case study 09 / 09Win-Stone Campus · Infrastructure · 2022 – 2024

Windows Server 2019 Deployment

A 30-PC computer lab needed central logins, addressing, file sharing and policy, kept apart from the rest of the campus network.

An isolated computer-lab domain: one Windows Server 2019 machine running AD DS, DHCP, DNS, File Server, WDS and Group Policy for 30 client PCs.

DOMAINOU-1OU-2OU-3GROUP POLICY → 30 LAB PCS
client PCs on one domain
30client PCs on one domain
server roles on one machine
6server roles on one machine
isolated lab network
1isolated lab network

01The situation

The campus IT lab had 30 client PCs. Each one needed user accounts, network settings, shared files and access rules, and doing that per machine doesn't scale.

The lab also had to stay separate from the main campus network, so I built it as its own isolated network with its own server.

02What it had to do

  • Isolated from the main campus network.
  • One login per person, working on any lab PC.
  • Network addresses assigned automatically.
  • Access controlled by role, managed from one place.
  • Lab PCs locked down: no USB storage, games or downloads, blocked sites, and a standard wallpaper.

03Architecture

  1. Lab server

    • Windows Server 2019

      One machine running AD DS, DHCP, DNS, File Server, WDS and Group Policy.

    Downward link: serves the lab segment only

  2. Lab network

    • Lab switch

      Connects the server and the 30 PCs, with an uplink to the main router for the admin console.

    • Lab router

      A rule blocks the lab segment from reaching other networks.

    Upward link: addresses, logins, policy, files and network installs

  3. Client PCs

    • 30 lab PCs

      Bound by MAC address to the lab segment; one domain login per user on any of them.

Lab PCs can't reach other networks; only the admin console reaches in, for monitoring.

04How it works

  1. Directory

    Active Directory Domain Services holds users, computers and groups, so every account is managed in one place.

  2. Addressing and names

    DHCP hands out IP addresses automatically and DNS resolves names inside the domain.

  3. Files

    A file server provides shared folders, with access set by group.

  4. Deployment

    Windows Deployment Services installs Windows on machines over the network.

  5. Policy

    Group Policy applies the lab's rules to every machine in the domain: USB storage blocked, selected websites blocked, a fixed wallpaper, games blocked and downloads blocked, along with role-based access.

  6. Isolation

    Each lab PC is bound by MAC address to the lab's own network segment, and a rule on the lab's router blocks traffic from that segment to other networks. The lab switch keeps an uplink to the main router, which lets the campus admin console reach the lab PCs for monitoring.

  7. One server

    All six roles run on a single Windows Server 2019 machine inside the lab, on a network kept apart from the rest of the campus.

05Run it yourself

A simulated morning in the lab: 30 client PCs and one server. Start a PC and watch it use each server role in turn, then check the isolation both ways. Names, addresses and timings are invented.

lab-srv · Windows Server 2019 · demo lab · 30 client PCs · isolated segment

07:45:00

one server, six roles

  • DHCP0

    Gives each PC its address

  • WDS0

    Installs Windows over the network

  • DNS0

    Finds the domain controller by name

  • AD DS0

    Checks the user's one login

  • Group Policy0

    Applies settings and access rules

  • File Server0

    Maps the shared folders by group

0/30 ready

isolation check

Run a check to trace it hop by hop.

lab-07, step by step

  1. DHCP · Gives each PC its address
  2. DNS · Finds the domain controller by name
  3. AD DS · Checks the user's one login
  4. Group Policy · Applies settings and access rules
  5. File Server · Maps the shared folders by group
  6. Desktop ready

try it on lab-07

Start lab-07 and wait for its desktop, then try what Group Policy locks down.

server log0 events

Quiet. Start a PC or run an isolation check.

06What changed

  • All 30 lab PCs get their addresses and settings automatically.
  • Access is managed by role from one console instead of machine by machine.