IT Support Home Lab

I built this lab to get hands-on experience with the tools and workflows that come up every day in helpdesk and IT support roles. Rather than just reading about Active Directory or ticketing systems, I wanted to actually build and break things, figure out why they broke, and fix them, because that is what the job is really like.

Everything here was built from scratch on my own machine using VirtualBox. No pre-built VMs, no shortcuts.

---

What the Lab Covers

• Setting up a Windows Server 2019 Domain Controller from scratch
• Building an Active Directory structure that mirrors how real companies organise their users and computers
• Configuring Group Policy for password rules, account lockouts, and desktop restrictions
• Joining a Windows 10 client to the domain and verifying everything works
• Installing and configuring osTicket as a helpdesk ticketing system
• Working through realistic helpdesk scenarios from ticket open to close

---

Lab Environment

Component	Details
Hypervisor	Oracle VirtualBox
Domain Controller	Windows Server 2019 Standard (DC01)
Client Machine	Windows 10 Pro (CLIENT01)
Domain	labcorp.local
Ticketing System	osTicket v1.18
Web Stack	XAMPP (Apache, MySQL, PHP)

Both VMs run on an internal network called LAB_INTERNAL. The server has a second NAT adapter for internet access during setup. The client only talks to the internal network and uses the DC as its DNS server.

---

Active Directory Structure

I organised the AD the way you would typically see it in a real environment, with users separated by department, computers in their own OU, and groups kept separate for easy management.

labcorp.local
├── _USERS
│   ├── IT
│   ├── HR
│   └── Finance
├── _COMPUTERS
│   └── Workstations
├── _GROUPS
└── _SERVICEACCOUNTS

One thing I learned early on is that if you leave users in the default built-in containers, your Group Policies will not apply to them. Everything needs to live in a proper OU.

---

Group Policies Configured

Password Policy (linked to domain):

• Minimum 10 characters
• Complexity required
• 90 day maximum age
• Last 5 passwords remembered

Account Lockout Policy (linked to domain):

• Locks after 5 failed attempts
• Stays locked for 30 minutes
• Counter resets after 15 minutes

Desktop Restriction Policy (linked to _USERS OU):

• Prevents users from changing their desktop background
• Applies to all users in HR and Finance through inheritance

---

Helpdesk Scenarios Documented

Account Lockout

Simulated a real lockout by triggering 5 failed login attempts on the Windows 10 client. Then resolved it two ways, through the GUI in Active Directory Users and Computers, and through PowerShell using Unlock-ADAccount. Both methods are worth knowing because in a real environment you will use PowerShell when dealing with multiple accounts or working remotely.

Password Reset

Walked through resetting a user password both through ADUC and via PowerShell with Set-ADAccountPassword. After the reset, forced the user to change their password at next logon, which is standard practice so the helpdesk never knows a user's current password.

New User Onboarding

Created a new Finance hire (David Lee) in the correct OU, added them to the Finance-ReadOnly security group, and set a temporary password with a forced reset at first login. This mirrors the kind of onboarding ticket you would work through on day one at most companies.

---

osTicket Setup

Installed osTicket on the domain controller using XAMPP as the web server stack. Configured the following:

Help Topics:

• Account Lockout
• Password Reset
• New User Request
• Permission / Access Issue
• Hardware Issue
• Software Installation

SLA Plans:

• SEV-A: 1 hour response, 24/7
• SEV-B: 4 hour response, 24/7
• SEV-C: 8 hour response, business hours only

Departments:

• IT Support Level 1
• IT Support Level 2

---

Sample Ticket: Full Lifecycle

This is what a real account lockout ticket looks like from start to finish.

User submitted:

I have been locked out of my account since 8am. I have an urgent report due. Please help.

Internal note (not visible to user):

Verified caller identity via employee ID badge number. Confirmed account b.johnson is locked in AD. 5 failed attempts logged. No suspicious activity pattern observed. Proceeding with account unlock via PowerShell.

Reply to user:

Hi Bob, I have unlocked your account and you should now be able to log in. Please note that accounts lock automatically after 5 incorrect password attempts. Contact us if you need further assistance.

Outcome: Ticket closed with status Resolved.

---

PowerShell Scripts

The /06-powershell-scripts folder contains scripts I wrote for common AD tasks:

• unlock-account.ps1 unlocks a user account and confirms the result
• reset-password.ps1 resets a password and forces change at next logon
• new-user-onboarding.ps1 creates a user in the correct OU and assigns group membership
• get-lockout-status.ps1 checks whether an account is currently locked

---

Repository Structure

it-support-homelab/
├── README.md
├── 01-lab-architecture/
│   └── screenshots/
├── 02-active-directory/
│   ├── ou-structure.md
│   ├── gpo-configurations.md
│   └── screenshots/
├── 03-osticket/
│   ├── help-topics-config.md
│   ├── sla-configuration.md
│   └── screenshots/
├── 04-helpdesk-scenarios/
│   ├── scenario-01-account-lockout.md
│   ├── scenario-02-password-reset.md
│   ├── scenario-03-new-user-onboarding.md
│   └── screenshots/
├── 05-password-reset-workflows/
│   └── screenshots/
└── 06-powershell-scripts/
    ├── unlock-account.ps1
    ├── reset-password.ps1
    ├── new-user-onboarding.ps1
    └── get-lockout-status.ps1

---

What I Got Out of This

A few things stood out while building this. The GPO issue where policies do not apply to users in default containers is the kind of thing you would only discover by actually doing it. Same with the domain join failing silently when DNS is not pointing to the DC, that took some troubleshooting before I figured out what was wrong.

Working through the osTicket ticket lifecycle also made me think more carefully about documentation. Writing an internal note that a colleague could pick up mid-shift and understand immediately is a skill in itself. It is not just about fixing the problem, it is about leaving a clear record of what you did and why.

---

Certification

CompTIA Security+ certified. You can verify the badge here:

CompTIA Security+ on Credly

---

Let's Connect

I am open to helpdesk, IT support, and Sysadmin roles across Canada. Feel free to reach out on LinkedIn if you have questions about anything in this lab or just want to connect.

LinkedIn: Segun Olawunmi