Skybaer Labs logo
SKYBÆR LABS
Showcase Project

Windows Integration

A Windows domain, a SQL Server backend, and a Microsoft Endpoint Configuration Manager (MECM) site, built from scratch on top of the lab’s existing Windows VM, with the rest of the lab now joining that same domain.

Active Directory Domain Services SQL Server IIS MECM / ConfigMgr realmd / sssd Windows Server 2025

One VM, Four Roles

What DC01 actually is now

Extending the lab into Windows enterprise management, domain services, endpoint configuration, the pieces that come up constantly in enterprise IT and that the Linux-only side of the lab couldn’t exercise on its own.

From lab VM to domain controller

WinLab2025 was renamed to DC01 and promoted to the root of a new Active Directory forest, skybaerlabs.net. DNS forward and reverse zones came from the promotion itself, no separate DNS server setup needed.

A full stack on one box

DC01 runs Active Directory Domain Services, SQL Server 2025 (backing the ConfigMgr database), IIS, and a Microsoft Endpoint Configuration Manager (MECM) primary site, all on a single Windows Server 2025 VM (4GB RAM, 2 vCPU).

The rest of the lab is joining it

Linux hosts are moving into skybaerlabs.net via realmd/sssd/adcli instead of staying in a separate identity silo. control.skybaerlabs.net is joined and verified so far (realm list, id, getent passwd all resolving through SSSD); the rest of the lab is still being brought in.

Still a work in progress

MECM’s primary site is up and verified (site DB1, a 180-day evaluation license), but this is a September 2026 build, not a finished product. Discovery, boundary groups, and client deployment are next, and this page will grow as that happens.

Real Troubleshooting

Four problems, from four different layers of the stack

A hyphen broke a service account

Problem
Creating the SQL Server service account as sql-svc failed immediately, with Active Directory rejecting it outright.
Root cause
The hyphenated username produced a UPN conflict. Active Directory reported that the operation failed because the UPN value provided was not unique forest-wide, even though no other account actually used that name.
Fix
Renamed the account to sqlsvc (no hyphen). Creation succeeded immediately with everything else unchanged.

SSMS could reach it. The setup wizard couldn’t.

Problem
The MECM setup wizard failed to connect to SQL Server at the Database Information screen, no matter which server name format was tried.
Root cause
SQL Server Management Studio had been connecting locally over named pipes the whole time, which masked that the TCP/IP protocol itself was disabled in SQL Server Configuration Manager. The setup wizard, unlike SSMS, connects over the network and specifically needs TCP/IP.
Fix
Enabled TCP/IP under SQL Server Network Configuration and restarted the SQL Server service; the wizard connected on the next attempt. IIS’s ASP.NET handler mappings had a similar “looks broken, isn’t” moment: IIS Manager showed no ASP.NET entries even after 4.8 was installed and confirmed via Server Manager. The MECM installer registers ASP.NET itself during setup, so that one needed no manual fix.

One unchecked box failed the prerequisite check

Problem
MECM’s prerequisite check failed on “Windows Preinstallation Environment installed,” even though the Windows ADK had already been installed.
Root cause
The Windows PE environment isn’t part of the ADK installer at all; it ships as its own separate add-on package that has to be installed on top of the ADK.
Fix
Installed the Windows PE add-on package alongside the ADK, and the prerequisite check passed clean on the next run.

DNS pointed at the wrong resolver

Problem
Joining control.skybaerlabs.net to the new domain failed at the discovery stage; realm discover couldn’t find the domain at all.
Root cause
The host’s DNS was still pointed at the VMware NAT resolver instead of DC01, so the SRV record lookups for the domain were going out to the public internet instead of Active Directory.
Fix
Repointed DNS at DC01 via nmcli (with a DNS search domain set and auto-DNS disabled so it survives DHCP), confirmed time sync, then realm join --user=Administrator skybaerlabs.net completed and verified clean through realm list, id, and getent passwd.
Questions about the lab?
Contact ·