redirection target paths have no supported PowerShell cmdlet (fdeploy.ini inside SYSVOL is unsupported/fragile — never edit it). After Phase 5:

1. SERVER ▸ gpmc.msc ▸ Domains ▸ css.local ▸ right-click GPO Folder Redirection ▸ Edit
2. User Config ▸ Policies ▸ Windows Settings ▸ Folder Redirection — repeat for Desktop, Documents, Pictures
3. Setting: Basic – redirect everyone to the same location · Root path: \\SERVER\FolderRedirection
4. Clients: gpupdate /force + sign out/in

Notes & corrections baked into these scripts

• Lightweight RDP only: registry flag + firewall group + local group membership. The full RDS role is deliberately NOT installed (120-day licensing time bomb) — unlike the original lecture procedure.
• tesda ≠ tesda.org: ACLs use the security group CSS\tesda. An OU can never hold permissions — regression-tested in the offline suite.
• Phase 2 refuses to join unless CLIENT-1 provably leased from SERVER's scope (guards against a rogue router DHCP answering first).
• Demo password in Phase 3 — change it for anything beyond a throwaway lab.

Testing without any Windows machines (offline logic suite)

60-assertion mock-based suite; runs anywhere PowerShell runs (incl. Linux):

mkdir -p /tmp/pwsh && curl -fsSL \
  https://github.com/PowerShell/PowerShell/releases/download/v7.4.6/powershell-7.4.6-linux-x64.tar.gz \
  | tar -xz -C /tmp/pwsh && chmod +x /tmp/pwsh/pwsh
/tmp/pwsh/pwsh -NoProfile -File tests/Test-LabScripts.ps1     # expect: RESULT: 60/60 assertions passed

For live-state checks on real hardware (dcdiag, ACLs, GPO XML): Verify-LabPlan.md.

Quick troubleshooting

Symptom	Fix
CLIENT-1 lease origin is the router, not .0.2	Second DHCP alive — disable it, then ipconfig /release && ipconfig /renew
CLIENT-1 has 169.254.x.x	No DHCP yet — normal gap before Phase 1; run it, then renew
Online but no internet	Missing forwarder — Set-DnsServerForwarder -IPAddress 8.8.8.8 on SERVER
Domain names resolve randomly	Exactly one DHCP may exist on the segment: SERVER