Install Windows Keys

These are NOT product / license keys that are valid for Windows activation.
These keys only select the edition of Windows to install during setup, but they do not activate or license the installation.

Windows 11

KMS Client Product Keys

• See learn.microsoft.com/windows-server/get-started/kms-client-activation-keys

Windows 10

Default Product Keys

Default Product Keys for OEM Activation 3.0

• See learn.microsoft.com/windows-hardware/manufacture/desktop/oem-activation-3

RTM Product Keys

KMS Client Product Keys

See learn.microsoft.com/windows-server/get-started/kms-client-activation-keys

References

• https://devicepartner.microsoft.com/en-us/communications/comm-windows-10-build
• https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/oem-activation-3?view=windows-10
• https://learn.microsoft.com/en-us/windows-server/get-started/kms-client-activation-keys
• https://support.microsoft.com/en-us/windows/activate-windows-c39005d4-95ee-b91e-b399-2820fda32227
• https://www.tenforums.com/tutorials/95922-generic-product-keys-install-windows-10-editions.html
• https://www.elevenforum.com/t/generic-product-keys-to-install-or-upgrade-windows-11-editions.3713/

Windows 11

This guide will explain how to prepare the windows installation media, the difference between (UEFI vs. BIOS), and performing a clean installation.

A clean installation will erase all data on your C: drive. Ensure you have backed up all important files, documents, and license keys to an external drive before proceeding.

Part 1: Pre-Installation Checks (UEFI vs. BIOS)

Before creating your installation USB, you need to know what type of firmware your computer uses. Modern computers use UEFI, while older computers use Legacy BIOS.

How to find out what your device supports:

1. Boot into your current Windows installation.
2. Press Win + R on your keyboard to open the Run dialog.
3. Type msinfo32 and press Enter.
4. In the System Information window, look for the item named BIOS Mode.
   • If it says UEFI, your system is modern and fully supports Windows 11 standards.
   • If it says Legacy, your system uses the older BIOS (MBR) format.

UEFI (GPT) vs. BIOS (MBR): What’s the difference?

When to use which?

• Always use UEFI (GPT) if your computer supports it. It is required for a standard Windows 11 installation.
• Only use BIOS (MBR) if you are trying to install Windows 11 on older, officially unsupported hardware. You will need to use Rufus to bypass the Windows 11 system requirements (TPM 2.0 and Secure Boot) to make this work.

Part 2: Prepare the Installation Media

To install Windows 11, you need a USB flash drive with at least 8GB of storage.

1. Download the Windows 11 ISO

1. Go to the official Microsoft Windows 11 Download Page.
2. Scroll down to Download Windows 11 Disk Image (ISO) for x64 devices.
3. Select Windows 11, choose your language, and click Download. Save the .iso file to your computer.

2. Create the Bootable USB using Rufus

We recommend using Rufus over the official Media Creation tool, as it gives you much more control over the installation parameters.

1. Insert your USB drive and open Rufus.
2. Under Device, select your USB drive.
3. Under Boot selection, click SELECT and locate the Windows 11 .iso file you just downloaded.
4. Choose your Partition Scheme (Based on your check in Part 1):
   • If your PC is UEFI: Select GPT. The Target system will automatically change to UEFI (non CSM).
   • If your PC is Legacy BIOS: Select MBR. The Target system will change to BIOS (or UEFI-CSM).
5. Click START.
6. Rufus Bonus Feature: A prompt will appear asking if you want to customize the installation. If you are installing on an older PC, you can check the boxes to Remove requirement for 4GB+ RAM, Secure Boot and TPM 2.0.

Part 3: Automate Your Install (Recommended ITGOIT Pro-Tip)

Windows 11 forces users to create a Microsoft Account and installs a lot of unnecessary default apps. You can easily bypass this by generating an autounattend.xml file.

Pro Tip: Use our official ITGOIT Autounattend Generator.

1. Go to the link above and configure your preferred Windows 11 setup (e.g., bypass Microsoft account requirements, create a local admin account, disable telemetry, etc.).
2. Download the generated autounattend.xml file.
3. Copy this file directly to the root directory of your newly created Windows 11 USB drive (do not put it inside any folders). Windows Setup will automatically read this file and apply your preferences during installation!

Part 4: The Installation Process

1. Boot from the USB

1. Keep the USB drive plugged in and Restart the computer.
2. As soon as the screen turns on, rapidly press the system's Boot Menu key. If you aren't sure which key to press during restart to boot from your USB drive, look for your computer or motherboard manufacturer in the table below.

Note for Laptop Users: On some laptops, the "F" keys act as media keys by default. You may need to hold down the Fn key while tapping your boot/BIOS key (e.g., Fn + F12).

3. Select your USB drive from the list to boot from it. (Alternatively, enter the BIOS/UEFI setup and change the boot order so the USB is first).

2. Run Windows Setup

If you used our ITGOIT Autounattend Generator. then most of these prompts will be skipped automatically.

1. When the Windows 11 setup screen appears, verify your Language, Time, and Keyboard layout. Click Next.
2. Click Install Now.
3. Product Key: If prompted, enter your Windows 11 product key. If you are reinstalling Windows on a device that previously had it, you can click "I don't have a product key"—it will activate automatically later.
4. License Terms: Accept the terms and click Next.
5. Installation Type: Select Custom: Install Windows only (advanced). This ensures a true clean installation.

3. Drive Partitioning

You will see a list of drives and partitions.

1. To ensure a completely clean slate, select each partition on your primary drive (usually Drive 0) and click Delete until only Drive 0 Unallocated Space remains.
2. Select the Unallocated Space and click Next.
3. Windows will now copy files, install features, and restart your computer several times. Do not turn off your PC during this process.

