{"id":4785,"date":"2025-09-03T13:45:48","date_gmt":"2025-09-03T10:45:48","guid":{"rendered":"https:\/\/webembed.gr\/?p=4785"},"modified":"2026-01-07T12:50:55","modified_gmt":"2026-01-07T09:50:55","slug":"building-a-real-world-windows-server-lab-with-monitoring-security","status":"publish","type":"post","link":"https:\/\/webembed.gr\/el\/building-a-real-world-windows-server-lab-with-monitoring-security\/","title":{"rendered":"Building a Real-World Windows Server Lab with Monitoring &#038; Security"},"content":{"rendered":"<p data-start=\"298\" data-end=\"320\"><strong data-start=\"301\" data-end=\"320\">Series Overview<\/strong><\/p>\n<p data-start=\"321\" data-end=\"641\">This article series documents the design and implementation of a real-world Windows Server lab that combines system administration, monitoring, and security operations. The project reflects an environment already applied in a practical scenario and is designed to mirror enterprise infrastructure as closely as possible.<\/p>\n<p data-start=\"643\" data-end=\"656\"><strong data-start=\"647\" data-end=\"656\">Parts<\/strong><\/p>\n<ul data-start=\"657\" data-end=\"893\">\n<li data-start=\"657\" data-end=\"702\">\n<p data-start=\"659\" data-end=\"702\"><strong data-start=\"659\" data-end=\"670\">Part 1:<\/strong> Architecture &amp; Network Design<\/p>\n<\/li>\n<li data-start=\"703\" data-end=\"773\">\n<p data-start=\"705\" data-end=\"773\"><strong data-start=\"705\" data-end=\"716\">Part 2:<\/strong> Active Directory, File Services &amp; Administration Tasks<\/p>\n<\/li>\n<li data-start=\"774\" data-end=\"831\">\n<p data-start=\"776\" data-end=\"831\"><strong data-start=\"776\" data-end=\"787\">Part 3:<\/strong> Monitoring, Detection &amp; Incident Analysis<\/p>\n<\/li>\n<li data-start=\"832\" data-end=\"893\">\n<p data-start=\"834\" data-end=\"893\"><strong data-start=\"834\" data-end=\"856\">Part 4 (optional):<\/strong> Lessons Learned &amp; Real-World Value<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"900\" data-end=\"943\"><strong data-start=\"902\" data-end=\"943\">Part 1: Architecture &amp; Network Design<\/strong><\/p>\n<p data-start=\"900\" data-end=\"943\"><strong data-start=\"948\" data-end=\"964\">Introduction<\/strong><\/p>\n<p data-start=\"965\" data-end=\"1347\">In this first part of the series, we focus on the architectural decisions behind the lab environment and explain how proper network design and segmentation were implemented. The goal was not simply to build a functional lab, but to design an infrastructure that behaves like a real enterprise environment &#8211; supporting both daily system administration tasks and centralized monitoring.<\/p>\n<p data-start=\"1354\" data-end=\"1373\"><strong data-start=\"1357\" data-end=\"1373\">Design Goals<\/strong><\/p>\n<p data-start=\"1374\" data-end=\"1458\">Before deploying any virtual machines, the following design principles were defined:<\/p>\n<ul data-start=\"1460\" data-end=\"1701\">\n<li data-start=\"1460\" data-end=\"1503\">\n<p data-start=\"1462\" data-end=\"1503\">Realistic enterprise-style architecture<\/p>\n<\/li>\n<li data-start=\"1504\" data-end=\"1574\">\n<p data-start=\"1506\" data-end=\"1574\">Clear separation between management traffic and monitoring traffic<\/p>\n<\/li>\n<li data-start=\"1575\" data-end=\"1618\">\n<p data-start=\"1577\" data-end=\"1618\">Centralized identity and access control<\/p>\n<\/li>\n<li data-start=\"1619\" data-end=\"1664\">\n<p data-start=\"1621\" data-end=\"1664\">Visibility at both host and network level<\/p>\n<\/li>\n<li data-start=\"1665\" data-end=\"1701\">\n<p data-start=\"1667\" data-end=\"1701\">Scalability for future expansion<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"1703\" data-end=\"1766\">These goals guided every architectural decision in the project.