Skip to content

Verify-LabPlan.md

Latest commit

 

History

History
128 lines (99 loc) · 10.8 KB

Verify-LabPlan.md

File metadata and controls

128 lines (99 loc) · 10.8 KB
Raw

Lab Verification Plan — swm.nc2 (Phase 1)

Ground rules:

  • Every check queries LIVE state (AD/DHCP/filesystem/registry/network). Script exit codes from the build phase carry zero weight.
  • All commands are read-only (Get-* / dcdiag / dsacls / ipconfig / Test-NetConnection / nslookup). No fix is applied during verification; failures are reported only.
  • Dependency rule: a failed prerequisite marks downstream checks BLOCKED, not FAIL.
  • Execution tiers:
    • TIER-A (authoritative): run in an elevated PowerShell console ON the named machine.
    • TIER-R (remote corroboration): unauthenticated probes from the session host (192.168.0.10, Linux). Can prove reachability/port state/DNS content, cannot substitute for Tier-A cmdlet results.

Dependency chain

V1 connectivity ──> V2 identity/roles ──> V3 DC health (dcdiag)
                          │                     │
                          v                     v
                    V4 DHCP (SERVER auth) ──> V4b CLIENT-1 lease ──> V5 domain join
                                                                    │
                              V6 AD objects <───────────────────────┘(order convenience)
                                    │
                        ┌───────────┼────────────┐
                        v           v            v
                  V7 share+ACLs   V8 GPO      V9 RDP (CLIENT-1 half)
                                  (link dep V6; settings presence independent)

V1 — Baseline connectivity (no prerequisites)

ID Machine Command Expected pass
V1.1 CLIENT-1 Test-Connection 192.168.0.2 -Count 4 4/4 replies, 0% loss
V1.2 CLIENT-1 ipconfig /all Adapter Up; IPv4 in 192.168.0.3–200; mask /24; GW 192.168.0.1; DHCP Enabled=Yes; DHCP Server=192.168.0.2; Lease Obtained/Expires populated; DNS=192.168.0.2
V1.3 SERVER Test-Connection 192.168.0.1 -Count 4 4/4 replies
V1.4 SERVER ipconfig /all IPv4 192.168.0.2/24; GW 192.168.0.1; DHCP Enabled=No; DNS=127.0.0.1

Tier-R corroboration (from session host): ping -c3 192.168.0.2, ping -c3 192.168.0.1.

V2 — Server identity & roles (prereq: V1.3/V1.4 OK if run over network; console run has no prereq)

ID Machine Command Expected pass
V2.1 SERVER hostname (or $env:COMPUTERNAME) SERVER
V2.2 SERVER Get-WindowsFeature AD-Domain-Services,DNS,DHCP | Format-Table Name,InstallState all three rows Installed
V2.3 SERVER Get-NetIPConfiguration -Detailed InterfaceAlias up; IPv4Address 192.168.0.2 /24; IPv4DefaultGateway.NextHop 192.168.0.1; DNSServer 127.0.0.1

V3 — Domain controller health (prereq: V2.2 shows AD-Domain-Services Installed)

ID Machine Command Expected pass
V3.1 SERVER (Get-ADDomain).DNSRoot; (Get-ADDomain).NetBIOSName; (Get-ADDomain).DomainMode css.local; CSS; mode ≤ WS2016
V3.2 SERVER dcdiag /v > $env:TEMP\dcdiag.txt; Select-String -Path $env:TEMP\dcdiag.txt -Pattern 'failed test' ZERO matches (canonical gate — do not skip)
V3.3 SERVER Select-String -Path $env:TEMP\dcdiag.txt -Pattern '\.\.\. SERVER passed test' ≥8 passed lines incl. Connectivity, Advertising, MachineAccount, Services, SysVolCheck, NetLogons

V4 — DHCP (prereq: V2.2 DHCP=Installed; V4b prereq: V4.1–V4.3 pass)