Part 5: Post-Installation

1. Out of Box Experience (OOBE): Once the installation finishes, you will be greeted by the Windows setup screens.
   • Note: If you utilized the autounattend.xml file from our generator, this entire process will be bypassed, and you will boot straight to the desktop!
   • Otherwise, follow the on-screen prompts to connect to Wi-Fi, name your PC, and log in.
2. Run Windows Update: Go to Settings > Windows Update and check for updates. Let Windows download all system updates and hardware drivers. Restart your PC if prompted.
3. Verify Activation: Go to Settings > System > Activation to ensure your copy of Windows 11 is properly activated.

Windows Server 2022

When deploying a Windows Server Lab in a home environment, DO NOT install the DHCP Role if your Network Adapter is set to "Bridged Mode."

A standard home network (WiFi) already has a DHCP Server (your ISP Router). If you install a second DHCP Server (this Windows Server) on the same network (Bridged), they will fight for control.

• The Result: Your home internet will crash. Devices will receive invalid IP addresses. You will be unable to browse the web.
• The Rule: There can be only one DHCP Server per network segment.

Select the architecture that fits your hardware setup.

Option A: The "Hybrid" Approach (Recommended for Beginners)

Best for: Using a physical laptop to join the domain without buying extra hardware.

1. VM Network: Set to Bridged.
2. Windows Server:
   • Install AD DS and DNS.
   • DO NOT install DHCP.
   • Set a Static IP (e.g., 192.168.1.250) outside your router's DHCP range.
3. The Client (Laptop):
   • Connect to home WiFi.
   • Manually set the DNS Server on the laptop's network adapter to point to the Windows Server (192.168.1.250).
   • You can now join the domain.

Option B: The "Isolated" Approach (Pure Virtual)

Best for: Testing dangerous configurations (DHCP, WDS, PXE) safely.

1. VM Network: Set to NAT or Host-Only (VMnet8 or VMnet1).
2. Windows Server:
   • Install AD DS, DNS, and DHCP.
   • You are the "King" of this isolated network.
3. The Client:
   • Must be a Virtual Machine (running inside VMware/Hyper-V).
   • Physical devices on your WiFi cannot join this domain easily.

Option C: The "Physical Lab" (Professional)

Best for: Hardware testing and complete isolation.

1. Hardware: Requires a second physical Router.
2. Setup:
   • Plug the WAN port of the Lab Router into the LAN port of your Home Router.
   • The Lab Router creates a new subnet (e.g., 10.0.0.x).
3. Windows Server:
   • Connect to the Lab Router.
   • Install DHCP, DNS, AD DS.
4. Isolation: The Lab Router acts as a firewall. Your experiments stay upstairs; the family network stays downstairs.

Turn off IE Enhanced Security Configuration

1. Open Server Manager

2. Click on "Local Server"

3. Click on "IE Enhanced Security Configuration"

4. Select Off for Administrators and Users then Click OK

Rename computer

sysdm.cpl

3. Click on Change...

4. Change the Computer name to your preferences and Click on OK

Example:
Computer name: wserver01

5. Restart Windows

Setup Static IP

ncpa.cpl

3. Right-Click on the Ethernet adapter and select "Properties"

4. Select Internet Protocol Version 4 (TCP/IPv4)

Setting the static IP is a personal preference

Example:
Ip address: 192.168.20.75
Subnet mask: 255.255.255.0
Default gateway: 192.168.20.1
Preferred DNS server: 192.168.20.75
Alternate DNS server: 1.1.1.1

Enable Network Discovery

cmd

sc config FDResPub start=auto

sc config SSDPSRV start=auto

sc config upnphost start=auto

exit

Install Active Directory Domain Services + DNS

1. Open Server Manager

2. Select "Add roles and features"

3. Click Next for Installation Type and Server Selection

4. Select "Active Directory Domain Services" Click "Add Features"

5. Select "DNS Server" and Click "Add Features"

6. Click "Next"

Click Next for Features, AD DS, DNS Server, Confirmation.

7. Click "Install"

8. When you see "⚠️" at the right top, Click on "Promote this server to a domain controller"

9. Select "Add a new forest" and register a Root domain name then Click on Next

Example:
Root domain name: teahouse.lan
Root domain name: arcadeparty.local

10. Create and Confirm a secure password at "Type the Directory Services Restore Mode (DSRM) password" Click Next

11. Click Next for DNS Options, Additional Options, Paths and Review Options and then Click Install

Windows will now restart automaticly.

Active Directory Template

(Reference Guide for Modern AD Architecture)

Naming Convention Standards

Use this legend to understand the object names used in the visual architecture below. This follows the Microsoft Enterprise Access Model (Tiering).

• Administrative Accounts (Tiered): t[Tier]-[role]
  • Examples: t0-domain.admin, t1-sql.dba, t2-helpdesk.tech
• Standard Users: [first].[last] (e.g., john.doe)
• Service Accounts: svc-[app]-[role] or gmsa-[app]$ (for Group Managed Service Accounts).
• Privileged Access Workstations (PAW): PAW-T[Tier]-[Role]-[00]
  • Example: PAW-T0-SECURE-01
• Corporate Endpoints (Hardware Based): [Type]-[HardwareID]
  • LT- = Laptop (LT-C0FFEE12)
  • DT- = Desktop (DT-123ABC99)
  • VM- = Virtual Machine (VM-UUID8492)
  • KIOSK- = Shared/Public device (KIOSK-LOBBY-01)
• Servers: SRV-[Role]-[Env]-[00]
  • Example: SRV-SQL-PROD-01
• Security Groups (RBAC): [Scope]-[Tier]-[Role/Access]
  • SG- = Universal/Global Group (Role) - e.g., SG-T1-SQL-Admins
  • DL- = Domain Local Group (Permission) - e.g., DL-ACL-FileShare-Finance-RW

