A Windows Server VM running Active Directory gives me a local environment to test Group Policy changes, practice AD administration, and understand Entra ID hybrid identity properly — replicating the kind of environment I manage professionally, without the risk of experimenting on a live client tenant.
VM setup
CPU: 4 cores (host type — passes through host CPU features rather than emulating a generic model)
RAM: 8192MB
Disk: 60GB (VirtIO SCSI)
NIC: VirtIO
VirtIO drivers are essential for decent performance and need loading manually during Windows install — Windows Server’s installer doesn’t ship with them natively, so the VirtIO driver ISO has to be attached as a second CD-ROM device and pointed to during the “where do you want to install Windows” step, or the installer won’t see the virtual disk at all.
CPU type: host # not "kvm64" — host passthrough avoids masking CPU features
# AD DS and later Windows features occasionally check for
# and expect during feature installation
Installing Active Directory
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools
Install-ADDSForest `
-DomainName "lab.local" `
-DomainNetbiosName "LAB" `
-InstallDns:$true `
-Force:$true
Using .local as the domain suffix is deliberate for a lab environment — it avoids any risk of the internal domain name colliding with a real public domain I might also be resolving from the same network, and it’s an instant visual signal that this is lab infrastructure rather than anything production-facing.
-InstallDns:$true sets the server up as the DNS server for the domain in the same step — worth knowing this reconfigures the VM’s own DNS client settings to point at itself (127.0.0.1) once promotion completes, which is expected but can look alarming if you’re checking ipconfig /all immediately after and see the DNS server listed as localhost.
Group Policy
A baseline policy enforcing sensible security defaults, applied at the domain level via Group Policy Management:
Minimum password length: 12
Account lockout threshold: 5 attempts
Lockout duration: 30 minutes
Configure automatic updates: Notify for download
Testing Group Policy changes safely matters here — a misconfigured lockout policy or password requirement can lock out every domain account simultaneously, including the one you’re using to fix it. I keep a local Administrator account (not domain-joined) available on the VM specifically as an escape hatch, mirroring the same “break-glass account” logic that matters in cloud identity too.
Connecting to Entra ID with Entra Connect
Syncing on-prem AD to a Microsoft 365 tenant replicates how most real hybrid organisations actually operate, rather than testing against a cloud-only tenant that doesn’t reflect that architecture:
- Choose Express Settings during Entra Connect installation
- Enter Global Admin credentials for the target Microsoft 365 tenant
- Enter on-prem AD credentials (Enterprise Admin rights needed for the initial schema/config changes Entra Connect makes)
- Enable Password Hash Synchronisation
Users created in lab.local sync to Entra ID and can sign in to Microsoft 365 with their AD password — the foundation of hybrid identity, and the piece that makes testing things like Conditional Access against synced (rather than cloud-only) identities possible without touching a real organisation’s directory.
One thing worth knowing before running this against any tenant you actually care about: Entra Connect’s Express Settings will overwrite existing cloud-only user attributes with on-prem values on first sync if UPNs collide — worth running against a dedicated test tenant rather than a live one, which is exactly why this lives in a home lab rather than being tested against client infrastructure directly.
Result
A working AD environment for testing Group Policy changes, AD administration tasks, and hybrid identity scenarios, snapshotted in Proxmox immediately after a clean baseline setup so experiments — deliberately breaking a GPO, testing a risky Entra Connect sync setting — can always be rolled back to a known-good state in seconds rather than rebuilding from scratch.