A comprehensive home-lab tutorial demonstrates how to build a miniature Active Directory environment integrated with the ELK stack for centralized security logging. The project uses VirtualBox with a custom NAT network named AD-Lab on the 192.168.100.0/24 subnet.
The stand consists of three virtual machines: DC01 running Windows Server 2019 as the domain controller, DNS and DHCP server; WIN7-PC01 running Windows 7 as a domain-joined client; and an Ubuntu Server host named elk that runs Elasticsearch, Logstash and Kibana 9.4.2.
Readers are guided through renaming the server, assigning a static IP, installing the AD-Domain-Services role and promoting the forest corp.lab. Subsequent sections detail DHCP scope creation, OU structure under OU=Lab,DC=corp,DC=lab, and the creation of test users and groups.
A dedicated chapter explains how to create the GPO “Lab-Audit-Policy” and enable advanced auditing categories including “Audit Process Creation” with command-line logging. The author also describes a non-obvious issue where the gPCMachineExtensionNames attribute was missing the GUID for advanced audit policy, preventing settings from applying, and provides the exact PowerShell commands to correct it.
Windows 7 is joined to the domain using Add-Computer, after which Winlogbeat 7.17 is installed on both the domain controller and the client. Because Winlogbeat 7.17 cannot connect directly to Elasticsearch 9.x, Logstash is placed in the middle to receive beats input on port 5044 and forward events to the Elasticsearch HTTPS endpoint.
Port forwarding rules are configured in VirtualBox so that Kibana is reachable at http://localhost:5601 and SSH access to the ELK server is available on port 2222. Memory tuning recommendations are given for Elasticsearch and Logstash JVM heaps when RAM is limited to 4–6 GB.
The article concludes with a troubleshooting section covering DHCP errors, time synchronization requirements for Kerberos, and the necessity of KB3004375 on Windows 7 to capture command-line data in event 4688.