Visual Architecture: Tiered Enterprise

itgoit.lan
│
├── _T0_Identity
│   │   # TYPE: TIER 0 – IDENTITY CONTROL PLANE (CROWN JEWELS)
│   │   # GPO: BLOCK INHERITANCE / Tier 0 Hardening
│   │   # RULE: Hardware MFA required. T0 cannot log on to T1/T2 assets. Dedicated PAW required.
│   │
│   ├── Admin_Users
│   │   ├── [User] t0-root.breakglass      <-- (Safe/Offline)
│   │   ├── [User] t0-domain.admin         <-- (Daily Identity Admin)
│   │   └── [User] t0-krbtgt.rotator
│   │
│   ├── Admin_Groups
│   │   ├── [Group] SG-T0-Admins-Enterprise
│   │   ├── [Group] SG-T0-Admins-PKI
│   │   └── [Group] SG-T0-PAW-Logon        <-- (Controls PAW Access)
│   │
│   ├── Infrastructure
│   │   ├── Domain_Controllers
│   │   │   └── [Computer] SRV-DC-PDC-01
│   │   ├── PKI
│   │   │   └── [Computer] SRV-CA-ROOT-01
│   │   └── DR_Site
│   │       └── [Computer] SRV-DC-DR-01
│   │
│   └── PAW_T0
│       │   # GPO: PAW - T0 Hardening (Allow: T0 Admins / Deny: T1, T2, Users)
│       │   # RULE: Tier 0 Admins log on interactively HERE ONLY.
│       └── [Computer] PAW-T0-SECURE-01
│
├── _T1_ServerOps
│   │   # TYPE: TIER 1 – SERVER MANAGEMENT PLANE
│   │   # GPO: T1 Admin Baseline (High Security / auditing)
│   │   # RULE: T1 Admins manage Servers. They cannot access T0 or log on to T2 Workstations.
│   │
│   ├── Admin_Users
│   │   ├── [User] t1-server.admin
│   │   ├── [User] t1-sql.dba
│   │   └── [User] t1-backup.svc
│   │
│   ├── Admin_Groups
│   │   ├── [Group] SG-T1-Admins-Global
│   │   ├── [Group] SG-T1-SQL-Admins
│   │   └── [Group] SG-T1-PAW-Logon
│   │
│   └── PAW_T1
│       │   # GPO: PAW - T1 Hardening (Allow: T1 Admins / Deny: T0, T2, Users)
│       │   # RULE: Tier 1 Admins log on interactively HERE ONLY.
│       └── [Computer] PAW-T1-MGMT-01
│
├── _T2_WorkstationOps
│   │   # TYPE: TIER 2 – ENDPOINT SUPPORT PLANE
│   │   # GPO: T2 Admin Baseline
│   │   # RULE: Network Logon (RDP/Tools) allowed from PAW -> Corp_Workstations. No local admin on Servers.
│   │
│   ├── Admin_Users
│   │   ├── [User] t2-helpdesk.lead
│   │   └── [User] t2-helpdesk.tech
│   │
│   ├── Admin_Groups
│   │   ├── [Group] SG-T2-Helpdesk-Global
│   │   └── [Group] SG-T2-PAW-Logon
│   │
│   └── PAW_T2
│       │   # GPO: PAW - T2 Hardening (Allow: T2 Admins / Deny: T0, T1, Users)
│       │   # RULE: Interactive logon allowed here. This is the "Jump Point" for support.
│       └── [Computer] PAW-T2-HELPDESK-01
│
├── _ServiceAccounts
│   │   # TYPE: NON-INTERACTIVE IDENTITIES
│   │   # GPO: Deny Interactive Logon / Deny RDP
│   │   # RULE: Must use gMSA where possible. Accounts are Tier-Bound (T1 account cannot touch T0).
│   │
│   ├── T0_Services
│   │   └── [User] svc-backup-exec
│   ├── T1_Services
│   │   └── [User] gmsa-sql-prod$
│   └── T2_Services
│       └── [User] svc-sccm-nas
│
├── _Corp_Servers
│   │   # TYPE: TIER 1 – PRODUCTION ASSETS (DATA PLANE)
│   │   # GPO: T1 - Server Hardening (Restrict RDP / Defender)
│   │   # GPO: Corp - LAPS Client (Native)
│   │   # RULE: Only T1 Admins (via PAW) can manage these.
│   │
│   ├── Infrastructure
│   │   └── [Computer] SRV-FILE-01
│   ├── Containers
│   │   │   # GPO: Container Host Hardening / K8s Node Policy
│   │   │   # NOTE: (Docker / K8s) High-risk zone due to container breakouts.
│   │   └── [Computer] SRV-K8S-NODE-01
│   ├── Database
│   │   └── [Computer] SRV-SQL-PROD-01
│   ├── Application
│   │   └── [Computer] SRV-ERP-PROD-01
│   └── Hybrid_Azure
│       └── [Computer] SRV-AVD-HOST-01
│
├── _Corp_Workstations
│   │   # TYPE: TIER 2 – PRODUCTION ENDPOINTS (DATA PLANE)
│   │   # GPO: T2 - Workstation Baseline (Block Inbound FW / No Local Admin)
│   │   # GPO: SEC - Deny T0/T1 Logon (Prevent Admin Credential Theft)
│   │   # RULE: Standard users have NO local admin rights. Managed by T2.
│   │
│   ├── Laptops
│   │   └── [Computer] LT-C0FFEE12
│   ├── Desktops
│   │   └── [Computer] DT-123ABC99
│   ├── VDI
│   │   └── [Computer] VM-UUID8492
│   └── Kiosks
│       └── [Computer] KIOSK-LOBBY-01
│
├── _Corp_Users
│   │   # TYPE: TIER 2 – STANDARD IDENTITIES
│   │   # GPO: User Experience / Office / Browser Policies
│   │   # RULE: No standing privileges. MFA required for external access.
│   │
│   ├── VIP
│   │   └── [User] ceo.john
│   ├── Shared_Mailboxes
│   │   └── [User] [email protected]
│   └── Regions
│       ├── AMER
│       │   └── [User] john.doe
│       ├── EMEA
│       │   └── [User] sarah.smith
│       └── APAC
│           └── [User] takashi.tanaka
│
├── _Lifecycle
│   │   # TYPE: AUTOMATION & PROVISIONING ZONE
│   │   # GPO: BLOCK INHERITANCE (Prevent policy conflicts during build)
│   │   # RULE: Zero Trust. Devices here are not yet trusted by the domain.
│   │
│   ├── Staging
│   │   │   # RULE: Default landing zone for new objects.
│   │   └── [Computer] LT-NEW123
│   │
│   ├── Quarantine
│   │   │   # GPO: SEC - Quarantine Isolation (Deny All Network Logon)
│   │   │   # RULE: Network isolation for compromised assets.
│   │   └── [Computer] DT-INFECTED
│   │
│   ├── Legal_Hold
│   │   │   # RULE: Object deletion prohibited.
│   │   └── [User] legal.hold.doe
│   │
│   └── Tombstone
│       │   # RULE: Disabled objects pending cleanup (90 days).
│       └── [Computer] DT-OLD999
│
├── _Security_Zones
│   │   # TYPE: ISOLATED / NON-STANDARD ENVIRONMENTS
│   │   # GPO: Explicit Hardening or Isolation Policies
│   │   # RULE: Lateral movement blocked. No trust to internal production network.
│   │
│   ├── Sandbox
│   │   └── [Computer] DT-BAD34DA
│   ├── IoT
│   │   └── [User] Sensor-Temp-01
│   └── Linux
│       └── [Computer] LNX-APACHE-01
│
├── _Access_Control
│   │   # TYPE: ROLE BASED ACCESS CONTROL (RBAC) CONTAINER
│   │   # GPO: None (Group objects only)
│   │   # RULE: AGDLP Strategy (Accounts -> Global Roles -> Domain Local Permissions).
│   │
│   ├── Global_Roles
│   │   └── [Group] SG-IT-Architecture
│   └── Domain_Local_ACL
│       └── [Group] DL-ACL-FileShare-Finance-RW
│
└── _External_Partners
    │   # TYPE: THIRD-PARTY TRUST BOUNDARY
    │   # GPO: Enforce MFA / Restrictive Login Hours
    │   # RULE: Just-In-Time access only. Accounts must have expiry dates.
    │
    ├── Vendors
    │   └── [User] vnd-microsoft.support
    └── Contractors
        └── [User] cnt-dev-alice

