Junior Systems Administrator

Learning identity infrastructure by building it.

Home-lab projects covering on-prem Active Directory, role-based access, Group Policy, and Entra ID cloud sync — built to understand how real IT environments work.

Lab Projects

Two labs, one identity stack — built and broken on purpose.

Home Lab / Azure AD Sync

On-prem VirtualBox domain controller → Microsoft Entra ID tenant
SYNC ENABLED

Connected a local Active Directory domain to the cloud using Microsoft Entra Connect Cloud Sync, then proved the whole identity path works — from a hash on a local DC to a live cloud login.

  1. Environment setup

    Built a local AD domain controller (corp.local) inside VirtualBox, created a Microsoft Entra ID tenant, and bridged the two with the Entra Connect Cloud Sync agent to sync identities upward.

  2. Test users & provisioning

    Created test users inside a dedicated IT_Department OU. Cloud provisioning stalled on scope filters until I fed Entra ID the exact distinguished name path: CN=Antonis Papathanasiou,OU=IT_Department,DC=corp,DC=local.

  3. Continuous sync

    Flipped the sync configuration from Disabled to Enabled to wake up the pipeline, then confirmed replication with a Directory synced: Yes status flag and an end-to-end cloud login.

How it works

The local sync agent extracts a password hash from Active Directory, hashes it again, and uploads it to Entra ID — authentication then happens on Microsoft's servers against that stored hash, not against the domain controller. Sync is one-way, so user management still happens locally. If the lab VM is off, synced users can still log in (Entra ID keeps its own copy), but new changes queue up until the domain controller is back online.

Active Directory DS Microsoft Entra ID Entra Connect Cloud Sync Password Hash Sync VirtualBox

AD_DS_Enterprise_Lab

Enterprise Active Directory, built from scratch with RBAC & security hardening
GPO LINKED

The goal wasn't just a working domain — it was a production-shaped one. Department-level OUs, role-based access instead of one-off permissions, a hardened lockout policy, and a DNS setup that keeps the domain isolated without cutting it off from the internet.

  1. Mapping the company & setting up RBAC

    Organized the environment into department-level OUs (HR, Finance, IT, Sales) and created two global security groups per department — [Department]_Supervisors and [Department]_Staff — so a new hire just drops into the right group and inherits the correct access instantly.

  2. Locking the front door with Group Policy

    Created a domain-wide GPO, Corporate_Security_Policy, linked at the root of the domain. Configured a five-strikes account lockout policy — five bad password attempts freezes the account for 30 minutes — then forced it out immediately with gpupdate /force instead of waiting on the default refresh cycle.

  3. Solving the DNS forwarding problem

    The DC's network card has to point to its own loopback address to resolve domain controllers and log users in, which leaves it with no route to the public internet. Configured DNS Forwarders in Windows DNS Manager so local queries resolve internally while everything else forwards out to 8.8.8.8 — an isolated domain that can still reach the internet when it needs to.

Active Directory DS Group Policy Objects RBAC design DNS Manager Account Lockout Policy
Toolset

What's running under the hood

Identity
Active Directory Domain Services, Microsoft Entra ID, Entra Connect Cloud Sync, Password Hash Sync
Access control
RBAC design, Global Security Groups, Organizational Units, Group Policy Objects
Networking
Windows DNS Manager, DNS forwarders, domain name resolution
Environment
VirtualBox, Windows Server, PowerShell, gpupdate