ID Machine Command Expected pass
V4.1 SERVER Get-DhcpServerv4Scope ScopeId 192.168.0.0; Name set; StartRange 192.168.0.3; EndRange 192.168.0.57; SubnetMask 255.255.255.0; State Active
V4.2 SERVER Get-DhcpServerv4OptionValue -ScopeId 192.168.0.0 | ft OptionId,Name,Value OptionId 003 Router={192.168.0.1}; 006 DNS={192.168.0.2}; 015 DNS Domain={css.local}
V4.3 SERVER Get-DhcpServerInDC row: DnsName server.css.local, IPAddress 192.168.0.2
V4.4 CLIENT-1 ipconfig /all Lease from 192.168.0.2, address inside .8–.57, options match V4.2 (this validates options END-TO-END, not just server-side)
V4.5 SERVER Get-DhcpServerv4Lease -ScopeId 192.168.0.0 contains a lease for CLIENT-1's name/IP (proves CLIENT-1's lease came from THIS scope, not stale cache)

V5 — Client domain join (prereq: V4.4 pass — joining/verifying with wrong DNS gives false results)

ID Machine Command Expected pass
V5.1 CLIENT-1 Get-ComputerInfo | Select-Object CsName,CsDomain,CsDomainRole CsDomain=css.local; CsDomainRole ∈ {MemberWorkstation}; CsName=CLIENT-1
V5.2 CLIENT-1 nltest /dsgetdc:css.local DC=\SERVER.css.local, flags include DS_KDC/DS_GC (proves secure-channel + locator works)
V5.3 SERVER Get-ADComputer -Identity CLIENT-1 | ft Name,DistinguishedName,Enabled object exists under CN=Computers (default), Enabled=True

V6 — AD OU/group/users (prereq: V3.2 clean dcdiag)

ID Machine Command Expected pass
V6.1 SERVER Get-ADOrganizationalUnit -Filter 'Name -eq "tesda.org"' DN OU=tesda.org,DC=css,DC=local
V6.2 SERVER Get-ADGroup tesda -Properties GroupScope,GroupCategory | ft Name,GroupScope,GroupCategory,DistinguishedName GroupScope=DomainLocal; GroupCategory=Security; DN inside tesda.org OU
V6.3 SERVER Get-ADUser user1,user2 -Properties Enabled,PasswordNeverExpires,CannotChangePassword | ft Name,Enabled,PasswordNeverExpires,CannotChangePassword Enabled=True, PasswordNeverExpires=True for both. NOTE: CannotChangePassword returned here is an AD-module COMPUTED property built by reading the object DACL — treat as indicative only; authoritative check is V6.4
V6.4 SERVER dsacls "CN=user1,OU=tesda.org,DC=css,DC=local" and same for user2 Output contains Deny ACE(s) granting CHANGE PASSWORD (normally two: Everyone + NT AUTHORITY\SELF). Alternative: (Get-Acl "AD:$dn").Access | ? { $_.AccessControlType -eq 'Deny' -and $_.ObjectType -eq [guid]'ab721a53-1e2f-11d0-9819-00aa0040529b' } returns ≥1 row (that GUID = Change Password extended right)
V6.5 SERVER Get-ADGroupMember tesda | ft Name,SamAccountName exactly user1 and user2

V7 — Share + permissions (prereq: V6.2 — identities must resolve or ACL rows show raw SIDs)

ID Machine Command Expected pass
V7.1 SERVER Get-SmbShare FolderRedirection | fl Name,Path,Description,ShareState Path=C:\Shares\FolderRedirection; ShareState=Online
V7.2 SERVER Get-SmbShareAccess FolderRedirection | ft AccountName,AccessControlType,AccessRight EXACTLY four Allow-Full entries: Everyone, CSS\tesda, CSS\Domain Users, CSS\Domain Admins
V7.3 SERVER (Get-Acl C:\Shares\FolderRedirection).Access | ? { -not $_.IsInherited } | ft IdentityReference,FileSystemRights,AccessControlType,IsInherited Modify: CSS\tesda + CSS\Domain Users (inheritance ContainerInherit,ObjectInherit); FullControl: CSS\Domain Admins
V7.4 SERVER (Get-SmbShareAccess FolderRedirection).AccountName + (Get-Acl C:\Shares\FolderRedirection).Access.IdentityReference | Select-String 'tesda\.org' NO matches — the OU name must appear nowhere in either ACL (regression test for the source-document bug)

