A 12-week educational program for running a Windows Server environment the way an enterprise would: layered identity and operations, not extra roles on one machine.
This program is for learners, career-switchers, and lab members who want to understand enterprise Windows Server architecture by building a small, honest replica. PowerShell is the thread. Hyper-V is the classroom. Restore drills are the exam.
Plan on 10–12 weeks at 4–6 hours per week after you can survive on one Windows 11 box. Evaluation copies of Windows Server and Windows 11 are enough. Do not practice on a production domain.
12 weeks
Enterprise architecture track
4–6 hrs
Study and lab time each week
Hyper-V
Host for the scaled-down replica
Eval licenses
Windows Server + Windows 11
Skip foundations only if you already administer Windows without guessing. Otherwise start here, then join week 1 of the architecture program.
Before the enterprise track: PowerShell, local security, and recovery on a single box.
Harden a Windows 11 VM, split local admin, turn on the firewall, and recover from a checkpoint.
One domain, one file share, Group Policy that actually applies.
DC plus one member PC. Create users, a working GPO, a file share with correct ACLs, and restore a deleted folder.
A layered identity and operations platform — not extra roles stacked on one server.
Build the replica below, then run the 12-week sequence and the capstone outage drill.
Enterprise Windows Server is a layered platform. The lab proves each layer at a smaller scale. It does not pretend a single VM is a data centre.
| Layer | What production looks like | What the lab can prove |
|---|---|---|
| Identity | One forest, few domains; Entra ID for cloud apps; hybrid join | 1 forest, 1 domain, Entra Connect to a developer tenant |
| Directory HA | 2+ domain controllers per site, AD-integrated DNS, documented FSMO | 2 DCs; transfer and seize FSMO once in the lab |
| Sites | AD sites match WAN/LAN; RODC at branches | 2 sites, 1 RODC, a site-linked GPO |
| Privilege | Tier 0/1/2, privileged access workstation, no daily Domain Admin | Separate admin OU, LAPS, a jump box |
| PKI | Offline root plus issuing CA | 1 enterprise CA; HTTPS and LDAPS |
| Compute | Hyper-V failover cluster or HCI | 2-node Hyper-V with live migration |
| File | DFS Namespace and replication, or a file cluster | DFS-N, shadow copies, a tested restore |
| Patch / endpoint | Intune or MECM with ringed rollouts | WSUS rings: pilot, then broad |
| Security | ASR, Credential Guard, Defender XDR, SIEM | Audit GPOs, event forwarding, attack-path discussion |
| Hybrid / DR | Azure Arc, Site Recovery, 3-2-1 backup, written RPO/RTO | Backup to a second disk; restore a DC and a file share |
| Ops | Change records, runbooks, monitoring SLOs | One-page runbook and a “DC down” drill |
Architecture discussion first, then a lab that matches the diagram, scaled down. Week 12 is a drill, not a slide recap.
Domains versus OUs, UPN suffixes, and when not to create a second domain.
Sites, subnets, replication, DNS aging and scavenging.
AD-integrated DNS, split-brain, DHCP failover, the idea of IPAM.
Privileged groups, Protected Users, LAPS, and a privileged access workstation.
OU model, WMI filters, loopback processing, central store.
Auto-enrolment, LDAPS, web TLS, and what breaks when the CA dies.
DFS Namespace, quotas, access-based enumeration, backup versus checkpoints.
Cluster, CSV, quorum, and how to patch a host without a surprise outage.
Entra Connect, hybrid join, Conditional Access as a concept (lab tenant).
Update rings, WSUS or Intune, desired state with DSC or Ansible.
Event IDs, non-authoritative DC restore, ransomware-aware backup.
Draw the architecture, then a 30-minute incident: one DC and the file share are gone.
Two domain controllers, two subnets, a file server, and a backup disk that you actually restore. Checkpoints are not backups.
| Piece | Role |
|---|---|
| Host | Windows 11 Pro or Education with Hyper-V enabled |
| DC1 | First domain controller and DNS |
| DC2 | Second DC in the same domain |
| FILE1 | File server, DFS-N, shadow copies |
| HV-MGMT | Windows Admin Center jump box |
| PC1 | Windows 11 domain member |
| RODC | Optional branch read-only DC |
| Networks | Two subnets = two AD sites |
| Backup | Separate VHDX; restore is the proof, not the job status |
