Windows Server networking basics

Start DC01 and SRV01. Use PowerShell as administrator on each. The step title tells you which server to use.

1Work out a subnet’s range (any machine)

Paste this whole block:

function Get-Subnet {
    param([string]$Address, [int]$Prefix)
    $ip   = ([ipaddress]$Address).GetAddressBytes()
    $mask = 0..3 | ForEach-Object { $b = [math]::Max(0, [math]::Min(8, $Prefix - 8 * $_)); [byte](256 - [math]::Pow(2, 8 - $b)) }
    $net  = 0..3 | ForEach-Object { $ip[$_] -band $mask[$_] }
    $bc   = 0..3 | ForEach-Object { $net[$_] + (255 - $mask[$_]) }
    [pscustomobject]@{
        Address     = $Address
        Prefix      = $Prefix
        Mask        = $mask -join '.'
        Network     = $net -join '.'
        Broadcast   = $bc -join '.'
        UsableHosts = [math]::Pow(2, 32 - $Prefix) - 2
    }
}

Run this to see all three in a table:

'10.0.0.10/24','192.168.10.77/26','172.16.5.200/20' | ForEach-Object { $a, $p = $_ -split '/'; Get-Subnet $a ([int]$p) } | Format-Table -AutoSize

You should see this:

Address       Prefix Mask            Network       Broadcast      UsableHosts
-------       ------ ----            -------       ---------      -----------
10.0.0.10         24 255.255.255.0   10.0.0.0      10.0.0.255             254
192.168.10.77     26 255.255.255.192 192.168.10.64 192.168.10.127          62
172.16.5.200      20 255.255.240.0   172.16.0.0    172.16.15.255         4094

Every extra bit of prefix halves the subnet. A /26 has 62 usable hosts, a /20 has 4,094. When someone asks “is 10.0.0.200 on the same network as DC01?”, you now have an exact answer: yes, it’s inside 10.0.0.0 to 10.0.0.255.

✅ Checkpoint: Your table matches the one above.

2Ping DC01 from SRV01

On SRV01, run this:

Test-NetConnection 10.0.0.10

You’ll probably see PingSucceeded : False, even though both servers are fine. Hold that thought; it’s the first Break It below. For now, test a TCP port instead, which is what real applications use:

Still on SRV01, run this:

Test-NetConnection 10.0.0.10 -Port 3389 | Select-Object RemoteAddress, RemotePort, TcpTestSucceeded

You should see this:

RemoteAddress RemotePort TcpTestSucceeded
------------- ---------- ----------------
10.0.0.10           3389             True

✅ Checkpoint: Ping fails, but TCP 3389 (Remote Desktop, enabled in Lesson 6) succeeds.

3See ARP at work

On SRV01, run this:

Get-NetNeighbor -IPAddress 10.0.0.10, 10.0.0.1 | Select-Object IPAddress, LinkLayerAddress, State

You should see something like this:

IPAddress LinkLayerAddress  State
--------- ----------------  -----
10.0.0.1  52-54-00-12-35-00 Reachable
10.0.0.10 08-00-27-6E-4C-1A Reachable

SRV01 learned both MAC addresses with ARP while you tested. 08-00-27 at the start is VirtualBox’s vendor code for virtual network cards. When two machines claim the same IP, this table is where the confusion shows up.

✅ Checkpoint: Both DC01 and the gateway appear with a MAC address.

4Follow the name resolution order

On SRV01, try to resolve DC01 by name:

Resolve-DnsName dc01

It fails: there’s no domain DNS yet, and the public resolver has never heard of your DC01. Now add a line to SRV01’s hosts file, the very first place Windows looks:

Run these:

Add-Content C:\Windows\System32\drivers\etc\hosts "10.0.0.10    dc01"
Resolve-DnsName dc01 | Select-Object Name, Type, IPAddress
Get-DnsClientCache -Entry dc01 | Select-Object Entry, Data, TimeToLive

You should see something like this:

Name Type IPAddress
---- ---- ---------
dc01 A    10.0.0.10

Entry Data      TimeToLive
----- ----      ----------
dc01  10.0.0.10      86400

The hosts file wins over DNS, and its entries sit in the DNS client cache.

That’s why a forgotten hosts entry can send a server to the wrong place for years. Remove the line now: open the hosts file in Notepad as administrator and delete it, then run Clear-DnsClientCache. From Lesson 11 on, DNS does this job properly.

✅ Checkpoint: dc01 resolved to 10.0.0.10 from the hosts file, and you removed the line again.

5Check firewall profiles

On DC01, run these:

Get-NetConnectionProfile | Select-Object InterfaceAlias, Name, NetworkCategory
Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction

You should see something like this:

InterfaceAlias Name    NetworkCategory
-------------- ----    ---------------
Ethernet       Network          Public

Name    Enabled DefaultInboundAction
----    ------- --------------------
Domain     True        NotConfigured
Private    True        NotConfigured
Public     True        NotConfigured

The LabNet connection is in the Public profile, because DC01 isn’t in a domain and Windows doesn’t trust the network.

All three profiles are on. NotConfigured looks scary but just means “the built-in default”, which for inbound traffic is Block. After Lesson 11, DC01’s connection switches to DomainAuthenticated.

✅ Checkpoint: DC01 shows NetworkCategory Public and all three firewall profiles enabled.

6Find the rule that allows Remote Desktop

On DC01, run this:

Get-NetFirewallRule -DisplayGroup 'Remote Desktop' | Where-Object Enabled -eq True | Select-Object DisplayName, Profile, Direction, Action

You should see something like this:

DisplayName                           Profile Direction Action
-----------                           ------- --------- ------
Remote Desktop - User Mode (TCP-In)       Any   Inbound  Allow
Remote Desktop - User Mode (UDP-In)       Any   Inbound  Allow
Remote Desktop - Shadow (TCP-In)          Any   Inbound  Allow

These are the rules you turned on in Lesson 6, and Profile: Any is why step 2’s port test worked even on the Public profile. When a port test fails, this is the command that shows whether a rule exists, whether it’s enabled and which profiles it covers.

✅ Checkpoint: You can see enabled Remote Desktop rules with Profile Any.

7Check the routing table

On SRV01, run this:

Get-NetRoute -AddressFamily IPv4 | Where-Object DestinationPrefix -in '0.0.0.0/0','10.0.0.0/24' | Select-Object DestinationPrefix, NextHop, RouteMetric

You should see this:

DestinationPrefix NextHop  RouteMetric
----------------- -------  -----------
10.0.0.0/24       0.0.0.0          256
0.0.0.0/0         10.0.0.1         256

Two routes explain everything SRV01 does: anything in 10.0.0.0/24 goes straight out (next hop 0.0.0.0 means “on this link”), and everything else (0.0.0.0/0, the default route) goes to the gateway 10.0.0.1. Remember this table for Break It 2.

✅ Checkpoint: SRV01 has a local route for 10.0.0.0/24 and a default route through 10.0.0.1.