The CyberLab uses two domain controllers in a single-domain model for the acs-p01.local forest (NetBIOS ACS-P01).
Current state (September 5, 2026): DC01 and DC02 remain domain controllers for
acs-p01.local— they are not being demoted or converted. What is changing is their role as session hosts: every student now has their own pod member server and connects there instead. Student RDP on DC01 is still technically enabled and is removed as the final cutover step, after the Pod01/Pod03 pilots pass. Student accounts do not move —student01–student20stay domain accounts held here.
| Property | Value |
|---|---|
| VM ID | 200 |
| Hostname | DC01-P01 |
| IP Address | 10.50.1.10 |
| OS | Windows Server 2022 |
| Domain | acs-p01.local |
| FSMO Roles | All 5 roles |
| vCPU | 12 |
| RAM | 32 GB |
| Bridge | pod01net (pods reach it through their pod gateway) |
| RD Session Host | Installed |
| Autostart | onboot=1 |
acs-p01.local zone)Without the RD Session Host role, Windows Server allows only 2 concurrent RDP sessions (administrative remote access). With all 20 pods pointed at DC01 that meant the third student was blocked, which is exactly the failure students hit on August 17.
Applied on DC01:
| Setting | Value | Effect |
|---|---|---|
RDS-RD-Server feature |
Installed | Lifts the 2-session cap |
LicensingMode |
4 (Per User) | No license server configured — runs on the RDS grace period |
MaxInstanceCount |
999999 | No artificial session cap |
MaxDisconnectionTime |
3600000 ms (1 h) | Disconnected sessions end and free resources |
MaxIdleTime |
7200000 ms (2 h) | Idle sessions are disconnected |
fSingleSessionPerUser |
1 | One session per student account |
Windows Search (WSearch) |
Disabled | Removes per-session indexing overhead |
| Defender exclusion | C:\CyberLab |
Keeps evidence writes off the scanner |
Validated, not just configured: 12 real student logons were driven through guacd simultaneously and all 12 were logged on at once (confirmed with quser) at roughly 2% CPU with ~27 GB RAM free. Sizing guidance from that test: 12 vCPU / 32 GB for 12 concurrent students, 12 vCPU / 48 GB if all 20 are on DC01.
Configuration and the load-test harness are codified in the crc-awx-labops repository (playbooks/configure-dc-session-host.yml, docs/runbooks/SHARED-DC-CAPACITY.md).
There is no RD licensing server and no RDS CALs, so DC01's session host runs on the RDS grace period. Windows Server 2022 Datacenter product keys license the operating system — they are not RDS CALs. The pod member server model removes this exposure: one student per server needs no CALs, and the RD Session Host role comes off DC01 when student logon is retired.
| Property | Value |
|---|---|
| VM ID | 221 |
| Hostname | DC02-P01 |
| IP Address | 10.50.1.11 |
| OS | Windows Server 2022 Datacenter Evaluation |
| Domain | acs-p01.local |
| vCPU | 4 |
| RAM | 16 GB |
| Bridge | pod01net |
| RD Session Host | Not installed (2-session admin limit) |
| License Expiry | October 2, 2026 |
DC02 is a replica for authentication resilience only. No student sessions run on DC02: its RDS logon right is restricted to Administrators, no Guacamole connection points at it, and it holds no pod evidence trees. There has never been a "students 01–10 on DC01 / 11–20 on DC02" split. Students are now issued PODXX-SRV tiles at 10.50.XX.20, and seed/verify/reset run against crc_pod_servers; the legacy PODXX-DC tiles at 10.50.1.10 and the crc_shared_dcs path are retained only for rollback.
Activating the Datacenter key on DC02 is planned for break week.
Students now sign in to their own PODXX-SRV, not to a DC. What the DCs still provide to a student session is directory service only: DNS, Kerberos logon, LDAP/LDAPS for ADUC and AD PowerShell, Global Catalog, and SYSVOL/NETLOGON for the logon script.
Directory-side rights are unchanged by the migration:
studentXX is delegated GenericAll on its own OU=PodXX,OU=Students,DC=acs-p01,DC=local — nothing else.studentXX@acs-p01.local (or ACS-P01\studentXX). ACS\studentXX is invalid — the NetBIOS name is ACS-P01.Still to remove at final cutover: studentXX membership in DC01's Remote Desktop Users, the RDS logon right for students, and their grants on the PODXX-DC Guacamole connections. DNS, LDAP/LDAPS, Kerberos, Global Catalog, SYSVOL/NETLOGON and replication are re-tested after that change.
AD replication between DC01 and DC02 uses standard intra-site replication over the shared 10.50.1.0/24 network. Both DCs are in Default-First-Site-Name.
| Page | Purpose |
|---|---|
| Pod Member Servers | The student session hosts (PODXX-SRV) |
| Pod Infrastructure | Pod networks, OUs, gateways |
| Student Quick Start | Student-facing login instructions |