> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/02-active-directory-basics/verify-domain-login.md).

# Verify a Domain Login

## Objective

Sign in to `CLIENT01` using the normal domain account `labuser01` and verify that authentication is coming from Active Directory.

## Sign In with the Domain User

At the `CLIENT01` sign-in screen:

1. Select **Other user** if required.
2. Enter either:

```
ZYBERLAB\labuser01
```

or:

```
labuser01@zyberlab.test
```

3. Enter the lab-only password created earlier.
4. Sign in.

The first sign-in may take slightly longer while Windows creates the local user profile.

## Verify the Logged-In Identity

Open Command Prompt and run:

```
whoami
```

Expected format:

```
zyberlab\labuser01
```

Then run:

```
echo %USERDOMAIN%
```

Expected result:

```
ZYBERLAB
```

Check the domain DNS name:

```
echo %USERDNSDOMAIN%
```

Expected result:

```
ZYBERLAB.TEST
```

## Identify the Domain Controller

Run:

```
echo %LOGONSERVER%
```

Expected result:

```
\\DC01
```

This shows which domain controller handled the sign-in context.

## Verify DNS Again

Run:

```
nslookup dc01.zyberlab.test
```

`CLIENT01` should resolve `DC01` through the domain DNS service.

## What Happened?

The user account did not need to be created locally on `CLIENT01`.

Instead:

```
labuser01
     │
     ▼
CLIENT01 requests domain authentication
     │
     ▼
DC01 / Active Directory
     │
     ▼
Authentication succeeds
     │
     ▼
Windows creates/loads the user's local profile
```

This is one of the central ideas behind an Active Directory domain: identity is managed centrally while users can access authorized domain-joined systems.

## Security Relevance

A normal domain sign-in generates security telemetry that can later be investigated.

Future ZyberLab exercises will compare:

* successful logons
* failed logons
* account lockouts
* privileged logons
* user and group changes

The same environment you have just built will be used to generate those events intentionally.

## Take a Snapshot

After verifying that everything works, shut down or stabilize both VMs and create a VMware snapshot such as:

```
AD Baseline - Domain Working
```

This gives you a clean recovery point before starting security configuration and monitoring exercises.

## Final Checkpoint

At the end of this section, you should have:

| Component       | Result                                      |
| --------------- | ------------------------------------------- |
| `DC01`          | Domain controller and DNS server            |
| Domain          | `zyberlab.test`                             |
| `CLIENT01`      | Domain joined                               |
| `labuser01`     | Normal domain user                          |
| Lab Users Group | Security group with `labuser01` as a member |
| Domain login    | Verified successfully                       |
| Snapshot        | AD baseline created                         |

You now have a small but complete Active Directory lab ready for Windows security and monitoring exercises.