Provisioning Architecture: The "Staging" Strategy

Why shouldn't you deploy new computers directly to Production OUs?
When mass-deploying computers (via MDT, SCCM, Intune, or Autopilot), joining them directly to their final production OU is a major cause of deployment failures. The industry standard is to join them to an isolated Staging OU first.

The Problem: GPO Race Conditions

In a standard environment, Production OUs (like _Corp_Workstations) contain numerous Group Policies: endpoint security, mapped drives, software installations, and firewall restrictions.

If you join a computer directly to a Production OU during Windows Setup (OOBE):

1. Windows is simultaneously trying to install core drivers, complete setup, and build the first local user profile.
2. At the exact same time, the Domain Controller forces heavy security policies and software installations onto the machine.
3. The Result: "Race conditions." The deployment often crashes, times out, or creates a corrupt default user profile because the system is overwhelmed.

The Solution: The Staging OU

In our architecture, the _Lifecycle \ Staging OU has Block Inheritance enabled. Absolutely zero GPOs apply here. This allows Windows to complete its setup process cleanly and incredibly fast without interference from Active Directory.

How to Implement This Workflow

Step 1: The Automation Configuration (XML / MDT)
Configure your deployment tool (e.g., autounattend.xml) to target the Staging container.

<component name="Microsoft-Windows-UnattendedJoin">
    <Identification>
        <JoinDomain>itgoit.lan</JoinDomain>
        <!-- Target the Staging OU (Zero GPOs applied here) -->
        <MachineObjectOU>OU=Staging,OU=_Lifecycle,DC=itgoit,DC=lan</MachineObjectOU>
    </Identification>
</component>

Step 2: Moving to Production (Manual vs. Automated)
Once the machine is successfully built in the Staging OU, it needs to be moved to its production OU so security policies apply.

• Option A: Manual Move (For Helpdesk/Small Labs):

  1. The computer finishes building and sits safely in Staging.
  2. An Admin renames the computer to the standard (e.g., LT-C0FFEE12).
  3. The Admin uses ADUC to drag the object into _Corp_Workstations \ Laptops.
  4. The Admin reboots the laptop. GPOs apply perfectly upon restart.

• Option B: Automated Move (Enterprise Recommended):
  Instead of dragging and dropping, trigger a PowerShell script at the very end of your deployment Task Sequence. This script looks at the computer name and routes it to the correct OU automatically.

  Example Routing Script:

  $Computer = $env:COMPUTERNAME
  
  # Example: If the computer is a Laptop ("LT-"), move it to the Laptops OU
  if ($Computer -match "^LT-") {
      $TargetOU = "OU=Laptops,OU=_Corp_Workstations,DC=itgoit,DC=lan"
      Get-ADComputer $Computer | Move-ADObject -TargetPath $TargetOU
      
      # A restart is recommended so Computer GPOs apply on the next boot
      Restart-Computer -Force
  }
  

Strategy Summary

Deploy DNS Server

1. Open Server Manager

2. Go to Tools -->> DNS

3. Right-Click on "Reverse Lookup Zones" and select "New zone"

4. Click Next for Zone Type and Active Directory Zone Replication Scope

5. Register the Network ID (Use same as the Static Ip address)

Example:
Network ID: 192.168.20 (Static IP was 192.168.20.75)
Network ID: 192.168.1 (Static IP was 192.168.1.75)
Network ID: 192.168.5 (Static IP was 192.168.5.75)

6. Click Next for Dynamic Update then Click Finish

7. In DNS Manager Click on Forward Lookup Zones --> youre-created-domain Click on Host (A) to validate the Static IP of Windows Server

