Home Lab Guide: Deploying Active Directory, Windows 7 Client and ELK Stack for Security Logging

A detailed tutorial walks readers through building an isolated VirtualBox lab featuring a Windows Server 2019 domain controller with DNS and DHCP, a Windows 7 client joined to the domain, and an ELK stack running Elasticsearch, Logstash and Kibana 9.4.2. The guide covers creation of organizational units, Group Policy Objects for advanced auditing, and configuration of Winlogbeat 7.17 to forward Security, System and Application logs to Logstash. Special attention is given to common pitfalls such as missing GPO extension attributes that prevent audit policies from applying and memory constraints when running the full ELK stack on limited RAM. The author emphasizes that Windows 7 is unsupported and should only be used in isolated lab networks. All steps are provided with exact PowerShell commands, netplan configurations, and Logstash pipeline examples suitable for a 192.168.100.0/24 NAT network.

HabrTranslated from Russian

Read at source

A comprehensive home-lab tutorial demonstrates how to build a miniature Active Directory environment integrated with the ELK stack for centralized security logging. The project uses VirtualBox with a custom NAT network named AD-Lab on the 192.168.100.0/24 subnet.

The stand consists of three virtual machines: DC01 running Windows Server 2019 as the domain controller, DNS and DHCP server; WIN7-PC01 running Windows 7 as a domain-joined client; and an Ubuntu Server host named elk that runs Elasticsearch, Logstash and Kibana 9.4.2.

Readers are guided through renaming the server, assigning a static IP, installing the AD-Domain-Services role and promoting the forest corp.lab. Subsequent sections detail DHCP scope creation, OU structure under OU=Lab,DC=corp,DC=lab, and the creation of test users and groups.

A dedicated chapter explains how to create the GPO “Lab-Audit-Policy” and enable advanced auditing categories including “Audit Process Creation” with command-line logging. The author also describes a non-obvious issue where the gPCMachineExtensionNames attribute was missing the GUID for advanced audit policy, preventing settings from applying, and provides the exact PowerShell commands to correct it.

Windows 7 is joined to the domain using Add-Computer, after which Winlogbeat 7.17 is installed on both the domain controller and the client. Because Winlogbeat 7.17 cannot connect directly to Elasticsearch 9.x, Logstash is placed in the middle to receive beats input on port 5044 and forward events to the Elasticsearch HTTPS endpoint.

Port forwarding rules are configured in VirtualBox so that Kibana is reachable at http://localhost:5601 and SSH access to the ELK server is available on port 2222. Memory tuning recommendations are given for Elasticsearch and Logstash JVM heaps when RAM is limited to 4–6 GB.

The article concludes with a troubleshooting section covering DHCP errors, time synchronization requirements for Kerberos, and the necessity of KB3004375 on Windows 7 to capture command-line data in event 4688.

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Other

Mail.ru Reduces Lifetime 1TB Cloud Storage Promo to Standard 8GB Quota for Select Users
Kimi K3 Open Model Surpasses Closed AI Leaders with Million-Token Context and 896 Experts
Innostage Completes Functional Testing of PT NGFW 1.10.3 Across 156 Criteria