This guide provides step-by-step instructions for completing all 12 Access Control labs. Each lab presents a real-world access control problem that you must identify and fix using Active Directory Users and Computers (ADUC) on the domain controller.
In these labs you will use Active Directory Users and Computers (ADUC) — the standard Windows tool for managing user accounts, groups, and organizational structure in a corporate network. You will find and fix access control violations that simulate real-world problems a cybersecurity analyst would encounter.
The 12 labs in this guide practice two CMMC Level 1 Access Control (AC)
requirements:
| Requirement | How these labs address it |
|---|---|
| AC.L1-3.1.1 — Limit system access to authorized users | Joiner/mover/leaver work: disabling terminated accounts, provisioning approved accounts, offboarding, contractor expiration, access-review evidence (L1.1, L2.1–L2.3, L4.1–L4.3) |
| AC.L1-3.1.2 — Limit access to the transactions and functions users are authorized to perform | Least-privilege work: correcting group membership, removing nested privilege, delegating a single permission instead of admin rights (L1.2, L1.3, L3.1–L3.3) |
The other two Level 1 AC requirements — AC.L1-3.1.20 (connections to external
systems) and AC.L1-3.1.22 (publicly accessible systems) — are not
practiced in these Active Directory exercises. Boundary control is exercised in
the System & Communications Protection (SC) firewall labs (SC.L1-3.13.1), and the
remaining policy elements are covered in classroom material rather than a hands-on
lab.
You will connect to the lab through Apache Guacamole — a web-based remote desktop gateway. There is nothing to install; everything runs in your web browser.
student01student02student05student12After logging in you will see one connection for your pod:
| Connection Name | What It Is |
|---|---|
| PODXX-SRV | Your own pod member server — your desktop for the AC labs and every other lab family |
Your pod's pfSense firewall (used in the SC labs) is not a connection here: you
reach it by browsing to http://10.51.XX.1 from inside this desktop.
studentXX@acs-p01.local (or ACS-P01\studentXX) with your domain passwordTip: To return to the Guacamole home screen (for example, to switch connections), press Ctrl+Alt+Shift to open the Guacamole side menu, then click Home.
You should now see the Windows Server desktop in your browser.
dsa.mscYou are a local administrator of your own server, so ADUC, GPMC and
Server Manager → Tools all open normally — approve any elevation prompt with
your own account. ADUC connects over the network to DC01-P01 / DC02-P01 and
shows the same directory as before; the oldRunAsInvokerworkaround was only
needed when students worked on the shared domain controller. Your domain
rights are unchanged: you can modify objects in your ownOU=PodXXonly, so an
Access denied on another pod's objects is expected.
You should now see the ADUC window with a tree structure on the left side.
Your instructor assigned you a Pod number. Everything you work with is prefixed with your pod number to keep your work separate from other students.
For example, if you are Pod 03:
P03-hr.user1, P03-fin.user1, P03-sales.user1P03-SG-ACS-Finance, P03-SG-ACS-HRNavigate to your pod by expanding the tree on the left side of ADUC:
acs-p01.local
└── Students
└── Pod03 <-- Your pod (replace 03 with your number)
├── Users
│ ├── Admins (IT admin accounts)
│ └── Staff (Regular employee accounts)
├── Groups
│ ├── Security (Security groups like P03-SG-ACS-Finance)
│ └── Distribution
├── Resources
│ ├── Departments
│ │ ├── Executive
│ │ ├── IT
│ │ ├── Finance
│ │ ├── HR
│ │ ├── Consulting
│ │ └── Sales
│ └── Computers
│ ├── Workstations
│ └── Servers
└── Policies
| Username | Full Name | Role | Located In | Member Of |
|---|---|---|---|---|
| PXX-ceo.acs | CEO | Executive leadership | Staff | SG-ACS-Executive, SG-ACS-All-Staff |
| PXX-it.admin | IT Administrator | System administrator | Admins | SG-ACS-IT, SG-ACS-IT-Admins |
| PXX-it.helpdesk | IT Helpdesk | Helpdesk technician | Admins | SG-ACS-IT, SG-ACS-Helpdesk |
| PXX-fin.user1 | Finance User 1 | Finance department | Staff | SG-ACS-Finance, SG-ACS-All-Staff |
| PXX-hr.user1 | HR User 1 | Human Resources | Staff | SG-ACS-HR, SG-ACS-All-Staff |
| PXX-consult.user1 | Consultant | Consulting department | Staff | SG-ACS-Consulting, SG-ACS-All-Staff |
| PXX-sales.user1 | Sales User 1 | Sales department | Staff | SG-ACS-Sales, SG-ACS-All-Staff |
(Replace PXX with your pod prefix, e.g., P03)
Module 1 focuses on identifying and remediating unauthorized or incorrect account access. These are the most common access control violations in real organizations.