<\/p>\n<p data-start=\"1773\" data-end=\"1804\"><strong data-start=\"1776\" data-end=\"1804\">Virtual Machine Overview<\/strong><\/p>\n<p data-start=\"1805\" data-end=\"1852\">The lab consists of five core virtual machines:<\/p>\n<p data-start=\"1854\" data-end=\"1904\"><strong data-start=\"1858\" data-end=\"1904\">1. Windows Server \u2013 Active Directory &amp; RDS<\/strong><\/p>\n<p data-start=\"1905\" data-end=\"1957\">This server acts as the backbone of the environment:<\/p>\n<ul data-start=\"1958\" data-end=\"2067\">\n<li data-start=\"1958\" data-end=\"1996\">\n<p data-start=\"1960\" data-end=\"1996\">Domain Controller (Active Directory)<\/p>\n<\/li>\n<li data-start=\"1997\" data-end=\"2009\">\n<p data-start=\"1999\" data-end=\"2009\">DNS Server<\/p>\n<\/li>\n<li data-start=\"2010\" data-end=\"2067\">\n<p data-start=\"2012\" data-end=\"2067\">Remote Desktop Services (RDS) for administrative access<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"2069\" data-end=\"2204\">Centralizing authentication and DNS allows all other systems to behave as domain-managed assets, just like in a production environment.<\/p>\n<p data-start=\"2211\" data-end=\"2241\"><strong data-start=\"2215\" data-end=\"2241\">2. Windows File Server<\/strong><\/p>\n<p data-start=\"2242\" data-end=\"2295\">The File Server is domain-joined and responsible for:<\/p>\n<ul data-start=\"2296\" data-end=\"2420\">\n<li data-start=\"2296\" data-end=\"2320\">\n<p data-start=\"2298\" data-end=\"2320\">Hosting shared folders<\/p>\n<\/li>\n<li data-start=\"2321\" data-end=\"2365\">\n<p data-start=\"2323\" data-end=\"2365\">Enforcing NTFS and share-level permissions<\/p>\n<\/li>\n<li data-start=\"2366\" data-end=\"2420\">\n<p data-start=\"2368\" data-end=\"2420\">Supporting file recovery scenarios via Shadow Copies<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"2422\" data-end=\"2504\">This server enables realistic permission management and troubleshooting use cases.<\/p>\n<p data-start=\"2511\" data-end=\"2536\"><strong data-start=\"2515\" data-end=\"2536\">3. Windows Client<\/strong><\/p>\n<p data-start=\"2537\" data-end=\"2619\">Although optional in some lab setups, a Windows client was intentionally included:<\/p>\n<ul data-start=\"2620\" data-end=\"2767\">\n<li data-start=\"2620\" data-end=\"2652\">\n<p data-start=\"2622\" data-end=\"2652\">To simulate real user behavior<\/p>\n<\/li>\n<li data-start=\"2653\" data-end=\"2721\">\n<p data-start=\"2655\" data-end=\"2721\">To generate authentication, file access, and policy-related events<\/p>\n<\/li>\n<li data-start=\"2722\" data-end=\"2767\">\n<p data-start=\"2724\" data-end=\"2767\">To validate Group Policy and access control<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"2769\" data-end=\"2845\">This significantly improves the realism of monitoring and incident analysis.