{
  "State": "verified",
  "UpdatedAt": "2026-11-01T12:17:47.2785635Z",
  "Domain": "corp.lab",
  "Network": "VirtualBox internal network ADLAB-FRESH, 10.10.10.0/24, no gateway",
  "Machines": [
    {
      "Name": "DC1",
      "IP": "10.10.10.10",
      "Role": "Domain controller and DNS"
    },
    {
      "Name": "MS1",
      "IP": "10.10.10.20",
      "Role": "Domain member and file server"
    }
  ],
  "ConfigurationChecks": [
    {
      "Computer": "DC1",
      "Check": "Domain membership",
      "Status": "PASS",
      "Observed": "True"
    },
    {
      "Computer": "DC1",
      "Check": "OS inventory",
      "Status": "PASS",
      "Observed": "Caption                                           Version    BuildNumber\r\n-------                                           -------    -----------\r\nMicrosoft Windows Server 2025 Standard Evaluation 10.0.26100 26100"
    },
    {
      "Computer": "DC1",
      "Check": "Firewall profiles enabled",
      "Status": "PASS",
      "Observed": "True"
    },
    {
      "Computer": "DC1",
      "Check": "LDAP DNS discovery",
      "Status": "PASS",
      "Observed": "NameTarget   Port\r\n----------   ----\r\ndc1.corp.lab  389"
    },
    {
      "Computer": "DC1",
      "Check": "File server DNS record",
      "Status": "PASS",
      "Observed": "True"
    },
    {
      "Computer": "DC1",
      "Check": "Intranet DNS alias",
      "Status": "PASS",
      "Observed": "True"
    },
    {
      "Computer": "DC1",
      "Check": "Domain controller address",
      "Status": "PASS",
      "Observed": "True"
    },
    {
      "Computer": "DC1",
      "Check": "DC advertising, services and SYSVOL health",
      "Status": "PASS",
      "Observed": "dcdiag Advertising, Services and SysVolCheck completed successfully"
    },
    {
      "Computer": "DC1",
      "Check": "Required OUs",
      "Status": "PASS",
      "Observed": "True"
    },
    {
      "Computer": "DC1",
      "Check": "Test identities",
      "Status": "PASS",
      "Observed": "True"
    },
    {
      "Computer": "DC1",
      "Check": "HR group nesting",
      "Status": "PASS",
      "Observed": "True"
    },
    {
      "Computer": "DC1",
      "Check": "Finance group nesting",
      "Status": "PASS",
      "Observed": "True"
    },
    {
      "Computer": "DC1",
      "Check": "Password and lockout policy",
      "Status": "PASS",
      "Observed": "True"
    },
    {
      "Computer": "DC1",
      "Check": "MS1 in Servers OU",
      "Status": "PASS",
      "Observed": "True"
    },
    {
      "Computer": "MS1",
      "Check": "Domain membership",
      "Status": "PASS",
      "Observed": "True"
    },
    {
      "Computer": "MS1",
      "Check": "OS inventory",
      "Status": "PASS",
      "Observed": "Caption                                           Version    BuildNumber\r\n-------                                           -------    -----------\r\nMicrosoft Windows Server 2025 Standard Evaluation 10.0.26100 26100"
    },
    {
      "Computer": "MS1",
      "Check": "Firewall profiles enabled",
      "Status": "PASS",
      "Observed": "True"
    },
    {
      "Computer": "MS1",
      "Check": "LDAP DNS discovery",
      "Status": "PASS",
      "Observed": "NameTarget   Port\r\n----------   ----\r\ndc1.corp.lab  389"
    },
    {
      "Computer": "MS1",
      "Check": "File server DNS record",
      "Status": "PASS",
      "Observed": "True"
    },
    {
      "Computer": "MS1",
      "Check": "Intranet DNS alias",
      "Status": "PASS",
      "Observed": "True"
    },
    {
      "Computer": "MS1",
      "Check": "Domain secure channel",
      "Status": "PASS",
      "Observed": "True"
    },
    {
      "Computer": "MS1",
      "Check": "Server baseline applied",
      "Status": "PASS",
      "Observed": "True"
    },
    {
      "Computer": "MS1",
      "Check": "Department share exists",
      "Status": "PASS",
      "Observed": "True"
