Windows Server final project: check, break and fix a whole network

Start DC01, DC02, SRV01 and CL01. Take a snapshot of every VM (“Before final project”). Work as SAATLAB\adm.rahul in PowerShell as administrator on DC01.

1Read the brief and prepare DC01

SaatLab Traders has 50 staff in Finance, IT and Sales. They need to sign in, open their department shares, print, use the intranet over HTTPS, and get their desktop settings from Group Policy, at both HQ and Branch.

Install the DHCP management tools on DC01 so it can check SRV01:

Install-WindowsFeature RSAT-DHCP | Select-Object Success
New-Item C:\Lab -ItemType Directory -Force | Out-Null

You’ll see something like this:

Success
-------
True

✅ Checkpoint: DC01 has the AD, Group Policy, DNS and DHCP tools, and C:\Lab exists.

2Write and run the health check

Save as C:\Lab\Test-SaatLab.ps1:

$checks = [ordered]@{
    '01 DNS: intranet resolves'        = { (Resolve-DnsName intranet.saatlab.internal -Type A -ErrorAction Stop).IPAddress -contains '10.0.0.20' }
    '02 IIS: W3SVC running on SRV01'   = { (Get-Service W3SVC -ComputerName SRV01).Status -eq 'Running' }
    '03 Shares: no deny on Departments'= { -not (Get-SmbShareAccess -CimSession SRV01 -Name Departments | Where-Object AccessControlType -eq 'Deny') }
    '04 Groups: Priya in GG_Finance'   = { (Get-ADGroupMember GG_Finance).SamAccountName -contains 'priya.sharma' }
    '05 GPO: U-Staff-Desktop enabled'  = { (Get-GPO -Name U-Staff-Desktop).GpoStatus -eq 'AllSettingsEnabled' }
    '06 AD: Netlogon running on DC02'  = { (Get-Service Netlogon -ComputerName DC02).Status -eq 'Running' }
    '07 Network: HTTPS open on SRV01'  = { Test-NetConnection SRV01 -Port 443 -InformationLevel Quiet -WarningAction SilentlyContinue }
    '08 Accounts: kiran.das unlocked'  = { -not (Get-ADUser kiran.das -Properties LockedOut).LockedOut }
    '09 Print: Spooler running on SRV01' = { (Get-Service Spooler -ComputerName SRV01).Status -eq 'Running' }
    '10 AD: DC02 outbound replication' = { -not ((repadmin /options DC02) -match 'DISABLE_OUTBOUND_REPL') }
}
$checks.GetEnumerator() | ForEach-Object {
    $ok = try { [bool](& $_.Value) } catch { $false }
    [pscustomobject]@{ Check = $_.Key; Result = if ($ok) { 'PASS' } else { 'FAIL' } }
}

Run it:

C:\Lab\Test-SaatLab.ps1 | Format-Table -AutoSize

You’ll see something like this:

Check                              Result
-----                              ------
01 DNS: intranet resolves          PASS
02 IIS: W3SVC running on SRV01     PASS
03 Shares: no deny on Departments  PASS
04 Groups: Priya in GG_Finance     PASS
05 GPO: U-Staff-Desktop enabled    PASS
06 AD: Netlogon running on DC02    PASS
07 Network: HTTPS open on SRV01    PASS
08 Accounts: kiran.das unlocked    PASS
09 Print: Spooler running on SRV01 PASS
10 AD: DC02 outbound replication   PASS

Every check must pass on a healthy lab. If one fails now, fix the lab (or the check) before you go on. Each check tests what users need, so a FAIL always means a real problem.

✅ Checkpoint: Test-SaatLab.ps1 shows 10 PASS results.