<\/p>\n<p data-start=\"2852\" data-end=\"2889\"><strong data-start=\"2856\" data-end=\"2889\">4. Wazuh Manager + OpenSearch<\/strong><\/p>\n<p data-start=\"2890\" data-end=\"2949\">This VM provides host-based monitoring and log aggregation:<\/p>\n<ul data-start=\"2950\" data-end=\"3090\">\n<li data-start=\"2950\" data-end=\"2980\">\n<p data-start=\"2952\" data-end=\"2980\">Windows Event Log collection<\/p>\n<\/li>\n<li data-start=\"2981\" data-end=\"3008\">\n<p data-start=\"2983\" data-end=\"3008\">File integrity monitoring<\/p>\n<\/li>\n<li data-start=\"3009\" data-end=\"3044\">\n<p data-start=\"3011\" data-end=\"3044\">Security alerting and correlation<\/p>\n<\/li>\n<li data-start=\"3045\" data-end=\"3090\">\n<p data-start=\"3047\" data-end=\"3090\">Centralized visibility into system activity<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"3092\" data-end=\"3155\">Wazuh acts as the primary platform for system-level monitoring.<\/p>\n<p data-start=\"3162\" data-end=\"3187\"><strong data-start=\"3166\" data-end=\"3187\">5. Security Onion<\/strong><\/p>\n<p data-start=\"3188\" data-end=\"3246\">Security Onion is deployed as a network monitoring sensor:<\/p>\n<ul data-start=\"3247\" data-end=\"3397\">\n<li data-start=\"3247\" data-end=\"3275\">\n<p data-start=\"3249\" data-end=\"3275\">Passive traffic inspection<\/p>\n<\/li>\n<li data-start=\"3276\" data-end=\"3311\">\n<p data-start=\"3278\" data-end=\"3311\">Network-based intrusion detection<\/p>\n<\/li>\n<li data-start=\"3312\" data-end=\"3354\">\n<p data-start=\"3314\" data-end=\"3354\">Protocol analysis and session visibility<\/p>\n<\/li>\n<li data-start=\"3355\" data-end=\"3397\">\n<p data-start=\"3357\" data-end=\"3397\">Detection of suspicious network behavior<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"3399\" data-end=\"3480\">It complements Wazuh by focusing on <strong data-start=\"3435\" data-end=\"3479\">network activity rather than host events<\/strong>.<\/p>\n<p data-start=\"3162\" data-end=\"3187\"><strong data-start=\"3166\" data-end=\"3187\">6. Ubuntu Server 24.04 \u2013 Router \/ DHCP \/ DNS<\/strong><\/p>\n<p>Ubuntu Router VM role:<\/p>\n<ul>\n<li data-start=\"231\" data-end=\"321\">\n<p data-start=\"51\" data-end=\"141\"><strong data-start=\"51\" data-end=\"63\">Routing:<\/strong> Connects the different subnets (e.g., management, monitoring, lab network).<\/p>\n<\/li>\n<li data-start=\"231\" data-end=\"321\">\n<p data-start=\"51\" data-end=\"141\"><strong data-start=\"143\" data-end=\"151\">NAT:<\/strong> Allows the VMs to access the Internet through the host, if needed.<\/p>\n<\/li>\n<li data-start=\"231\" data-end=\"321\">\n<p data-start=\"51\" data-end=\"141\"><strong data-start=\"222\" data-end=\"248\">DHCP \/ DNS (optional):<\/strong> Can assign IPs to the lab VMs or provide DNS resolution.<\/p>\n<\/li>\n<li data-start=\"231\" data-end=\"321\">\n<p data-start=\"51\" data-end=\"141\"><strong data-start=\"309\" data-end=\"333\">Firewall \/ Security:<\/strong> Can filter traffic between subnets.<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"3399\" data-end=\"3480\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-4786 size-large\" src=\"https:\/\/webembed.gr\/wp-content\/uploads\/2026\/01\/wazuh_sec_onion-1024x683.png\" alt=\"wazuh_sec_onion\" width=\"1024\" height=\"683\" srcset=\"https:\/\/webembed.gr\/wp-content\/uploads\/2026\/01\/wazuh_sec_onion-1024x683.png 1024w, https:\/\/webembed.gr\/wp-content\/uploads\/2026\/01\/wazuh_sec_onion-300x200.png 300w, https:\/\/webembed.gr\/wp-content\/uploads\/2026\/01\/wazuh_sec_onion-768x512.png 768w, https:\/\/webembed.gr\/wp-content\/uploads\/2026\/01\/wazuh_sec_onion-1500x1000.png 1500w, https:\/\/webembed.gr\/wp-content\/uploads\/2026\/01\/wazuh_sec_onion-1320x880.png 