    }
  ],
  "AccessTests": [
    {
      "User": "ben.brooks",
      "Test": "HR can create a file via SMB",
      "ExpectedAllowed": true,
      "ObservedAllowed": true,
      "Status": "PASS",
      "Detail": "Operation succeeded",
      "Time": "2026-11-01T12:12:43.1033799Z"
    },
    {
      "User": "ben.brooks",
      "Test": "HR cannot read Finance via SMB",
      "ExpectedAllowed": false,
      "ObservedAllowed": false,
      "Status": "PASS",
      "Detail": "Access is denied",
      "Time": "2026-11-01T12:12:43.4079505Z"
    },
    {
      "User": "chris.chen",
      "Test": "Finance can read via SMB",
      "ExpectedAllowed": true,
      "ObservedAllowed": true,
      "Status": "PASS",
      "Detail": "Operation succeeded",
      "Time": "2026-11-01T12:12:43.5420816Z"
    },
    {
      "User": "chris.chen",
      "Test": "Finance cannot create a file via SMB",
      "ExpectedAllowed": false,
      "ObservedAllowed": false,
      "Status": "PASS",
      "Detail": "Access to the path '\\\\MS1.corp.lab\\Departments\\Finance\\chris-proof.txt' is denied.",
      "Time": "2026-11-01T12:12:43.6720128Z"
    },
    {
      "User": "chris.chen",
      "Test": "Finance cannot read HR via SMB",
      "ExpectedAllowed": false,
      "ObservedAllowed": false,
      "Status": "PASS",
      "Detail": "Access is denied",
      "Time": "2026-11-01T12:12:43.7980362Z"
    }
  ],
  "Lockout": {
    "Computer": "DC1",
    "User": "dana.diaz",
    "LockedOutObserved": true,
    "Matching4740Events": 1,
    "UnlockedAfterTest": true,
    "Status": "PASS",
    "CollectedAt": "2026-11-01T12:13:58.6276907Z"
  },
  "AuthenticationTest": {
    "Computer": "MS1",
    "User": "dana.diaz",
    "BaselineLogon": true,
    "StartedAt": "2026-11-01T12:13:05.4681089Z",
    "Attempts": [
      {
        "Attempt": 1,
        "Succeeded": false,
        "WindowsError": 1326,
        "Time": "2026-11-01T12:13:05.7030798Z"
      },
      {
        "Attempt": 2,
        "Succeeded": false,
        "WindowsError": 1326,
        "Time": "2026-11-01T12:13:05.7622963Z"
      },
      {
        "Attempt": 3,
        "Succeeded": false,
        "WindowsError": 1326,
        "Time": "2026-11-01T12:13:05.8183768Z"
      },
      {
        "Attempt": 4,
        "Succeeded": false,
        "WindowsError": 1326,
        "Time": "2026-11-01T12:13:05.8869528Z"
      },
      {
        "Attempt": 5,
        "Succeeded": false,
        "WindowsError": 1326,
        "Time": "2026-11-01T12:13:05.9584105Z"
      }
    ],
    "Matching4624Events": 1,
    "Matching4625Events": 5,
    "Note": "Five controlled wrong-password attempts against one disposable lab identity. DC lockout verification is separate."
  },
  "Screenshots": [
    {
      "File": "lockout-event-export.jpg",
      "Caption": "Event 4740 exported from DC1 Security log: dana.diaz locked out at 7:13:04 AM, caller MS1. The original CSV message is shown as plain text in a browser; this is not an Event Viewer screenshot."
    },
    {
      "File": "hr-acl-export.jpg",
      "Caption": "Original Get-Acl output collected on MS1 for C:\\Shares\\Departments\\HR. CORP\\DL_FS_HR_Modify has Modify permission. Text export viewed in a browser."
    },
    {
      "File": "finance-acl-export.jpg",
      "Caption": "Original Get-Acl output collected on MS1 for C:\\Shares\\Departments\\Finance. CORP\\DL_FS_Finance_Read has ReadAndExecute permission. Text export viewed in a browser."
    },
    {
      "File": "gpo-baseline-report.jpg",
      "Caption": "Original Windows-generated Get-GPOReport export from DC1, collected November 1 at 7:05 AM. LAB - Server Baseline configures the Domain Profile firewall state as On. Report viewed in a browser."
    }
  ],
  "Limits": "Two Windows Server evaluation VMs. No production users or systems. Windows Security event auditing is used; no Splunk or Sysmon ingestion is claimed. Results describe only the checks recorded here."
}