Scenario: A former employee (PXX-ex.employee) was terminated but their account was never disabled. They still have an active account with access to the Finance security group and All-Staff. This is a critical security violation — terminated employees should have their access removed immediately.
Your Task: Find the terminated employee's account and disable it.
Step-by-Step Instructions:
P03-ex.employee)Why This Matters: CMMC AC.L1-3.1.1 requires that system access is limited to authorized users. A terminated employee is no longer authorized.
Bonus (Optional): You should also remove the user from the Finance and All-Staff groups:
Scenario: An HR employee (PXX-hr.user1) has been mistakenly added to the Finance security group. HR staff should only have access to HR resources — they should not be able to access financial data.
Your Task: Remove the HR user from the Finance group.
Step-by-Step Instructions:
Why This Matters: The principle of least privilege means users should only have access to the resources they need for their job. An HR employee does not need Finance access.
Scenario: The helpdesk technician (PXX-it.helpdesk) has been incorrectly added to the IT-Admins security group. Helpdesk staff should have limited IT support access, not full administrator-level privileges.
Your Task: Remove the helpdesk user from the IT-Admins group.
Step-by-Step Instructions:
Why This Matters: Giving helpdesk staff full admin access violates least privilege. If a helpdesk account is compromised, the attacker would have full admin access to all IT systems.
Module 2 focuses on the lifecycle of user accounts — when people join the organization, change roles, or leave.
Scenario: HR has approved a new employee named new.user1 to join the organization. The CEO's account has a note about this approval (check the Description field on PXX-ceo.acs). However, the IT team has not yet created the account. This is a compliance gap — approved users should be provisioned in a timely manner.
Your Task: Create the new user account.
Step-by-Step Instructions:
PXX-new.user1 (replace PXX with your pod prefix, e.g., P03-new.user1)LabUser!2026#ac). A shorter or simplerPXX-SG-ACS-All-Staff and click Check Names, then OKWhy This Matters: Failing to provision approved accounts can delay onboarding and indicates a breakdown in the identity management process.
Scenario: A consultant (PXX-consult.user1) has transferred from the Consulting department to the Sales department. Their new Sales access was added, but their old Consulting access was never removed. This means they have access to both departments' resources when they should only have Sales access now.
Your Task: Remove the user's old Consulting group membership.
Step-by-Step Instructions:
Why This Matters: When employees change roles, their old access must be revoked. This is called "access creep" — over time, users accumulate more access than they need, creating security risks.
Scenario: A finance employee (PXX-fin.user1) has left the organization, but their account was not properly offboarded. The account is still enabled and still has Finance group membership. Proper offboarding requires: (1) disabling the account, (2) removing all group memberships, and (3) moving the account to the Terminated OU.
Your Task: Perform a complete offboarding of this user account.
Step-by-Step Instructions:
Step A — Disable the account:
Step B — Remove all group memberships:
Step C — Move the account to the Terminated OU:
TerminatedWhy This Matters: Improper offboarding is one of the most common security gaps. Former employees with active accounts can still access company resources, creating a major insider threat risk.
Module 3 focuses on the principle of least privilege — ensuring users have only the minimum access they need to do their jobs.