1320w, https:\/\/webembed.gr\/wp-content\/uploads\/2026\/01\/wazuh_sec_onion.png 1536w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<p data-start=\"3487\" data-end=\"3523\"><strong data-start=\"3490\" data-end=\"3523\">Network Segmentation Strategy<\/strong><\/p>\n<p data-start=\"3524\" data-end=\"3609\">To reflect real enterprise environments, the lab uses <strong data-start=\"3578\" data-end=\"3608\">logical network separation<\/strong>:<\/p>\n<p data-start=\"3611\" data-end=\"3637\"><strong data-start=\"3615\" data-end=\"3637\">Management Network:<\/strong><\/p>\n<ul data-start=\"3638\" data-end=\"3781\">\n<li data-start=\"3638\" data-end=\"3671\">\n<p data-start=\"3640\" data-end=\"3671\">Used by all servers and clients<\/p>\n<\/li>\n<li data-start=\"3672\" data-end=\"3737\">\n<p data-start=\"3674\" data-end=\"3737\">Handles authentication, file access, RDS, and normal operations<\/p>\n<\/li>\n<li data-start=\"3738\" data-end=\"3781\">\n<p data-start=\"3740\" data-end=\"3781\">Represents the internal corporate network<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"3783\" data-end=\"3809\"><strong data-start=\"3787\" data-end=\"3809\">Monitoring Network:<\/strong><\/p>\n<ul data-start=\"3810\" data-end=\"3982\">\n<li data-start=\"3810\" data-end=\"3850\">\n<p data-start=\"3812\" data-end=\"3850\">Dedicated interface for Security Onion<\/p>\n<\/li>\n<li data-start=\"3851\" data-end=\"3881\">\n<p data-start=\"3853\" data-end=\"3881\">Operates in promiscuous mode<\/p>\n<\/li>\n<li data-start=\"3882\" data-end=\"3937\">\n<p data-start=\"3884\" data-end=\"3937\">Receives mirrored traffic from the Management Network<\/p>\n<\/li>\n<li data-start=\"3938\" data-end=\"3982\">\n<p data-start=\"3940\" data-end=\"3982\">No direct access from endpoints or servers<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"3984\" data-end=\"4111\">This design ensures Security Onion can observe traffic without interfering, maintaining a clear separation of responsibilities.<\/p>\n<p data-start=\"4118\" data-end=\"4149\"><strong data-start=\"4121\" data-end=\"4149\">Why Segmentation Matters<\/strong><\/p>\n<p data-start=\"4150\" data-end=\"4176\">This segmentation enables:<\/p>\n<ul data-start=\"4177\" data-end=\"4383\">\n<li data-start=\"4177\" data-end=\"4242\">\n<p data-start=\"4179\" data-end=\"4242\">Safer monitoring without introducing risk to production traffic<\/p>\n<\/li>\n<li data-start=\"4243\" data-end=\"4303\">\n<p data-start=\"4245\" data-end=\"4303\">Clear analysis of lateral movement and suspicious behavior<\/p>\n<\/li>\n<li data-start=\"4304\" data-end=\"4336\">\n<p data-start=\"4306\" data-end=\"4336\">Realistic SOC-style visibility<\/p>\n<\/li>\n<li data-start=\"4337\" data-end=\"4383\">\n<p data-start=\"4339\" data-end=\"4383\">Easier troubleshooting and incident response<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"4385\" data-end=\"4467\">It also reinforces good architectural habits commonly used in enterprise networks.