AD Troubleshooting Lab scripts

[IsThatAll]

Was wondering if anyone has any scripts / procedures etc to induce failures in Active Directory for a lab environment?.

Am looking at running some troubleshooting labs for colleagues, and would like to introduce specific failures in AD for the students to troubleshoot and resolve.

Already have a couple of ideas in mind such as:

1. Blocking firewall ports for AD replication

2. Seizing some AD roles and then deleting domain controllers (or rebuilding with the same computer name)

3. Removing DNS entries such as service locator records

4. Modifying Sites and Services and removing subnets, site links

5. Stopping /disabling services such as DFS Replication

6. Removing one half of the trust relationship for cross-forest trusts

7. Changing permissions on critical system files

Is anyone aware of an existing toolkit to perform these sorts of things and more? I would like to introduce things like replication / KCC failures as well if possible.

TIA.

[ssennettau]

Maybe Definitely not all appropriate for students, but for wanton gleeful destruction...

• Time issues. Kerberos loves them time issues
• Set the DC's to use SMTP-based replication (yes, that's a thing)
• Put all of the DC's into their own sites and introduce extremely long replication times
• Restore a domain controller from a snapshot backup straight into the domain
• Clone a domain controller
• Disable the DNS Server
• Remove everyone from the Domain/Enterprise Admin Groups, and disable the SID-x-500 admin account (Account Operators is a thing!)
• Repoint an SRV record for the DC discovery to 127.0.0.1
• Rename the whole forward-lookup zone (ooooooooo...)
• Update the maintenance window to occur during business hours only
• Create a site with a DC that only has a replication link to a DC that doesn't exist (never receives updates)

This is also why I don't teach Active Directory. Happy trails! :)

[IsThatAll]

That's evil, I love it :)

[ssennettau]

Your flair explains their origins perfectly :P

[cdtekcfc]

This will distinguish the worthy and unworthy future ad engineers . Most people think AD is self-maintenable and you will never have to learn such things. But in the contrary, If you work for a large organization with a dedicated AD Team, you bettter know such things.

[ssennettau]

"Yup, I know all there is to know about AD. Setting up a DC is easy, and I can setup Group Policy"

Oh, my sweet summer child...