A production-pattern domain built to practice what you cannot safely practice on a client's network: forest promotion, cross-subnet firewall policy, and storage pooling. Windows Server 2025 on bare metal, Hyper-V, two VMs, a hardware firewall, and 4.5 TB of pooled storage. Everything below is running.

Fig. 1 — Flat two-subnet topology. Management traffic crosses from the wireless segment to the server segment through an explicit Sophos rule rather than a flat allow. VLAN segmentation is staged next, once the domain is stable.

Host

Dell OptiPlex 9020 · Windows Server 2025 Datacenter

Directory

DC01 — forest promoted; AD DS, DNS and DHCP for lab.local

File services

FS01 — domain-joined, File Server role, SMB/NFS

Storage

Storage Spaces pool — 2×2 TB + 1×500 GB, thin-provisioned 4 TB NTFS virtual disk, SCSI passthrough to FS01

Edge

Sophos XG 125 (v22) — multi-port LAN/WAN separation, cross-subnet policy

DHCP scopes

172.16.16.100–200 and 192.168.30.100–150

Carried into client work: install hypervisor roles before patching, isolate disks during OS installs, and confirm which firewall port is actually the gateway before blaming the virtual switch.

Most sysadmins inherit a provisioning process. I designed one. Built the onboarding system for a ~200-employee health insurer end to end — permissions, licenses, equipment, documentation, training — then built the matching deprovisioning path so company data was secured at offboarding and equipment and licenses were recovered and redeployed rather than lost. Repeatable and auditable, which is the part that matters when a regulator asks.

Own end-to-end onboarding for 10+ managed-services clients at once — timelines, technical deliverables, and the translation layer between engineers and the people signing the contract. Runs from signed agreement through transition to steady-state support, with network assessments and pre-sales infrastructure recommendations feeding the same work.

Turning the lifecycle system above into running code against the homelab domain: a script that reads a new-hire CSV, creates the AD user in lab.local, assigns groups, provisions a home folder on FS01, and emits the welcome documentation. Repository goes public when it does.

A containerized web app for tracking studio operations — KPIs, client metrics, and pipeline. Built it because spreadsheets stopped scaling. REST API for programmatic updates, JSON persistence on a mounted volume, CSV import and export, and a container healthcheck so it restarts itself when it stops answering.

Fig. 2 — State lives on a mounted volume rather than inside the container, so the image stays disposable and a rebuild never costs data.

A defensive account- and domain-security service covering the digital assets the studio manages. It is the closest thing in my own business to the email security and incident work I did in-house at a health insurer — same disciplines, smaller blast radius.

Access

MFA on every managed account, passkeys or security keys for admin logins — plus least-privilege role cleanup, removal of stale users, and replacing shared logins with individual access.

OAuth

Review and revocation of risky third-party app connections; verification of recovery contacts and backup codes.

Email auth

SPF, DKIM and DMARC audit and configuration — DMARC staged from p=none through quarantine to reject once legitimate senders are confirmed, so the domain cannot be spoofed.

Monitoring

Recurring breach-exposure checks and review of login and admin activity, summarized in a monthly written report.

Response

A documented account-takeover incident-response procedure, with hardening checklists and audit-report templates behind it.

Training

Phishing-recognition training for client staff — recognition material only; the service does not send live lures.

Tooling

Python utilities I wrote for the recurring checks — breach exposure and email-authentication verification.

The third time I have built one of these — after the employee lifecycle system at a health insurer and client onboarding at an MSP. A documented, repeatable seven-stage process every engagement runs through, so onboarding does not depend on me remembering it.

01 Profile

Master reference record for the engagement — kept current as the single source of truth.

02 Discovery

Prep checklist, call script, structured notes, and a written action plan — so discovery produces a decision, not just a conversation.

03 Build

Website project scope, milestones and delivery.

04 Brand

Brand assets, voice, and style reference.

05–07

Proposals, project media, and agreements — each stage with its own template so nothing is improvised per client.

A written audit methodology paired with an implementation training guide, so the deliverable is not just a report but the ability to act on it. Same instinct as the work-from-home training I built and delivered at a health insurer — the handoff matters more than the document.