Let's Build Lab Series

In this first section, we’ll set up a Google account. Following that, we’ll use the Google email to establish a Microsoft account. Next, we’ll sign up for Cloudflare and acquire a domain to initiate our venture. The domain I’ve secured for ongoing use in this tutorial series is happybeer.net.

In this section, you will see how to install Proxmox on a 2012 Mac Pro tower. Any hardware with an adequate amount of resources should work for you. A physical server would be ideal, but you could technically even install Proxmox on a VM, it just depends on how far you want to go with everything.

This section will guide you through configuring the ProxMox server, uploading a Windows Server .ISO file, and then using that file to create Windows Server VMs.

This section will guide you through configuring a Windows Server that will host DNS services and also act as a directory using Windows Active Directory.

Jump Desktop is a secure and reliable remote desktop app that lets you connect to any computer, anywhere in the world.

This section will guide you through configuring a Windows Server hosting the Certification Authority role.

You’ll also see how to deploy certificates to a Mac computer via MDM. Further sections will show how to use those certificates for network access.

This section will guide you through configuring a Windows Server hosting the Network Device Enrollment Service (NDES) role. This will be used to deliver SCEP certificates to devices.

After configuring NDES, you'll see how to deploy a certificate to a Mac computer using Kandji.

This section will guide you through configuring BGInfo on Windows Servers. This is completely optional. It is a nice way to quickly identify what server you are looking at, and to quickly identify important information that you can define.

BGInfo generates desktop backgrounds that include important information about the system.

This section will guide you through binding a Mac computer to Windows Active Directory.

Apple still supports this payload, but it is not recommended. Instead, you should use Platform SSO (if your IdP supports it) the Kerberos SSO Extension, or an OIDC/ROPG workflow, if your MDM supports it.

This section will guide you through creating a Microsoft Azure Developer Account.

This isn't meant to be a go-to guide but rather what I ran into when trying to create an Azure developer account. Following this guide should get you where you need to be; however, I did run into some problems that are documented in this guide.

This section will guide you through backing up your VM files to an external source and then using those files to restore the VMs on another ProxMox host.

This section will guide you through creating a custom domain in Microsoft Entra. This is where you will be able to use the domain that you may have purchased earlier in this series to create a custom domain in Microsoft Entra.

You will also see how to sync your on-prem AD users to Microsoft Entra. You'll then be able to sign in with those accounts to access cloud resources.

This section will guide you through creating an Application Proxy with Microsoft Entra to deploy device certificates. You will need to have a domain server, DNS server, CA server, and an NDES server to set this up, all of which have been covered earlier in this series.

This can be a very complicated topic and has a lot of configurations that rely on other services. The application proxy will allow the deliverance of a certificate deployed via MDM to a device on or off of the corporate network.

This section will guide you through creating a Kerberos SSO Extension profile and syncing a local Mac password with an Active Directory password.

This section also goes into detail about the password sync behavior when using Entra cloud sync, as well as how to change Group Policy Objects related to password policies and Kerberos policies.

This section will guide you through updating a Proxmox server to the latest minor release. After updating to the latest minor release, this guide will walk you through upgrading to the latest major release of Proxmox.

This section will guide you through creating a LXC container in Proxmox and subsequently, installing a UniFi controller. This will avoid having to purchase a cloud license to manage UniFi network equipment.

This section will guide you through configuring a UniFi controller. You'll also see how to change some basic settings and create a WPA2 WiFi network, as well as a captive portal network.

This section will guide you through creating a WPA2 Enterprise WiFi network with UniFi. The guide will primarily be focused on how to configure a network profile using SecureW2 and SecureW2's RADIUS server for certificate deployment.

This section will guide you through creating a WPA2 Enterprise WiFi network using a Windows NPS server and a UniFi controller/AP.

There are folks out there still using this method and I would personally recommend moving away from this as it is legacy. A cloud RADIUS such as SecureW2 would be better suited.

This section will guide you through creating an Okta developer account.

If you’re not familiar with Okta, it is an identity management service and it is pretty solid. While the developer account is limited in what you can do, it is wonderful that Okta offers this because you can learn more about the platform while using this in a lab environment. It’s helped me learn a lot because I can do whatever I want and don’t have to worry about breaking anything.

This section will guide you through renewing a Windows Server evaluation license. You can renew the license every 180 days for a total of 6 times, which equals 3 years....how cool is that!