Enterprise Windows Server lab focused on centralized identity, DNS, client integration, data protection, recovery validation and controlled remote administration.
This project documents the design, implementation and validation of a Windows Server 2025 environment for the fictional company PixelForge Studios, a game development organization whose operations depend on critical digital assets such as source code, graphical assets, builds and technical documentation.
The environment was rebuilt from a controlled baseline and configured to provide:
- centralized identity and authentication;
- internal DNS resolution;
- structured Active Directory administration;
- Windows 11 domain integration;
- backup and recovery capabilities;
- controlled Remote Desktop administration;
- functional validation of the implemented services.
The project was approached as an infrastructure case study rather than a sequence of configuration steps: each technical decision was connected to an operational requirement and key functions were tested after implementation.
PixelForge Studios was modeled around four functional areas:
- Programming
- Art
- Production
- Infrastructure
The infrastructure was designed to improve administrative organization, centralize authentication, reduce configuration dispersion, protect business-critical data and provide controlled remote administration.
| Component | Implementation |
|---|---|
| Virtualization | VMware lab environment |
| Server | Windows Server 2025 |
| Server hostname | PFS-DC01 |
| Client | Windows 11 |
| Client hostname | PFS-CL01 |
| Internal domain | pixelforge.internal |
| Server IPv4 | 192.168.1.10 |
| DNS | Hosted on the Domain Controller |
| Core roles | Active Directory Domain Services, DNS |
All addresses shown in this repository belong to the isolated laboratory environment.
The environment was built in a controlled sequence:
- Restore the server and client to a known baseline.
- Configure coherent server naming and static IPv4 addressing.
- Install Active Directory Domain Services and DNS.
- Promote
PFS-DC01to Domain Controller. - Create the internal domain
pixelforge.internal. - Build the Active Directory structure using Organizational Units, security groups and domain users.
- Integrate the Windows 11 client into the domain.
- Validate centralized authentication.
- Implement manual and scheduled backup operations.
- Simulate data loss and validate file recovery.
- Configure and test controlled Remote Desktop administration.
The Active Directory structure reflects the fictional company's functional organization rather than placing all identities in default containers.
The implementation includes:
- Organizational Units for the main business areas;
- security groups;
- domain user accounts;
- functional group membership;
- centralized authentication;
- explicit administrative and remote-access authorization.
The server was promoted to Domain Controller and the internal pixelforge.internal domain was created successfully.
Organizational Units, security groups and user accounts were structured around the company's functional areas.
The Infrastructure OU also contains the administrative groups used in the lab.
The laboratory used an administrative account with sufficient privileges to validate server management and Remote Desktop access.
This should not be interpreted as a recommended production privilege model. In a production environment, privileged group membership should be reviewed regularly and administrative roles should be separated and reduced according to least-privilege principles.
The Windows 11 client was integrated into pixelforge.internal after validating network connectivity and internal DNS resolution.
Validation included:
- connectivity between client and server;
- resolution of the internal domain;
- successful domain join;
- confirmation of domain membership;
- interactive logon using a domain account.
This validates the client experience of the domain rather than relying only on the configuration state of the Domain Controller.
Data protection was implemented with Windows Server Backup and dedicated local backup volumes inside the laboratory environment.
A test dataset was created under:
C:\PixelForge\Projetos
The validation workflow was:
- execute a backup of the selected business data;
- confirm successful backup completion;
- deliberately remove the original test file;
- initiate recovery through Windows Server Backup;
- restore the file to
C:\PixelForge\Restauro; - confirm that the recovered file was available.
The important outcome was not simply that a backup job completed, but that recoverability was tested after simulated data loss.
The lab also included scheduled protection for different data categories, including:
- a daily administrative backup scheduled for 03:00;
- dedicated handling of more critical backup data;
- two scheduled daily runs for the critical backup workflow;
- validation that scheduled execution produced backup data.
This demonstrates the distinction between configuring a backup mechanism and validating that the protection workflow actually runs.
Remote Desktop was configured for controlled administrative access to the server.
The validation process confirmed both sides of the access-control requirement:
- an authorized administrative user could establish an RDP session;
- a user without the required permission was denied remote access.
This is stronger evidence than showing only that Remote Desktop was enabled.
| Area | Validation |
|---|---|
| AD DS / DNS | Domain active and services operational |
| Domain Controller | PFS-DC01 promoted successfully |
| Active Directory | OUs, groups and users created |
| DNS / connectivity | Client reached the server and resolved pixelforge.internal |
| Domain join | Windows 11 client joined successfully |
| Authentication | Domain user logon validated |
| Remote administration | Authorized RDP session succeeded |
| Access restriction | Unauthorized RDP attempt was blocked |
| Backup | Backup execution completed successfully |
| Recovery | Simulated file loss followed by successful restore |
| Scheduled protection | Scheduled backup execution validated |
Several principles guided the implementation:
Known-good baseline
The environment was rebuilt from a controlled starting point so that configuration changes remained traceable.
Business-aligned identity structure
Active Directory objects were organized around the company's functional structure.
Validation over configuration state
A service was not considered complete simply because it appeared configured. Domain membership, authentication, remote access and recovery were tested functionally.
Recovery must be proven
A successful backup job does not by itself demonstrate recoverability. The project therefore included simulated data loss and an actual restore.
Laboratory implementation is not automatically production design
Some implementation choices are appropriate for an isolated training environment but require additional controls in a real organization.
For a production deployment, the following improvements would be required or strongly recommended:
- separate administrative roles and reduce privileged group membership;
- formalize backup retention and rotation policies;
- maintain additional backup copies outside the primary server;
- include off-site or otherwise isolated backup storage;
- implement monitoring and alerting for backup failures and infrastructure health;
- apply additional operating-system and Active Directory hardening;
- document recovery objectives and periodically test recovery procedures.
In particular, the local backup volumes used in this lab demonstrate backup and restore mechanics but should not be treated as a complete production backup architecture.
windows-server-enterprise-lab/
├── README.md
├── notes/
│ ├── overview.md
│ ├── technical-scope.md
│ └── lessons-learned.md
└── assets/
├── architecture/
│ └── pixelforge-windows-server-architecture.png
├── active-directory/
│ ├── domain-controller-deployment.png
│ ├── ou-programming-users-groups.png
│ └── ou-infrastructure-admin-groups.png
├── backup-recovery/
│ ├── manual-backup-success.png
│ ├── file-restore-validation.png
│ └── scheduled-backup-policy.png
├── client-integration/
│ ├── dns-connectivity-validation.png
│ ├── windows11-domain-join-success.png
│ └── domain-user-logon-validation.png
└── remote-administration/
└── rdp-administrative-session.png
The repository deliberately uses a curated set of original implementation screenshots rather than reproducing every figure from the academic report.
Completed and validated.
The laboratory successfully demonstrated:
- Windows Server 2025 deployment;
- Active Directory Domain Services and DNS;
- structured identity management;
- Windows 11 domain integration;
- centralized authentication;
- manual and scheduled backup operations;
- validated file recovery;
- controlled Remote Desktop administration.
Technologies: Windows Server 2025 · Active Directory Domain Services · DNS · Windows 11 · Windows Server Backup · Remote Desktop · VMware