V8 — GPO (V8.1–V8.2 prereq: V6.1; V8.3 independent of others)

ID Machine Command Expected pass
V8.1 SERVER Get-GPO 'Folder Redirection' | fl DisplayName,GpoStatus exists; GpoStatus = AllSettingsEnabled
V8.2 SERVER (Get-GPInheritance -Target 'OU=tesda.org,DC=css,DC=local').GpoLinks | ft DisplayName,Enabled,Order one link: 'Folder Redirection', Enabled=True
V8.3 SERVER $x=[xml](Get-GPOReport 'Folder Redirection' -ReportType Xml); $x.GPO.User.ExtensionData.Extension.OuterXml | Select-String -Pattern '\\\\SERVER\\FolderRedirection' -AllMatches (plus inspect HTML report Get-GPOReport ... Html -Path $env:TEMP\fr.html) XML contains literal UNC \\SERVER\FolderRedirection under User Configuration, with redirection nodes for Desktop, Documents and Pictures. If OuterXml has NO folder-redirection extension data → the manual GUI step was never completed → FAIL with cause 'manual gpmc.msc step skipped', NOT a script bug

V9 — Remote Desktop, lightweight only (SERVER half: no prereq beyond V2; CLIENT-1 half prereq: V5.1)

ID Machine Command Expected pass
V9.1 SERVER + CLIENT-1 Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections | select fDenyTSConnections value = 0 on BOTH
V9.2 SERVER + CLIENT-1 Get-NetFirewallRule -DisplayGroup 'Remote Desktop' | ? Enabled -eq True | ft DisplayName,Enabled (fallback -Name RemoteDesktop-* on non-en-US) TCP + UDP inbound UserMode rules Enabled=True on BOTH
V9.3 SERVER + CLIENT-1 Get-LocalGroupMember 'Remote Desktop Users' | ft Name,PrincipalSource contains CSS\Domain Users, CSS\Domain Admins, CSS\tesda (PrincipalSource=ActiveDirectory) on BOTH
V9.4 SERVER Get-WindowsFeature -Name RDS* | ? InstallState -eq Installed ZERO rows — proves the RDS-role correction held (Connection Broker/Gateway/Licensing/Host all NOT installed ⇒ no licensing time bomb)
V9.5 SERVER + CLIENT-1 Test-NetConnection <self> -Port 3389 (or netstat -an | findstr :3389) LISTENING on both

Tier-R probes runnable without credentials (from session host 192.168.0.10)

These corroborate but never replace Tier-A:

ID Target Probe Pass looks like
R1 192.168.0.2 ICMP ping replies ⇒ SERVER powered+cabled+IP'd
R2 192.168.0.2 TCP connect 53/88/389/445/3389/5985 53+88+389 open ⇒ DNS/Kerberos/LDAP serving (DC core alive); 3389 open ⇒ V9 partially proven; 445 ⇒ SMB stack up; 5985 ⇒ WinRM available for future automation
R3 192.168.0.2 nslookup css.local 192.168.0.2 + nslookup -type=SRV _ldap._tcp.dc._msdcs.css.local 192.168.0.2 A record 192.168.0.2; SRV → server.css.local:389 ⇒ zone css.local hosted with AD locator records (corroborates V3.1/V6 without login)
R4 192.168.0.3–200 ping sweep then TCP 3389 on responders locates CLIENT-1's current lease + proves inbound RDP listening ⇒ corroborates V4.4/V9(CLIENT-1)
R5 self DHCP origin of 192.168.0.10 ⚠ anomaly flag if lease came from router while scope claims .8–.57 ⇒ investigate dual-DHCP or wrong segment

Reporting convention

Result values: PASS / FAIL / BLOCKED / UNVERIFIABLE (needs Tier-A access). FAIL rows get root cause + proposed fix, and STOP — fixes require explicit confirmation.