# Isolated Windows Server lab only. Review and execute individually.
# Prerequisites: licensed/evaluation media, local admin session, isolated switch.
# Configure a static lab IP and DNS plan before promotion. No secrets are stored.
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools
Install-ADDSForest -DomainName 'lab.example' -InstallDNS
# Promotion prompts for the DSRM password and normally restarts the server.
# After restart, use an authorised domain administrator session:
Get-ADDomain
Get-ADDomainController -Filter *
Resolve-DnsName -Type SRV '_ldap._tcp.dc._msdcs.lab.example'
# Create Lab OU and child OUs Admin, Staff, Students with management tools.
# Link a harmless test GPO ONLY to the Lab OU. Do not change Default Domain Policy.
# Join one disposable Windows client using its own lab DNS setting.
# On the client:
whoami
gpresult /r
# Evidence: capture redacted OU structure, domain join and effective policy.
# Rollback: revert or remove disposable lab VMs, never production controllers.