Applies to: Cohort 1, which ran on the shared DC01 session host
(August 2026). Cohort 2 runs on per-student
pod member servers (PODXX-SRV), where each student
is a local administrator of their own machine — the two host-rights waivers
below (IA M2-L1's stored credential, MP's media mounting) are retired once the
Pod01/Pod03 pilots pass. The IA M3-L2 waiver stays: the Default Domain Password
Policy is a domain-wide change either way.
On the shared domain controller students were deliberately not administrators
of the host, so three lab steps were credited rather than performed. Everything
else in the 57 labs is possible with a student's delegated pod permissions.
On PODXX-SRV the student is a local administrator of that server, so tools open
the normal way and elevation prompts are theirs to approve:
| Tool | Launch |
|---|---|
| ADUC | Desktop shortcut Active Directory Users and Computers, or Windows + R → dsa.msc |
| Group Policy Management | Windows + R → gpmc.msc |
| Task Scheduler | Windows + R → taskschd.msc |
| Local Security Policy | Windows + R → secpol.msc |
| PowerShell | Start → Windows PowerShell (elevated also works) |
Local administrator on the member server grants no domain privilege: ADUC
binds to DC01-P01/DC02-P01 and the student's directory rights are still scoped to
their own OU=PodXX.
Cohort 1 / shared DC only: ADUC had to be launched unelevated with
cmd /c "set __COMPAT_LAYER=RunAsInvoker&& start "" mmc.exe dsa.msc" (deployed as
C:\CyberLab\Tools\Open-ADUC.cmd by
scripts/deploy_aduc_launcher.ps1), because anything
elevating produced "Logon failure: the user has not been granted the requested
logon type at this computer". That workaround is unnecessary on a member
server.
| Item | State |
|---|---|
Step 1 — create PXX-svc_backup |
Graded as normal |
Step 2 — repoint PodXX ACS Nightly Backup at the service account |
Read-only / credited |
| Verifier | ia_m2l1_task_step_waived: true |
Storing a scheduled-task credential requires SeTcbPrivilege, i.e. local
administrator. Tested from a real student account on the shared DC with password,
S4U and interactive logon types — all return Access is denied. Students inspect
the task and read the step; the principal remains PXX-s.jenkins.
On PODXX-SRV the student holds that privilege on their own server, so the step
is performable. The waiver flag stays enabled until the Pod01/Pod03 pilots prove
it from a real RDP session, then it is retired with the matching guide and
verifier change.
Separately, the task's security descriptor originally excluded student accounts,
so the task appeared to be missing from Task Scheduler and
Get-ScheduledTask. That was fixed on all 20 pods and verified from a student
session — the task is present and readable.
The Default Domain Password Policy is domain-wide on acs-p01.local, so one
pod's change would apply to all 20. The hardened policy has been applied
centrally and students verify and document it instead of changing it:
| Setting | Value |
|---|---|
| Minimum password length | 12 |
| Complexity (upper, lower, number, symbol) | Enabled |
| Lockout threshold | 10 attempts |
| Password history | 24 |
| Maximum age | 90 days |
Get-ADDefaultDomainPasswordPolicy |
Select-Object MinPasswordLength, ComplexityEnabled, LockoutThreshold,
PasswordHistoryCount, MaxPasswordAge, MinPasswordAge
Set-ADDefaultDomainPasswordPolicy and GPO edits are denied by design. The lab
passes for every pod because the policy is genuinely hardened.
Knock-on effect: every lab that sets a password — AC L2.1, IA M1-L2, IA
M2-L1's service account and IA M3-L3 — must use 12+ characters with upper case,
lower case, a number and a symbol (verified live: LabUser!2026#ac and
CyberLab-2026! are accepted, an 8-character password is rejected). The student's
own Guacamole/domain sign-in password predates the policy and is shorter, so
students who reuse it when creating an account get "The password does not meet
the password policy requirements". That rejection is the policy working, not a
fault; the guides and all 20 quick starts now print a compliant example instead
of "the lab password your instructor provided".
Mounting a VHDX requires SeManageVolumePrivilege; formatting requires more
still. Granting either on a shared domain controller is an administrator
escalation path, so both hands-on steps are credited
(mp_media_mount_waived: true) and the paperwork remains real work.
On PODXX-SRV mounting is possible — the blast radius is one student's own
server — so this waiver is retired after the pilots, together with a guide update
that restores the hands-on steps.
Instead of mounting, each pod has published contents listings alongside the
images in C:\CyberLab\PodXX\MP-Artifacts\:
PXX-FCI-USB-Contents.txtPXX-Employee-Handbook-Contents.txtThey list the volume label and every file and folder, including hidden items, so
classification, the sanitization log and the certificate are all graded normally.
The PODXX-GW Guacamole tiles were created with protocol http, which guacd
does not implement (Support for protocol "http" is not installed), so clicking
one failed and the tile's autoretry looped. All 20 tiles are hidden from
students — the connection objects still exist for administrators, so restoring
them is a single permission statement.