<\/p>\n<p data-start=\"4474\" data-end=\"4498\"><strong data-start=\"4477\" data-end=\"4498\">What This Enables<\/strong><\/p>\n<p data-start=\"4499\" data-end=\"4543\">With this design in place, the lab supports:<\/p>\n<ul data-start=\"4544\" data-end=\"4684\">\n<li data-start=\"4544\" data-end=\"4577\">\n<p data-start=\"4546\" data-end=\"4577\">System administration workflows<\/p>\n<\/li>\n<li data-start=\"4578\" data-end=\"4602\">\n<p data-start=\"4580\" data-end=\"4602\">Centralized monitoring<\/p>\n<\/li>\n<li data-start=\"4603\" data-end=\"4633\">\n<p data-start=\"4605\" data-end=\"4633\">Security incident simulation<\/p>\n<\/li>\n<li data-start=\"4634\" data-end=\"4684\">\n<p data-start=\"4636\" data-end=\"4684\">Log correlation across hosts and network traffic<\/p>\n<\/li>\n<\/ul>\n<p data-start=\"4686\" data-end=\"4774\">This foundation is essential for the scenarios explored in the next parts of the series.<\/p>\n<p data-start=\"4781\" data-end=\"4799\"><strong data-start=\"4784\" data-end=\"4799\">What\u2019s Next<\/strong><\/p>\n<p data-start=\"4800\" data-end=\"4832\">In <strong data-start=\"4803\" data-end=\"4813\">Part 2<\/strong>, we will focus on:<\/p>\n<ul data-start=\"4833\" data-end=\"4980\">\n<li data-start=\"4833\" data-end=\"4865\">\n<p data-start=\"4835\" data-end=\"4865\">Active Directory configuration<\/p>\n<\/li>\n<li data-start=\"4866\" data-end=\"4893\">\n<p data-start=\"4868\" data-end=\"4893\">User and group management<\/p>\n<\/li>\n<li data-start=\"4894\" data-end=\"4919\">\n<p data-start=\"4896\" data-end=\"4919\">File server permissions<\/p>\n<\/li>\n<li data-start=\"4920\" data-end=\"4980\">\n<p data-start=\"4922\" data-end=\"4980\">Common administrative issues and troubleshooting scenarios<\/p>\n<\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"<p>Series Overview This article series documents the design and implementation of a real-world Windows Server lab that combines system administration, monitoring, and security operations. The project reflects an environment already applied in a practical scenario and is designed to mirror enterprise infrastructure as closely as possible. Parts Part 1: Architecture &amp; Network Design Part 2: [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":4787,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1,78,74,3,4,76],"tags":[132,144,140,138,134,141,145,146,137,133,113,139,143,136,110,135,142,108,147,131],"class_list":["post-4785","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-data-privacy-protection","category-digital-transformation","category-how-to-guides","category-tech-insights-trends","category-tech-driven-business-strategy","tag-active-directory","tag-case-study","tag-cybersecurity-lab","tag-endpoint-monitoring","tag-file-server","tag-it-infrastructure","tag-lab-environment","tag-monitoring-logging","tag-network-segmentation","tag-rds","tag-security-monitoring","tag-security-onion","tag-sysadmin-best-practices","tag-system-administration","tag-threat-detection","tag-virtual-lab","tag-virtualization","tag-wazuh","tag-windows-client-management","tag-windows-server-2025"],"_links":{"self":[{"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/posts\/4785","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/comments?post=4785"}],"version-history":[{"count":5,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/posts\/4785\/revisions"}],"predecessor-version":[{"id":4885,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/posts\/4785\/revisions\/4885"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/media\/4787"}],"wp:attachment":[{"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/media?parent=4785"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/categories?post=4785"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webembed.gr\/el\/wp-json\/wp\/v2\/tags?post=4785"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}