Day 01/90: Before Investigating an Active Directory Alert, I Needed to Understand My Own Domain

90 Days of SOC Tier 1 & Tier 2 Mastery | Active Directory Baseline and Organizational Structure

A computer account exists in Active Directory.

Does that mean the workstation is connected and authenticating successfully?

The NTDS service is running on a domain controller.

Does that mean the entire domain is healthy?

These were two important distinctions I explored on Day 01 of my 90 Days of SOC Tier 1 & Tier 2 Mastery journey.

When learning security operations, it is tempting to jump straight into suspicious logons, alerts, and attack simulations.

But before I can confidently investigate unusual activity, I need to understand what normal looks like in the environment I am protecting.

That is why my first exercise was not an attack simulation or a security incident investigation.

It was an Active Directory baseline assessment.

Starting With My Existing Home Lab

My environment runs on a Lenovo ThinkPad using Proxmox VE.

For this exercise, I worked with a Windows Server 2022 virtual machine named DC01, which hosts Active Directory Domain Services for my corp.local domain.