Install DHCP Server

1. Open Server Manager

2. Select "Add roles and features"

3. Click Next for Installation Type and Server Selection

4. Select "DHCP Server" Click "Add Features"

5. Click Next for Features, DHCP Server, Confirmation and Click Install

6. When you see "⚠️" at the right top, Click on "Complete DHCP configuration"

7. Click Next then Commit and then Close

Deploy DHCP Server

1. Open Server Manager

2. Go to Tools -->> DHCP

3. Click on the small arrow (make sure you see IPv4 and IPv6)

4. At IPv4 Click on the small arrow

5. Right-Click on "IPv4" and select "New scope"

6. Name the scope then Click Next

Example:
Name: teahouse DHCP
Description: DHCP Server

7. Set the range of IP addresses to deliver

Example:
Start IP address: 192.168.20.41
End IP address: 192.168.20.140
Thats 100 IPv4 addreses

8. Exclude some IP addresses (if needed) Then Click Add and then Next

Example:
Start IP address: 192.168.20.121
End IP address: 192.168.20.140

9. Click Next for Lease Duration and Configure DHCP Options

10. Insert the Default Gateway Then Click Add and then Next

Example:
IP address: 192.168.20.1

11. Click Next for Domain Name and DNS Servers and WINS Servers then Click Finish

Always dynamically update DNS

Specify the correct OU and DC path for your domain at LINE 16
Replace arcadeparty.lan with your correct domain at LINE 19

1. Save the following powershell script as: new-user-dhcpdns.ps1

<#
.SYNOPSIS
    Automated DHCP Service Account & Config
.DESCRIPTION
    1. Creates the dhcpdns user in the correct Service Account OU.
    2. Adds user to DnsUpdateProxy group.
    3. Configures DHCP Server to ALWAYS update DNS.
    4. Applies the credentials to the DHCP Server service automatically.
#>

Import-Module ActiveDirectory
Import-Module DhcpServer

# --- CONFIGURATION ---
$DomainInfo = Get-ADDomain
$DomainName = $DomainInfo.DnsRoot
$DomainDN   = $DomainInfo.DistinguishedName

# 1. Update Path to match your Architecture (scripts\3_OU_Structure.ps1)
# Checks if the structured OU exists, otherwise falls back to default Users
$TargetOU = "OU=SVC,OU=ServiceAccounts,$DomainDN"
if (-not (Get-ADOrganizationalUnit -Filter "DistinguishedName -eq '$TargetOU'" -ErrorAction SilentlyContinue)) {
    Write-Warning "Target OU not found. Falling back to default Users container."
    $TargetOU = "CN=Users,$DomainDN"
}

$UserParams = @{
    Name                  = "dhcpdns"
    SamAccountName        = "dhcpdns"
    UserPrincipalName     = "dhcpdns@$DomainName"
    AccountPassword       = (ConvertTo-SecureString "Wwelkom123" -AsPlainText -Force)
    Path                  = $TargetOU
    Enabled               = $true
    PasswordNeverExpires  = $true
    Description           = "DNS Dynamic update user for DHCP"
    OtherAttributes       = @{'dispalyName'="DHCP Service"}
}

# --- EXECUTION ---

Write-Host "1. Creating Account..." -ForegroundColor Cyan
try {
    if (-not (Get-ADUser -Filter "SamAccountName -eq '$($UserParams.SamAccountName)'" -ErrorAction SilentlyContinue)) {
        New-ADUser @UserParams
        Write-Host "   Created User: [$($UserParams.SamAccountName)] in [$TargetOU]" -ForegroundColor Green
    } else {
        Write-Host "   User already exists." -ForegroundColor Gray
    }
} catch { Write-Error "Failed to create user: $_"; exit }

Write-Host "2. Adding to Groups..." -ForegroundColor Cyan
try {
    Add-ADGroupMember -Identity "DnsUpdateProxy" -Members $UserParams.SamAccountName -ErrorAction SilentlyContinue
    Write-Host "   Added to 'DnsUpdateProxy'" -ForegroundColor Green
} catch { Write-Warning "Could not add to group (Group might not exist yet?)" }

Write-Host "3. Configuring DHCP Server Settings..." -ForegroundColor Cyan
try {
    # This replaces the "Always dynamically update DNS records" checkbox
    Set-DhcpServerv4DnsSetting -ComputerName $env:COMPUTERNAME -DynamicUpdate Always -DeleteDnsRrtodns $true
    Write-Host "   Set: Always Dynamically Update DNS" -ForegroundColor Green
} catch { Write-Error "Failed to set DNS settings: $_" }

Write-Host "4. Applying Credentials to DHCP Service..." -ForegroundColor Cyan
try {
    # This replaces the "Right Click -> Properties -> Credentials" step
    $CredObj = New-Object System.Management.Automation.PSCredential ($UserParams.UserPrincipalName, $UserParams.AccountPassword)
    Set-DhcpServerDnsCredential -ComputerName $env:COMPUTERNAME -Credential $CredObj
    Write-Host "   Credentials applied successfully." -ForegroundColor Green
} catch { Write-Error "Failed to set DHCP Credentials: $_" }

Write-Host "`nDONE. No manual GUI steps required." -ForegroundColor Magenta

2. Right-Click new-user-dhcpdns.ps1 then select Run with PowerShell

dhcpmgmt.msc

4. Right-Click on IPv4 node and select Properties

5. Click on DNS tab

6. Select Always dynamically update DNS records

7. Click on DNS tab

8. Click on Credentials Provide the dhcpdns user info then Click OK and OK

Username: [email protected]
Domain: arcadeparty.lan
Password: Wwelkom123
Confirm password: Wwelkom123

Install Routing

Make sure you have 2 network adapters installed on domain controller (DC)

Domain Controller (Windows Server 01)
Network Adapter 1 = INTERNET
IP address: 192.168.1.101
Subnet mask: 255.255.255.0
Default gateway: 192.168.1.2
Preferred DNS server: 1.1.1.1
Alternate DNS server: 1.0.0.1

Domain Controller (Windows Server 01)
Network Adapter 2 = LAN
IP address: 192.168.5.101
Subnet mask: 255.255.255.0
Default gateway:
Preferred DNS server: 127.0.0.1
Alternate DNS server:

