~/tech-journal

There is an issue I ran into while playing Path of Exile 2 and here I've documented my thoughts while working to resolve the problem.

This SOC lab analyzes a local administrator group membership change on a domain-joined Windows workstation, focusing on how persistent privilege escalation is reflected in Windows Security logs.

The activity demonstrates how elevated privileges can be granted through local group modification and persist across logouts and reboots. While the action was performed in a controlled lab environment, the behavior is classified as suspicious in a SOC context due to its impact and potential for misuse if unauthorized.

This lab emphasizes analyst triage and reasoning, including distinguishing administrative action from authorization, assessing severity and confidence, and identifying detection opportunities without assuming compromise.

This SOC lab analyzes behavior observed after multiple failed attempts to gain access to a domain controller, focusing on what follows unsuccessful authentication and attempted lateral movement.

This lab does not demonstrate successful lateral movement, privilege escalation, or system compromise. All observed activity reflects partial authentication and failed authorization within a controlled environment.

The lab builds on a previously established Active Directory environment and introduces dedicated test user accounts created specifically for this simulation to ensure controlled and interpretable results.

In this post, I connect Windows 11 to the Active Directory domain homelab.local. This lab walks through the process of joining a computer to the domain and verifying the connection.

These steps demonstrate's how to connect a Windows 11 client to an Active Directory domain.

This lab does not demonstrate successful lateral movement, privilege escalation, or compromise. The activity observed reflects partial authentication with failed authorization in a controlled lab environment.

The lab builds on an existing Active Directory setup and uses test accounts created specifically for this simulation to keep the activity scoped and interpretable.

In this post, I create an Organizational Unit (OU), set up user accounts inside it, and link Group Policy Objects (GPOs) to the OU in myhomelab.local. This lab also covers where to locate password policy settings for enforcement.

These steps add to the core essentials of Active Directory administration: creating OUs, and linking GPOs.

Start with first post: Building My First Domain.

Continuing from the first post, I am exploring how to create and manage users in myhomelab.local. In this lab I have created a test user, configured password options, created a test security group, and added the user to that group using Active Directory Users and Computers (ADUC).

These are the core essentials of AD administration: setting up user accounts, and using groups to assign access without changing permissions.

Start with first post: Building My First Domain.

Next step: accounts will be organized into Organizational Units (OUs) for better management and applying Group Policies will begin.

Installing Windows Server 2022 and setting it up as the Domain Controller to create my own domain myhomelab.local. This lab provided me with hands-on experience with setting up Active Directory and a domain controller.

With this I am provided a solid base in managing user accounts, groups, and policies within a Windows Domain environment.

Next step: In the following lab, I will be creating and configuring users and groups within Active Directory to simulate account management.