3Write the fault script and break three things

Save as C:\Lab\Break-SaatLab.ps1 (or ask a friend to write and run it, so you don’t know what it does):

param([int[]]$Fault = (1..10 | Get-Random -Count 3))
$faults = @{
    1  = { Remove-DnsServerResourceRecord -ZoneName saatlab.internal -Name intranet -RRType A -Force }
    2  = { Invoke-Command SRV01 { Stop-Service W3SVC; Set-Service W3SVC -StartupType Disabled } }
    3  = { Block-SmbShareAccess -CimSession SRV01 -Name Departments -AccountName 'SAATLAB\GG_Finance' -Force | Out-Null }
    4  = { Remove-ADGroupMember GG_Finance -Members priya.sharma -Confirm:$false }
    5  = { (Get-GPO -Name U-Staff-Desktop).GpoStatus = 'UserSettingsDisabled' }
    6  = { Invoke-Command DC02 { Stop-Service Netlogon } }
    7  = { Invoke-Command SRV01 { New-NetFirewallRule -DisplayName 'Final project rule' -Direction Inbound -Protocol TCP -LocalPort 443 -Action Block | Out-Null } }
    8  = { 1..11 | ForEach-Object { net use \\SRV01\IPC$ /user:SAATLAB\kiran.das WrongPass1 2>$null | Out-Null } }
    9  = { Invoke-Command SRV01 { Stop-Service Spooler -Force; Set-Service Spooler -StartupType Disabled } }
    10 = { repadmin /options DC02 +DISABLE_OUTBOUND_REPL | Out-Null }
}
foreach ($f in $Fault) { & $faults[$f] }
"Applied $($Fault.Count) fault(s). Good luck."

Run it without looking at which numbers it picks:

C:\Lab\Break-SaatLab.ps1
Clear-Host
C:\Lab\Test-SaatLab.ps1 | Where-Object Result -eq 'FAIL'

You’ll see something like this (yours will differ):

Check                              Result
-----                              ------
03 Shares: no deny on Departments  FAIL
06 AD: Netlogon running on DC02    FAIL
09 Print: Spooler running on SRV01 FAIL

The health check tells you what users would notice. It doesn’t tell you the cause or the fix: that’s your job.

✅ Checkpoint: Three checks fail after running Break-SaatLab.ps1.

4Find and fix each fault

For each FAIL, follow the workflow from Lesson 42. Confirm the symptom as a user would see it, scope it, find the evidence (events, settings, logs), fix the cause and rerun the health check. Use the lesson references in the table above if you get stuck.

Keep a short incident note for each fault, for example:

$notes = @'
INC-C1 | Print fails | Spooler stopped and Disabled on SRV01 (event 7040) | Set to Automatic, started | PASS 09
INC-C2 | Branch logons slow | Netlogon stopped on DC02 (dcdiag Advertising fail) | Started Netlogon | PASS 06
INC-C3 | Finance denied on Departments | Deny entry for GG_Finance on the share | Unblock-SmbShareAccess | PASS 03
'@
$notes | Set-Content C:\Lab\final-project-incidents.txt

After all fixes, run the full check again:

C:\Lab\Test-SaatLab.ps1 | Where-Object Result -eq 'FAIL' | Measure-Object | Select-Object Count

You should see this:

Count
-----
    0

Then run Break-SaatLab.ps1 again for three more faults, until you’ve fixed all ten at least once. Restore the “Before final project” snapshots if you get completely stuck.

✅ Checkpoint: All checks pass again, and C:\Lab\final-project-incidents.txt has a note for every fault you fixed.

5Produce your final report

Save the results as an HTML report:

$results = C:\Lab\Test-SaatLab.ps1
$results | ConvertTo-Html -Title 'SaatLab health report' -PreContent "<h1>SaatLab health report</h1><p>$(Get-Date)</p>" |
    Set-Content C:\Lab\SaatLab-Health.html
Start-Process C:\Lab\SaatLab-Health.html

Open the report in a browser: ten PASS rows with the date. Together with your incident notes and the scripts, it’s a portfolio you can show and explain in an interview. [Add your screenshot here]

✅ Checkpoint: C:\Lab\SaatLab-Health.html shows all ten checks passing.