Build administrator workstation in sandbox AD

In general an administrator workstation is dedicated administrative tasks and has the tools necessary installed. The workstation is used as the (only) access to server resources like services or databases.

Windows 7 is unfortunately still in use in a lot of organisations, and this is why I begin with an example on a Windows 7 administrator workstation.

United States of America (USA) Department of Defence (DoD) has release a Security Implementation Guide (STIG) on a Windows Privileged Access Workstation (PAW). The document is unclassified and general available (link).
The guide requires Windows 10 (Rule ID: SV-92857r1_rule), but still the guide can be used as inspiration for other Windows versions or even other operating systems.

Prepare workstation

Network profile:

IP: 192.168.42.57

Subnet: 255.255.255.0

Preferred DNS : 192.168.42.42 (this host)

Alternate DNS : 192.168.42.1 (the vmnet)

Default gateway: None (host-only)

1. Rename the computer, e.g. "Admin7".
2. Set password on user Administrator and rename user, e.g. "Ragnar".
• If you have created a personal local user, then make sure that it does not have the same name as a domain user.
3. Static network configuration: IP and DNS.
4. Print Spooler service stopped and disabled.

Add to domain

Domain: sandbox.lan

1. Log on as a local administrator.
2. Add computer to the domain through its configuration windows. Use your domain administrator to log on to the domain.
3. A restart is required.
4. Log on with your domain administrator and configure the desktop.
• A domain administrator does not have a roaming profile. The desktop must be configured on each computer.
• I usually set the background to a solid red to constantly warn me that I am logged on as a domain administrator.

Configure workstation

1. Danish keyboard.
2. Windows location: UK
3. UK date time format
4. Remove these Windows features

• Windows Gadget platform
• Windows Fax and scanning

Install Remote Server Administration Tools (RSAT) for Windows 7. Download installation set from Microsoft (link). In my case I download the 64 bit edition.
Enable these Windows featues after RSAT installation:

• Group Policy Management Tools
• Active Directory Certificate Services Tools
• Expand and select subitems.
• AD DS and AD LDS Tools
• Expand and select subitems.
• DNS Server Tools

Install SQL Server Management Studio in latest version. This is a little tricky when the computer is off-line from the internet. But I have made a short description on how it can be done in the blog post "SSMS installation on off-line computer".

Install web browser. If you reallyreallyreally need Internet Explorer, then you should upgrade to IE 11. The installation set for offline installation can be downloaded from Microsoft (link). Pick the installation set that matched your Windows 7 installation. But - before installing IE 11 you must download and install "Prerequisite updates for Internet Explorer 11".
There are several very good reasons to use another browser like Mozilla Firefox in the latest version. Downlod the installation set that fits you Windows PAW installation (link). Change the Windows settings to use another browser as default.

Remember to continuously update the web browser.