Scenario: A sales employee (PXX-sales.user1) has been placed in the Executive department OU instead of the Sales department OU where they belong. Being in the wrong OU could give them access to executive-level resources through OU-based group policies.
Your Task: Move the user back to the correct department OU.
Step-by-Step Instructions:
Important: the account must end up in the Sales OU. Moving it to
Users → Staff(or any other OU) will not pass verification — the check requiresOU=Salesin the account's distinguished name.
Why This Matters: OU placement determines which group policies and access controls apply to a user. A user in the wrong OU may receive access they are not authorized to have.
Scenario: The All-Staff security group has been nested inside the IT-Admins security group. This means every single employee in the organization now has IT administrator-level access — a massive security violation.
Your Task: Remove the All-Staff group from IT-Admins.
Step-by-Step Instructions:
Why This Matters: Group nesting can accidentally give hundreds of users access they should never have. This is why regular access reviews are required under CMMC.
Scenario: The helpdesk technician (PXX-it.helpdesk) needs the ability to reset passwords for users in the Staff OU — but without having full IT-Admins access. Currently, the helpdesk account description mentions this delegation needs to be configured.
Your Task: Delegate the "Reset Password" permission for the Staff OU to the helpdesk user.
Step-by-Step Instructions:
PXX-it.helpdesk (e.g., P03-it.helpdesk) and click Check NamesVerification: To verify the delegation was applied:
PXX-it.helpdesk listed with "Reset Password" permissionsWhy This Matters: Instead of giving helpdesk staff full admin access (which violates least privilege), delegation allows them to perform specific tasks — like resetting passwords — without unnecessary privileges.
Module 4 focuses on monitoring, reviewing, and documenting access control activities.
Scenario: A contractor (PXX-contractor.user1) has an active account with no expiration date set. Company policy requires that all contractor and temporary accounts must have an expiration date to ensure they are automatically disabled when the contract ends.
Your Task: Set an expiration date on the contractor's account.
Step-by-Step Instructions:
Optional — Also disable the account immediately:
Why This Matters: Contractor accounts without expiration dates are a common audit finding. If a contractor leaves and no one remembers to disable their account, they retain access indefinitely.
Scenario: An access review was supposed to be conducted and documented in the evidence folder C:\CyberLab\PodXX\Lab4-2 on the domain controller. However, the folder is empty — no evidence was collected. You need to perform a basic access review and document the results.
Your Task: Conduct a basic access review and save the evidence.
Step-by-Step Instructions:
Open PowerShell on the domain controller:
PowerShell and click Windows PowerShellRun the following command to export the access review to review.csv (replace Pod03 with your pod, e.g. Pod07):
Get-ADUser -Filter {Enabled -eq $true} -SearchBase "OU=Pod03,OU=Students,DC=acs-p01,DC=local" -Properties MemberOf | Select-Object Name, SamAccountName, Enabled | Export-Csv "C:\CyberLab\Pod03\Lab4-2\review.csv" -NoTypeInformation
The file must be named
review.csvand live inC:\CyberLab\PodXX\Lab4-2\. Verification looks for that exact name and requires it to be non-empty; any other file name will not pass.
(Optional supporting evidence) export group memberships alongside it:
Get-ADGroup -Filter * -SearchBase "OU=Pod03,OU=Students,DC=acs-p01,DC=local" | ForEach-Object { $group = $_.Name; Get-ADGroupMember $_ -ErrorAction SilentlyContinue | Select-Object @{N='Group';E={$group}}, Name, SamAccountName } | Export-Csv "C:\CyberLab\Pod03\Lab4-2\group_memberships.csv" -NoTypeInformation
Verify the file was created and is not empty:
Get-ChildItem "C:\CyberLab\Pod03\Lab4-2"
You must see review.csv with a size greater than 0.
Why This Matters: CMMC requires organizations to maintain evidence of access reviews. An empty evidence folder means the review was never conducted — a compliance failure.
Scenario: An access review was partially completed — there is a file in C:\CyberLab\PodXX\Lab4-3 but it only contains a placeholder. You need to complete the review with actual data.