Member Server (Windows Server 02)
Network Adapter 1 = LAN
IP address: 192.168.5.102
Subnet mask: 255.255.255.0
Default gateway: 192.168.5.101
Preferred DNS server: 192.168.5.101
Alternate DNS server:

Windows Client
Network Adapter 1 = LAN
IP address:
Subnet mask:
Default gateway:
Preferred DNS server: 192.168.5.101
Alternate DNS server:

1. Open Server Manager

2. Select "Add roles and features"

3. Click Next for Installation Type and Server Selection

4. Select "Remote Acess" Click "Next"

5. Click Next for Features and Remote Access

6. Select "Routing" Click "Add Features"

7. Click Next for Web Server Role (IIS) and Role Services.

8. Click "Install" then Click "Close"

Configure Routing

rrasmgmt.msc

3. Right-Click on your server name (local) Then select Configure and Enable Routing and Remote Access

4. Select Network address Translation (NAT) then Click Next

5. Select INTERNET then Click Next and Click Finish

Enable Remote Desktop (RDP)

sysdm.cpl ,5

3. Select Allow remote connections to this computer Click Select Users to choose Users for RDP access then Click Apply and OK

RDP connection to Windows Server

mstsc

3. Insert the Static Windows Server IP and credentials

Example:
Computer: 192.168.20.75

Connect computer to Active Directory

sysdm.cpl

3. Click on Change...

4. Select Domain:

5. Insert the AD domain name

Example:
teahouse.lan
arcadeparty.local

Configure Group Policy Objects (GPO)

We will setup a Firewall GPO as a example

1. Open Server Manager

2. Go to Tools -->> Group Policy Management

Do NOT edit the Default Domain Policy

3. Right-Click on "YOUREDOMAIN.lan" and Select "Create a GPO in this domain, and Link it here..."

4. Name the GPO then Click OK

Example:
Firewall

5. Right-Click on the new created GPO then select "Edit..."

6. Go to Computer Configuration --> Policies --> Windows Settings --> Security Settings --> Windows Defender Firewall with Advanced Security --> Windows Defender Firewall with Advanced Security LDAP --> Inbound Rules -->

7. Right-Click on Windows Defender Firewall with Advanced Security LDAP then select "Properties"

Domain Profile:
State
Firewall state: Off
Inbound connections: Allow
Outbound connections: Allow (default)

8. Click Apply then OK

9. Right-Click on Inbound Rules then select "New Rule..."

10. Select Predefined: then Click Next > for Rule Type, Predefined Rules and Action then Click Finish

11. Right-Click on Inbound Rules then select "New Rule..."

12. Select Predefined: with File and Printer Sharing then Click Next > for Rule Type, Predefined Rules and Action then Click Finish

13. Right-Click on Inbound Rules then select "New Rule..."

14. Select Predefined: with Windows Managment Instrumentation (WMI) then Click Next > for Rule Type, Predefined Rules and Action then Click Finish

Same rules for Outbound rules BUT Allow the connection at the Action tab

15. Right-Click on Outbound Rules then select "New Rule..."

16. Select Predefined: then Click Next > for Rule Type, Predefined Rules

17. Select Allow the connection then Click Finish

18. Right-Click on Outbound Rules then select "New Rule..."

19. Select Predefined: with File and Printer Sharing then Click Next > for Rule Type, Predefined Rules

20. Select Allow the connection then Click Finish

21. Right-Click on Outbound Rules then select "New Rule..."

22. Select Predefined: with Windows Managment Instrumentation (WMI) then Click Next > for Rule Type, Predefined Rules

23. Select Allow the connection then Click Finish

24. Right-Click on Inbound Rules then select "New Rule..."

25. Select Custom then Click Next > for Rule Type and Program

26. For Protocol type select ICMPv4 then Click Next > for Scope and Action

27. Deselect Private and Public Keep Domain selected then Click Next >

28. Name it: PING then Click Finish

Apply the Group Policy rules

cmd

gpupdate /force

Configure a File Server (Shares)

diskmgmt.msc

3. Select GPT (GUID Partition Table) then Click OK

4. Right-Click on Unallocated and select New Simple Volume...

5. Click Next > then Specify a Volume Size and then Click Next >

6. Assign a Drive Letter or Path and give it a Volume label: you want then Click Next >

Example:
File system: NTFS
Allocation unit size: Default
Volume label: Ourdata

7. Open Server Manager

8. Go to File and Storage Services --> Shares

9. Right-Click under NETLOGON SYSVOL then select New Share...

10. Select SMB Share - Quick then Click Next >

11. Select ur new share drive that you just made then Click Next >

12. Name the share with a description then Click Next >

13. Select Enable access-based enumeration then Click Next >

14. Click Next > and then Click Create

Map the network drives (Shares) (GPO)

1. Open Server Manager

2. Go to Tools -->> Group Policy Management

Do NOT edit the Default Domain Policy

3. Right-Click on "YOUREDOMAIN.lan" and Select "Create a GPO in this domain, and Link it here..."

4. Name the GPO then Click OK

Example:
Network Drives

5. Right-Click on the new created GPO then select "Edit..."

6. Go to User Configuration --> Preferences --> Windows Settings --> Drive Maps -->

7. Right-Click on Drive Maps then select "New" --> Mapped Drive

8. For Action, choose "Create"

9. For location, put the location of your share

Example:
\\WSERVER01\Ourdata

10. Select the box for "Reconnect" so it reconnects whenever they log back in

11. Select a Drive Letter

12. Click on OK

Install Windows Deployment Services (WDS)

1. Open Server Manager

2. Select "Add roles and features"

3. Click Next for Installation Type and Server Selection

4. Select "Windows Deployment Services" and Click "Add Features"

5. Click Next for Server Roles, Features, WDS, Roles Services, Confirmation and Click Install

6. Open Server Manager

7. Go to Tools -->> DHCP

8. Click on the small arrow (make sure you see IPv4 and IPv6)

9. Go to IPv4 --> Scope IP Addres domain DHCP --> Scope Options

10. Right-Click on "Scope Options" and select "Configure Options"

11. Select 066 Boot Server Host Name and insert the server hostname

Example:
wserver01.teahouse.lan
wserver02.arcadeparty.local

12. Select 067 Bootfile Name and insert the Name the Click OK

Example:
boot\x64\wdsnbp.com

13. Open Server Manager

14. Go to Tools -->> Windows Deployment Services

15. Click on Servers then Right-Click on your server and select Configure Server

16. Click Next > for Before You Begin and Install Options

17. Change the path to the WDS drive you want then Click Next > for Remote Installation Folder Location and Proxy DHCP Server

