This project replicates an enterprise deployment environment on a single Proxmox host — Active Directory, SCCM, SQL Server, pfSense, and fully automated PXE imaging for both Windows 11 and RHEL 8/9/10. The goal was to solve a real problem: getting SCCM and Linux Kickstart to coexist without conflict, which required designing a network-segmented architecture where each platform operates on its own isolated bridge with independent DHCP and PXE routing.
The result is a lab where deploying a new Windows or RHEL machine is three steps: clone a template, start it, and let PXE handle the rest.
What this covers:
- Active Directory, DNS, DHCP (Windows Server 2022)
- SCCM / Microsoft Endpoint Configuration Manager — OS deployment via PXE
- RHEL 8/9/10 automated deployment via Kickstart + TFTP
- Network segmentation with pfSense across three isolated bridges
- Linux AD integration (SSSD, realmd, Kerberos)
- VM templating and repeatable deployment workflows in Proxmox
Once the lab is running, deploying a new machine takes about 3 steps:
- Clone WIN11-TEMPLATE (Full Clone) — set the NIC to vmbr2
- Start the VM
- It PXE boots, contacts SCCM01, and presents the task sequence menu
- Select Deploy Windows 11 Enterprise — OS installs, domain joins, and SCCM client installs automatically
- Clone RHEL-TEMPLATE (Full Clone) — set the NIC to vmbr3
- Start the VM
- It PXE boots, contacts KICKSTART, and presents the GRUB menu
- Select the desired RHEL version — Kickstart handles the full unattended install
Each deployment bridge has its own DHCP scope with options 66/67 pointing directly to the correct PXE server. VMs are placed on the correct bridge at clone time — no manual boot order changes or DHCP reservations needed.
| Bridge | Subnet | Gateway | Purpose |
|---|---|---|---|
| vmbr1 | 10.10.10.0/24 | 10.10.10.1 | Infrastructure — all servers |
| vmbr2 | 10.10.20.0/24 | 10.10.20.1 | Windows deployment — SCCM PXE clients |
| vmbr3 | 10.10.30.0/24 | 10.10.30.1 | Linux deployment — Kickstart PXE clients |
| Item | Value |
|---|---|
| Domain Name | lab.local |
| NetBIOS Name | LAB |
| DNS Server | DC01 (10.10.10.10) |
| Hostname | IP Address | Role | OS | RAM |
|---|---|---|---|---|
| pfSense | 10.10.10.1 | Gateway / Firewall | pfSense CE | 4 GB |
| DC01 | 10.10.10.10 | AD DS + DNS | Server 2022 | 4 GB |
| DHCP01 | 10.10.10.11 | DHCP Server | Server 2022 | 2 GB |
| SCCM01 | 10.10.10.12 | SCCM + SQL Server 2022 | Server 2022 | 12 GB |
| KICKSTART | 10.10.10.13 | RHEL PXE / Kickstart | RHEL 9 | 2 GB |
| VM | vCPU | RAM | Disk |
|---|---|---|---|
| Proxmox Host | - | 2 GB | - |
| pfSense | 1 | 4 GB | 10 GB |
| DC01 | 2 | 4 GB | 60 GB |
| DHCP01 | 2 | 2 GB | 40 GB |
| SCCM01 | 4 | 12 GB | 200 GB |
| KICKSTART | 2 | 2 GB | 120 GB |
| WIN11-01 | 2 | 4 GB | 60 GB |
| WIN11-02 | 2 | 4 GB | 60 GB |
| RHEL8-01 | 2 | 2 GB | 40 GB |
| RHEL9-01 | 2 | 2 GB | 40 GB |
| Total | 19 | ~38 GB | ~630 GB |
Remaining: ~29 GB RAM headroom for additional VMs or increased allocations.
| Product | Source | Duration |
|---|---|---|
| Windows Server 2022 | Microsoft Evaluation Center | 180 days (rearm x3) |
| SQL Server 2022 | Express (free) or Evaluation | Unlimited / 180 days |
| SCCM / MECM | Microsoft Evaluation Center | 180 days |
| Windows 11 Enterprise | Microsoft Evaluation Center | 90 days |
| RHEL 8 / 9 / 10 | Red Hat Developer Subscription (developers.redhat.com) | Free, 16 systems |
| pfSense CE | pfSense website | Free |
The build MUST follow this order due to service dependencies:
Week 1: Foundation
Phase 0 - Proxmox VE Installation -> docs/Phase-0-Proxmox-Install.md
Phase 1 - Networking (pfSense + Proxmox bridges) -> docs/Phase-1-Networking.md
Phase 2 - Domain Controller (AD DS + DNS on DC01) -> docs/Phase-2-Domain-Controller.md
Week 2: Core Services
Phase 3 - DHCP Server (DHCP01) -> docs/Phase-3-DHCP.md
Week 2-3: Management Infrastructure
Phase 4 - SCCM Server (SQL + SCCM on SCCM01) -> docs/Phase-4-SCCM.md
Week 3-4: Deployment Services
Phase 5 - PXE Boot (Windows + RHEL) -> docs/Phase-5-PXE.md
Week 4+: Client Deployment
Phase 6 - Client VMs (Win11 + RHEL + Domain Join) -> docs/Phase-6-Clients.md
Phase 1 (Networking)
|
v
Phase 2 (Domain Controller + DNS)
|
+-------+--------+
v v v
Phase 3 Phase 4 Phase 6 (RHEL clients can be joined manually)
(DHCP) (SCCM)
| |
v v
Phase 5 Phase 5
(PXE) (PXE - SCCM integrated)
|
v
Phase 6 (Clients via PXE)
| Object Type | Convention | Example |
|---|---|---|
| Servers | ROLE + Number | DC01, SCCM01, DHCP01 |
| Workstations | OS + Number | WIN11-01, RHEL9-01 |
| Service Accounts | svc-ServiceName | svc-sccm, svc-sccmjoin |
| OUs | Descriptive | Lab Servers, Lab Workstations |
| GPOs | Purpose - Target | Security - Workstations |
Create these during Phase 2 (Domain Controller setup):
| Account | Purpose | Notes |
|---|---|---|
| svc-sccm | SCCM site server service account | Domain admin (lab only) |
| svc-sccmna | SCCM network access account | Domain user |
| svc-sccmjoin | SCCM domain join account | Delegated join permission |
| svc-sccmpush | SCCM client push account | Local admin on clients |
| svc-sql | SQL Server service account | Domain user |
| svc-dhcp | DHCP server authorization | Uses computer account |
Each phase has its own detailed build guide:
- Phase 0 - Proxmox VE Installation
- Phase 1 - Networking
- Phase 2 - Domain Controller
- Phase 3 - DHCP Server
- Phase 4 - SCCM Server
- Phase 5 - PXE Boot Services
- Phase 6 - Client Deployment
Troubleshooting Guide — Common issues and fixes across all phases
- Summary — Host hardware, architecture, design decisions, issues encountered, and known gaps through Phase 6
- Snapshot before major changes. Before promoting DC01 to a domain controller, before installing SCCM, etc. Proxmox snapshots are your safety net.
- Static IPs for servers. All servers get static IPs configured at the OS level (not DHCP reservations). Only clients use DHCP.
- Don't skip DNS verification. After setting up DC01, verify forward and reverse lookups work before proceeding. Bad DNS causes cryptic failures in SCCM and domain joins.
- Download ISOs early. Microsoft Evaluation Center downloads can be slow. Download Server 2022, Win11, SQL Server, and SCCM media before you start building.