Per-pod Windows Server 2022 member servers are the target student session hosts. Each student gets their own server, is a local administrator on that server only, and the domain controllers stop hosting student sessions entirely.
Current state (September 5, 2026): all 20 servers are built, domain-joined, hardened and patched, each student is local administrator and Remote Desktop User on their own server only, the 20
PODXX-SRVGuacamole connections exist and are granted to the matching student, and the DigitalRCC portal now issuesPODXX-SRVas the session host. Seed / verify / reset run againstcrc_pod_serversand all five lab families have been verified fleet-wide.Still open before student access: replacement Windows licences for POD07-SRV and POD11-SRV (both original keys rejected with
0xC004C008), the interactive Pod01/Pod03 pilots, and removal of the student session role on DC01/DC02. The legacyPODXX-DCtiles stay in place as the rollback path until then.
| Problem on the shared DC | How the member server fixes it |
|---|---|
| A student local-admin on a DC is effectively domain-wide | Local admin is scoped to their own server; AD rights stay delegated to their own pod OU |
| ADUC required elevation (UAC) for non-admin students | Student is a local admin, so dsa.msc and Server Manager → Tools work normally |
| IA M2-L1 (scheduled task) and the MP media steps need host admin | Both are local operations on the student's own server (IA M3-L2 edits the domain policy and stays a domain action) |
| One student shutting down DC01 took all 20 pods offline | Blast radius is one pod |
| Server without RDSH allows only 2 concurrent RDP sessions | One student per server, so 2 admin sessions is ample and no RDS CALs are needed |
| Evidence for all pods lived on one disk | Evidence lives on the student's own server |
| Property | Value |
|---|---|
| Base image | win2022-template (VM 102), Windows Server 2022 |
| Name | PODXX-SRV (member server — not a domain controller) |
| VM IDs | 400 + pod number (Pod01 = VM 401 … Pod20 = VM 420) |
| Sizing | 2 vCPU / 4 GB RAM / 60 GB disk |
| Bridge | podXXnet (the pod's own bridge on PVE1) |
| IP address | 10.50.XX.20/24 |
| DNS | 10.50.1.10, 10.50.1.11 |
| Domain | acs-p01.local, computer object in OU=PodServers |
| Local admin + RDP user | ACS-P01\studentXX (that pod's student only) |
| Tools | RSAT AD DS tools (ADUC, AD PowerShell module), GPMC |
| Evidence tree | C:\CyberLab\PodXX\ |
Provisioning is credential-free: a first-boot script is injected into each clone's disk offline from PVE1 (static IP, rename, enable WinRM, domain join), after which AWX manages the host over WinRM like every other lab system. Automation lives in the pod_member_server role — see AWX Automation.
All 20 servers verified from DC01 and over WinRM on September 3–5, 2026: computer object enabled in OU=PodServers,DC=acs-p01,DC=local, secure channel healthy, RDP + NLA on, RSAT/GPMC/AD PowerShell present, matching student in local Administrators and Remote Desktop Users with no other student in either group, no cached credentials, no password-backed scheduled tasks, Defender real-time protection on, maintenance NIC removed.
| Pod | Server | VM | IP | Student | Licensing |
|---|---|---|---|---|---|
| Pod01 | POD01-SRV | 401 | 10.50.1.20 | student01 | activated |
| Pod02 | POD02-SRV | 402 | 10.50.2.20 | student02 | activated |
| Pod03 | POD03-SRV | 403 | 10.50.3.20 | student03 | activated |
| Pod04–Pod06 | POD04-SRV … POD06-SRV | 404–406 | 10.50.4.20 … 10.50.6.20 | student04–06 | activated |
| Pod07 | POD07-SRV | 407 | 10.50.7.20 | student07 | unlicensed — replacement key requested |
| Pod08–Pod10 | POD08-SRV … POD10-SRV | 408–410 | 10.50.8.20 … 10.50.10.20 | student08–10 | activated |
| Pod11 | POD11-SRV | 411 | 10.50.11.20 | student11 | unlicensed — replacement key requested |
| Pod12–Pod20 | POD12-SRV … POD20-SRV | 412–420 | 10.50.12.20 … 10.50.20.20 | student12–20 | activated |
POD07-SRV and POD11-SRV must not be issued to a student until a valid key activates.
ADUC and the ActiveDirectory PowerShell module are remote clients: they bind to acs-p01.local over the network. On a member server the student sees the same OU=Students tree and keeps the same GenericAll delegation on their own OU=PodXX and nothing else. Being a local administrator of their own server grants no domain privilege.
What changed:
C:\CyberLab\PodXX\ on the pod server instead of on DC01.ia_m2l1_task_step_waived, mp_media_mount_waived) stay enabled until the Pod01/Pod03 pilots pass, then each is retired in its own commit. IA M3-L2 edits the domain password policy and remains a domain-admin action.PODXX-SRV to each student; PODXX-DC remains defined for rollback only.PODXX-SRV/10.50.XX.20 as the session host and DC01-P01/DC02-P01 as directory controllers only.ia_m2l1_task_step_waived and mp_media_mount_waived waivers after those pilots, each in its own commit with the matching guide and verifier change.PODXX-DC Guacamole connections — last step, after every batch passes.Cohort 1 evidence is archived on DC01 at C:\CohortArchive\COHORT1-20260902 (3,675 files, SHA-256 manifest, restore notes) and the member servers start Cohort 2 with empty evidence trees.
| Page | Purpose |
|---|---|
| Domain Controllers | DC01 session-host capacity, DC02 replica |
| Pod Infrastructure | Pod networks, OUs, gateways |
| AWX Automation | Seed, verify, reset |