18. Select Respond to all client computers (known and unknown) then Click Next > and then Finish

adding new image to WDS

We will setup a Windows 10 Pro image as a example

1. Download windows 10 ISO by selecting the Create Windows 10 installation media https://www.microsoft.com/en-us/software-download/windows10

2. Open Server Manager

3. Go to Tools -->> Windows Deployment Services

4. Go to Servers --> your server --> Install Images

5. Right-Click on Install Images then select Add Install Image...

6. Give the image group a name then Click Next >

Example:
wserver01-images

7. Click on Browse... and find the Install.wim file in the sources folder of the ISO then Click Next >

If you cannot find the Install.wim file then follow this

Convert Install.esd to Install.wim

1. Copy the Install.esd from the ISO file to the root C:/ drive location

2. 

cmd

cd c:/

dism /Get-WimInfo /WimFile:install.esd

Change INSERTINDEXNUMBERHERE to the index number of the windows version you want

dism /export-image /SourceImageFile:install.esd /SourceIndex:INSERTINDEXNUMBERHERE /DestinationImageFile:install.wim /Compress:max /CheckIntegrity

7. Delete the Install.esd file When the extraction is 100% finished

8. Back at the Windows Deployment Services Click on Browse... and find the Install.wim file in the root C:/ drive location then Click Next >

9. Click Next > for Available Images and Summary

10. Right-Click on Boot Images then select Add Boot Image...

11. Click on Browse... and find the Boot.wim file from the ISO in the folder sources then Click Next >

12. Give it a image name then Click Next > for Image Metadata and Summary then Click Finish

Example:
Image name: Windows 10 Pro x64
Image description: Windows 10 Pro x64

Windows Lite Touch install

1. Download and install Windows ADK

Make sure you install the ADK on the right Windows version! https://learn.microsoft.com/en-us/windows-hardware/get-started/adk-install

In this example we are on Windows Server 2022
We download ADK for Windows Server 2022--> https://go.microsoft.com/fwlink/?linkid=2162950
We also need the Windows PE add-on --> https://go.microsoft.com/fwlink/?linkid=2163233

2. Download and install MicrosoftDeploymentToolkit_x64.msi from here: https://www.microsoft.com/en-us/download/details.aspx?id=54259

3. Open DeploymentWorkbench

4. Right-Click Deployment Shares and select New Deployment Share

5. Select a deployment share path then Click Next for Share, Descriptive Name,

6. At Options, Remove all checkmarks then Click Next for Summary and then Finish

7. Go to MDT Deployment Share --> Operating Systems

8. Right-Click on Operating Systems and select Import Operating System

9. Select Full set of source files then Click Next

10. Click on Browse to select your Windows image source files then Click Next

11. Give it a directory name then Click Next for summary and then Click Finish

12. Right-Click on Task sequence and select New Task sequence

13. Give the Task a name then Click Next

Example:
Task sequence ID: W10D
Task sequence Name: Windows 10 Pro x64
Task sequence Comment: A clean deployment.

14. Make sure Standard Client Task Sequence is selected then Click Next

15. Select the Windows image under the Operating Systems folder then Click Next

16. Do not specify a product key at this time and Click Next

17. Give some details for OS Settings

Example:
Full Name: Admin
Organization: Arcadeparty
Internet Exploder Home Page: about:blank

18. Select Do not specify an Administrator password at this time then Click Next for Summary and then Click Finish

19. Right-Click on MDT Deployment Share and select Properties

20. Click on General tab then at Platforms Supported, remove the checkbox for x86

21. Click on Rules tab COPY AND PASTE THE RULES BELOW MAKE SURE THEY MATCH

[Settings]
Priority=Default
Properties=MyCustomProperty

[Default]
OSInstall=Y
SkipBDDWelcome=YES
SkipCapture=YES
SkipAdminPassword=YES
SkipProductKey=YES
SkipComputerBackup=YES
SkipBitLocker=YES
SkipUserData=YES
SkipTimeZone=YES
SkipLocaleSelection=YES

JoinDomain=arcadeparty.lan
MachineObjectOU=OU=Workstations,DC=arcadeparty,DC=lan

KeyboardLocale=en-US
TimeZoneName=W. Europe Standard Time
EventService=http://DEPLOYMENT:9800

All KeyboardLocale inputs: https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/default-input-locales-for-windows-language-packs
All TimeZoneName inputs: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-vista/cc749073(v=ws.10)

Click on Edit Bootstrap.ini then COPY AND PASTE THE RULES BELOW MAKE SURE THEY MATCH

[Settings]
Priority=Default

[Default]
DeployRoot=\\DEPLOYMENT\DeploymentShare$

UserID=Administrator
UserDomain=arcadeparty.lan
UserPassword=Password01

KeyboardLocalePE=0409:00000409

SkipBDDWelcome=YES

22. Click on Windows PE tab then at Platform Click on x86 and choose for x64

23. Click on Monitoring tab then select Enable monitoring for this deployment share then Click Apply and OK

24. Right-Click on MDT Deployment Share and select Update Deployment Share

25. Select Optimize the boot image updating process. then Click Next for Summary and then Click Finish

Deploying the clean LiteTouch ISO

1. Open Server Manager

2. Go to Tools -->> Windows Deployment Services

3. Go to Servers --> your server --> Boot Images

4. Right-Click on Boot Images then select Add Boot Image...

5. Click on Browse... and locate the LiteTouchPE_x64.wim file in the DeploymentShare\Boot folder then Click Next

6. Give it a image name then Click Next for Image Metadata and Summary then Click Finish

Example:
Image name: Lite Touch Windows PE clean (x64)
Image description: Clean image of Lite Touch Windows PE clean (x64)

