Per-pod Windows Server 2022 member servers are the student session hosts. Each student gets their own server, is a local administrator on that server only, and the domain controllers no longer host student sessions.
Current state (September 22, 2026): the cutover is complete. All 20 servers are built, domain-joined, hardened and patched; each student is local administrator and Remote Desktop User on their own server only; the 20
PODXX-SRVGuacamole connections are granted to the matching student; the portal issuesPODXX-SRVas the session host; seed / verify / reset run againstcrc_pod_serversand all six families have been verified fleet-wide. The Pod01/Pod03 interactive pilots passed, the fleet rollout followed, the student session role on DC01/DC02 has been retired, and the IA M2-L1, IA M3-L2 and MP waivers are retired in member-server mode.Still open: replacement Windows licences for POD07-SRV and POD11-SRV (both remain unactivated,
License Status: Notification), which is why pods 7 and 11 are held back from auto-advance (crc_held_back_pods: 7,11).
| Problem on the shared DC | How the member server fixes it |
|---|---|
| A student local-admin on a DC is effectively domain-wide | Local admin is scoped to their own server; AD rights stay delegated to their own pod OU |
| ADUC required elevation (UAC) for non-admin students | Student is a local admin, so dsa.msc and Server Manager → Tools work normally |
| IA M2-L1 (scheduled task), IA M3-L2 (password policy) and the MP media steps need host admin | All three are local operations on the student's own server, so all three waivers are retired |
| One student shutting down DC01 took all 20 pods offline | Blast radius is one pod |
| Server without RDSH allows only 2 concurrent RDP sessions | One student per server, so 2 admin sessions is ample and no RDS CALs are needed |
| Evidence for all pods lived on one disk | Evidence lives on the student's own server |
| Property | Value |
|---|---|
| Base image | win2022-template (VM 102), Windows Server 2022 |
| Name | PODXX-SRV (member server — not a domain controller) |
| VM IDs | 400 + pod number (Pod01 = VM 401 … Pod20 = VM 420) |
| Sizing | 2 vCPU / 4 GB RAM / 60 GB disk |
| Bridge | podXXnet (the pod's own bridge on PVE1) |
| IP address | 10.50.XX.20/24 |
| DNS | 10.50.1.10, 10.50.1.11 |
| Domain | acs-p01.local, computer object in OU=PodServers |
| Local admin + RDP user | ACS-P01\studentXX (that pod's student only) |
| Tools | RSAT AD DS tools (ADUC, AD PowerShell module), GPMC |
| Evidence tree | C:\CyberLab\PodXX\ |
Provisioning is credential-free: a first-boot script is injected into each clone's disk offline from PVE1 (static IP, rename, enable WinRM, domain join), after which AWX manages the host over WinRM like every other lab system. Automation lives in the pod_member_server role — see AWX Automation.
All 20 servers verified from DC01 and over WinRM on September 3–5, 2026: computer object enabled in OU=PodServers,DC=acs-p01,DC=local, secure channel healthy, RDP + NLA on, RSAT/GPMC/AD PowerShell present, matching student in local Administrators and Remote Desktop Users with no other student in either group, no cached credentials, no password-backed scheduled tasks, Defender real-time protection on, maintenance NIC removed.
| Pod | Server | VM | IP | Student | Licensing |
|---|---|---|---|---|---|
| Pod01 | POD01-SRV | 401 | 10.50.1.20 | student01 | activated |
| Pod02 | POD02-SRV | 402 | 10.50.2.20 | student02 | activated |
| Pod03 | POD03-SRV | 403 | 10.50.3.20 | student03 | activated |
| Pod04–Pod06 | POD04-SRV … POD06-SRV | 404–406 | 10.50.4.20 … 10.50.6.20 | student04–06 | activated |
| Pod07 | POD07-SRV | 407 | 10.50.7.20 | student07 | unlicensed — replacement key requested |
| Pod08–Pod10 | POD08-SRV … POD10-SRV | 408–410 | 10.50.8.20 … 10.50.10.20 | student08–10 | activated |
| Pod11 | POD11-SRV | 411 | 10.50.11.20 | student11 | unlicensed — replacement key requested |
| Pod12–Pod20 | POD12-SRV … POD20-SRV | 412–420 | 10.50.12.20 … 10.50.20.20 | student12–20 | activated |
POD07-SRV and POD11-SRV must not be issued to a student until a valid key activates.
ADUC and the ActiveDirectory PowerShell module are remote clients: they bind to acs-p01.local over the network. On a member server the student sees the same OU=Students tree and keeps the same GenericAll delegation on their own OU=PodXX and nothing else. Being a local administrator of their own server grants no domain privilege.
What changed:
C:\CyberLab\PodXX\ on the pod server instead of on DC01.ia_m2l1_task_step_waived, mp_media_mount_waived) evaluate to false whenever crc_target_mode: member_server, which every lab template now sets.HostState\host-state.json on every evidence pull (playbooks/sync-pod-evidence.yml); a snapshot older than 24 hours is reported as stale rather than guessed at.PODXX-SRV to each student; PODXX-DC remains defined for rollback only, and only student07 / student11 still hold a legacy grant (Backlog).PODXX-SRV/10.50.XX.20 as the session host and DC01-P01/DC02-P01 as directory controllers only.ia_m2l1_task_step_waived, IA M3-L2 and mp_media_mount_waived waivers retired with the matching guide and verifier changes (crc-awx-labops PR #42, AWX project 10 synced to f4293d5).Remaining: replacement Windows Server 2022 Datacenter keys for POD07-SRV and POD11-SRV.
Cohort 1 evidence is archived on DC01 at C:\CohortArchive\COHORT1-20260902 (3,675 files, SHA-256 manifest, restore notes) and the member servers started the new cohort with empty evidence trees.
| Page | Purpose |
|---|---|
| Domain Controllers | DC01 session-host capacity, DC02 replica |
| Pod Infrastructure | Pod networks, OUs, gateways |
| AWX Automation | Seed, verify, reset |