Your Task: Replace the placeholder with real audit evidence.
Step-by-Step Instructions:
First, check what exists in the evidence folder:
Get-ChildItem "C:\CyberLab\Pod03\Lab4-3"
Get-Content "C:\CyberLab\Pod03\Lab4-3\enabled_users.csv"
You will see the file contains only "placeholder" — not real data.
Replace with a real export of enabled users:
Get-ADUser -Filter {Enabled -eq $true} -SearchBase "OU=Pod03,OU=Students,DC=acs-p01,DC=local" -Properties MemberOf, Description | Select-Object Name, SamAccountName, Enabled, Description | Export-Csv "C:\CyberLab\Pod03\Lab4-3\enabled_users.csv" -NoTypeInformation -Force
Add a group membership report:
Get-ADGroup -Filter * -SearchBase "OU=Pod03,OU=Students,DC=acs-p01,DC=local" | ForEach-Object { $group = $_.Name; Get-ADGroupMember $_ -ErrorAction SilentlyContinue | Select-Object @{N='Group';E={$group}}, Name, SamAccountName } | Export-Csv "C:\CyberLab\Pod03\Lab4-3\group_memberships.csv" -NoTypeInformation
Add a review summary document (every file in Lab4-3 must be non-empty — an empty file anywhere in the folder fails the check):
$date = Get-Date -Format "yyyy-MM-dd"
$summary = @"
Access Control Review - Pod03
Date: $date
Reviewer: [Your Name]
Findings:
- All enabled accounts have been reviewed
- Group memberships documented in group_memberships.csv
- Enabled user list documented in enabled_users.csv
Status: Review Complete
"@
Set-Content "C:\CyberLab\Pod03\Lab4-3\review_summary.txt" $summary
Verify all files are present:
Get-ChildItem "C:\CyberLab\Pod03\Lab4-3"
You should see: enabled_users.csv, group_memberships.csv, and review_summary.txt
Why This Matters: Incomplete documentation is treated the same as no documentation during an audit. Evidence must be thorough and contain real, verifiable data.
| What You Need | Where to Find It |
|---|---|
| Your pod's user accounts | Students → PodXX → Users → Staff (or Admins) |
| Your pod's security groups | Students → PodXX → Groups → Security |
| A user's group memberships | Double-click user → Member Of tab |
| A group's members | Double-click group → Members tab |
| Disable an account | Double-click user → Account tab → check "Account is disabled" |
| Move a user to a different OU | Right-click user → Move... → select destination |
| Set account expiration | Double-click user → Account tab → "Account expires" section |
| Create a new user | Right-click on destination OU → New → User |
| Delegate permissions | Right-click on OU → Delegate Control... |
| Evidence folders | Open PowerShell → navigate to C:\CyberLab\PodXX\ |
PodXX and PXX with your actual pod numberdsa.mscUse this checklist to track your progress:
| Lab | Task | Done? |
|---|---|---|
| L1.1 | Disable the terminated employee (PXX-ex.employee) | ☐ |
| L1.2 | Remove PXX-hr.user1 from Finance group | ☐ |
| L1.3 | Remove PXX-it.helpdesk from IT-Admins group | ☐ |
| L2.1 | Create the new user account (PXX-new.user1) | ☐ |
| L2.2 | Remove PXX-consult.user1 from Consulting group | ☐ |
| L2.3 | Disable, de-group, and move PXX-fin.user1 to Terminated OU | ☐ |
| L3.1 | Move PXX-sales.user1 from Executive OU back to Staff | ☐ |
| L3.2 | Remove PXX-SG-ACS-All-Staff from IT-Admins group | ☐ |
| L3.3 | Delegate password reset for Staff OU to PXX-it.helpdesk | ☐ |
| L4.1 | Set expiration date on PXX-contractor.user1 | ☐ |
| L4.2 | Create access review evidence in Lab4-2 folder | ☐ |
| L4.3 | Replace placeholder with real audit data in Lab4-3 folder | ☐ |