7. Startup a virtual machine or use a real computer and boot with network (PXE) you need to be on the same network as the Windows Server

8. Click on Run the Deployment Wizard to install an ew Operating System

9. Insert the Windows Server login Credentials then Click OK

10. Select the task sequence then Click Next

11. Click Next for Computer Details

12. Select Do not move user data and settings. then Click Next

13. Select Do not restore user data and settings. then Click Next

14. Click next for Locale and Time

15. Click Begin (this will install Windows) at the end Click Finish

16. Customize the operating system how you want it, install some applications like Firefox, Office or LibreOffice.

If you install applications, make sure you insert the desktop shortcuts in the folder: C:\Users\Default\Desktop

Capturing the customized image

1. On Windows Server, Open DeploymentWorkbench

2. Go to Deployment Shares --> MDT Deployment Share --> Task Sequences

3. Right-Click on Task sequence and select New Task sequence

4. Give the Task a name then Click Next

Example:
Task sequence ID: W10C
Task sequence Name: Capture Windows 10 Pro x64
Task sequence Comment: A customized capture.

5. Make sure Sysprep and Capture is selected then Click Next

6. Select the Windows image under the Operating Systems folder then Click Next

7. Do not specify a product key at this time and Click Next

8. Give some details for OS Settings

Example:
Full Name: Admin
Organization: Arcadeparty
Internet Exploder Home Page: about:blank

9. Select Do not specify an Administrator password at this time then Click Next for Summary and then Click Finish

10. Right-Click on your created task Task sequence and select Properties

11. Click on Task Sequence tab

12. Click on Add then General and then Click on Run Command Line
    Name it: Create new local account
    Insert the command in the Command line section: net user /add admin H@llo123!

13. Click on Add then General and then Click on Run Command Line
    Name it: Add user account to local administrators group
    Insert the command in the Command line section: new localgroup administrators admin /add

14. Click on Add then General and then Click on Run Command Line
    Name it: Disable builtin local administrator account
    Insert the command in the Command line section: net user administrator /active:no

15. Right-Click on MDT Deployment Share and select Properties

16. Click on Rules tab COPY AND PASTE THE RULES BELOW MAKE SURE THEY MATCH

[Settings]
Priority=Default
Properties=MyCustomProperty

[Default]
OSInstall=N
SkipCapture=NO
SkipAdminPassword=YES
SkipProductKey=YES
SkipComputerBackup=YES
SkipBitLocker=YES
DoCapture=YES

17. Click on Windows PE tab then at Platform Click on x86 and choose for x64 then Click Apply and OK

18. Right-Click on MDT Deployment Share and select Update Deployment Share

19. Select Optimize the boot image updating process. then Click Next for Summary and then Click Finish

20. Switch to the Windows client desktop that you deployed.

21. Open explorer then open the LiteTouch vbs script that is located at: \\SERVERHOSTNAME_OR_IP\deploymentshare$\Scripts\LiteTouch.vbs then enter your Windows Server network credentials

22. Select the task sequence Capture Windows then press Next

23. Select Capture an image of this reference computer. then Click Next and Click Begin at the end Click Finish

Deploying the customized image

1. On Windows Server, Open DeploymentWorkbench

2. Go to Deployment Shares --> MDT Deployment Share --> Operating Systems

3. Right-Click on Operating Systems and select Import Operating System

4. Select Custom image file then Click Next

5. Click on Browse and open the captured image file located at: DeploymentShare\Captures

6. Select Setup files are not needed then Click Next

7. Give it a name then Click Next for Summary and then Click Finish

Example:
Windows 10 Pro x64 Captured

8. Delete the old Windows image, Right-Click on the old image and select Delete

9. Select Completely delete these items. even if there are copies in other folders. (force) then Click Next for Summary and then Click Finish

10. Go to Deployment Shares --> MDT Deployment Share --> Advanced Configuration --> Selection Profiles

11. Right-Click on Selection Profiles and select New Selection Profile

12. Give it a name then Click Next

Example:
Windows 10 Pro x64

13. Select Applications, Operating Systems and Task Sequences then Click Next for Summary and then Click Finish

14. Right-Click on Media and select New Media

15. Click on Browse... and Make a new folder called Media Make sure its the same location as where the DeploymentShare folder is

16. For Selection profile: Click on Everything and then select the Windows profile you made then Click Next for Summary and then Click Finish

17. Right-Click on MEDIA001 and select Properties

18. At the Platforms Supported section, Remove the checkmark for Generate x86 boot image

19. Change the ISO file name to something better

Example:
Windows10Prox64final

20. Click on Rules tab COPY AND PASTE THE RULES BELOW MAKE SURE THEY MATCH

[Settings]
Priority=Default
Properties=MyCustomProperty

[Default]
OSInstall=Y
SkipCapture=YES
SkipAdminPassword=YES
SkipProductKey=YES
TimeZoneName= W. Europe Standard Time
SkipDomainMembership=NO
SkipUserData=YES
SkipLocaleSelection=YES
SkipTaskSequence=NO
SkipApplications=NO
SkipBitLocker=YES
SkipSummary=YES
SkipRoles=YES
SkipFinalSummary=YES

To know the right name for your TimeZoneName run the following command in cmd:
tzutil /l

21. Click on Windows PE tab then at Platform Click on x86 and choose for x64 then Click Apply and OK

22. Right-Click on MEDIA001 and select Update Media Content at the end Click Finish

Change Deployment Toolkit background

1. Go to the folder: C:\Program Files\Microsoft Deployment Toolkit\Samples

2. Replace Background.bmp with your custom image (Needs to be a .bmp format)

You can find the settings of the Background below

1. Open DeploymentWorkbench

2. Right-Click on MDT Deployment Share and select Properties

3. Click on the Windows PE tab and then the Windows PE Customizations section