The supported path is a browser inside the student's own desktop:
http://10.51.XX.1 (Pod 06 → http://10.51.6.1).This required routing work — the pod hosts are on 10.50.x while the pfSense
LANs are on 10.51.x, so neither documented option had ever worked. See
Network & Firewall for the per-pod route/SNAT service.
PODXX-GW remains the firewall's name in diagrams; it is simply not a clickable
connection.
Each student receives exactly one connection to use, PODXX-SRV, pointing at
their own member server (10.50.XX.20) and granted only to the matching
studentXX. The legacy PODXX-DC connections still exist as the rollback path
until cutover completes and are not part of any guide. The 20 PODXX-WS01
connections were deleted in June 2026 and the 20 PODXX-GW tiles are hidden, so
all guides and handouts list PODXX-SRV only.
Both messages were unreadable and M3-L1 was also wrong.
M3-L1 compared rules across every interface, so the separate default-deny rule
that each interface needs after M2-L2 (DMZ) and M2-L3 (VLANs) counted as a duplicate
of the LAN deny — a correctly segmented pod could not pass. Duplicates are now judged
within one interface tab and include protocol and port, and the failure names the
rule: FAIL:Issues(1): rule 29 on opt5 ('Allow HTTPS'): duplicate of rule 28. N is
the number of rules objected to, not a task number.
M3-L3 printed ExtraPorts(0) when no rule targeted the accounting host at all,
which reads like a passing count but actually means the one rule the lab asks you to
keep is gone. It now reports FAIL:NoHTTPSRuleTo10.51.XX.100 for a missing keeper
rule and FAIL:ExtraPorts(2): 21,3306 — naming the ports — when unnecessary ports
survive. 443, HTTPS, 443-443 and a destination written 10.51.XX.100/32 all
count.
Student fix for the missing rule: Firewall → Rules → LAN → + Add, Action Pass,
Protocol TCP, Destination Single host or alias 10.51.XX.100, Destination port
range HTTPS (443), placed above the Default Deny, then Apply Changes. If a
rule for the accounting application already exists, check that the protocol is TCP, the
destination is the host and not an interface or network address, and the port is
443. Nothing else needs rebuilding; re-verification picks the change up on the next
scheduled run.
The capstone's logging check requires every rule whose action is Block to have
Log packets that are handled by this rule ticked. pfSense stores this per rule, so
turning logging on under Status → System Logs → Settings does not satisfy it, and the
block rule created back in the segmentation lab (typically Block DMZ to LAN lateral
movement on the OPT1/DMZ tab, not LAN) is the one students overlook.
The grader used to report only capstone: passed 4/5 checks; failing: logging, which gave
no way to find the rule. It now names each offender:
capstone: passed 4/5 checks; failing: logging
(logging off on rule 10 on opt1 ('Block DMZ to LAN lateral movement'))
no block rules exist yet in that position means Task 1's default deny is missing rather
than unlogged. Student fix: edit the named rule, tick the log option under Extra
Options, Save, Apply Changes; the next scheduled verification credits the lab.
| Change | Live now | Still needed |
|---|---|---|
| Hardened password policy (M3-L2 passes) | Yes | — |
| Scheduled-task visibility fix (all 20 pods) | Yes | — |
| MP contents listings in all 20 pods | Yes | — |
| Guacamole GW tiles hidden, per-pod firewall routing | Yes | — |
mp_media_mount_waived + M3-L2 verify-only |
Yes | — |
ia_m2l1_task_step_waived verifier waiver |
Yes | — |
| ADUC / Server Manager guide corrections | Yes | — |
| SC firewall route + SC guide rewrite | Yes | — |
| Tolerant MP/PE/IA/SC wording and identifier grading | Yes | — |
| Anti-lockout baseline + SC M4-L1 log evidence | Yes (AWX project 10 synced to 8e62ba2) |
— |
| SC M3-L1 per-interface duplicates + named M3-L3 failure | Yes (PR #39 merged, project 10 synced to c40b832) |
— |
| SC M4-L3 logging failure names the offending block rules | No | Merge crc-awx-labops PR #40, then AWX project 10 sync |
| Revised guides (AC/IA/SI/SC/MP/PE) | Published on this wiki | Repo DOCX/PDF branch cannot be pushed (git proxy 403) |
AWX project 10 has update revision on launch disabled, so merging alone
does not activate a verifier change — the project must be synced
(AWX Automation).
Set ia_m2l1_task_step_waived: false and mp_media_mount_waived: false, move
M3-L2 to a per-server or fine-grained password policy, and repoint the Guacamole
RDP connections at PODXX-SRV. Credit already earned is unaffected.
| Page | Purpose |
|---|---|
| Student Quick Start | Student-facing version of these instructions |
| Lab Guides | Guides carrying the same notices |
| Pod Member Servers | Cutover that removes these waivers |
| Backlog & Known Issues | Outstanding work |