Getting the server up

I grabbed the free 180-day evaluation of Windows Server 2025 from Microsoft — no license key, no cost, just a form to fill out. Spun up a new VM in VirtualBox (4GB RAM, 2 CPUs, 50GB disk felt like enough for a lab), and went with the Desktop Experience edition instead of Server Core, since I wanted an actual GUI to click around in while I'm still learning the ropes.

Nothing dramatic here; just the usual install screens, a reboot or two, and I was staring at Server Manager for the first time.

Getting Sysmon running

Next up was Sysmon. If you haven't come across it, it's a background service that logs detailed system activity — process creation, network connections, registry changes — straight into Windows Event Viewer. On its own, it just logs everything, which is way too noisy to be useful. So I used the SwiftOnSecurity config, which is basically the community-standard baseline real SOC teams build on, since it filters out the noise and keeps the events that actually matter. One command later:

/'Sysmon64.exe -accepteula -i sysmonconfig-export.xml'

...and I had it running. Popped open Event Viewer, navigated to Sysmon's Operational log, and there it was: real-time events logging as I used the machine. That "oh, it's actually working" moment made the whole setup feel real.

Then I locked myself out

Yes, I forgot the Administrator password. For a second, I thought I'd have to reinstall the whole thing and redo it all.
Turns out you don't have to. Windows has a built-in recovery environment you can boot into from the install ISO, and from there you can trick your way into a SYSTEM-level command prompt: swap out 'utilman.exe' (the accessibility button on the login screen) with a copy of 'cmd.exe', reboot, click that button, and BOOM, command prompt with full privileges, ready to reset the password with one 'net user' command.

Honestly? This ended up being the most valuable part of the whole exercise. I didn't plan to learn about offline password resets, but now I actually understand a technique that's genuinely useful for legitimate recovery and for understanding why physical/console access to a machine is such a big deal in security.

What's next?

Now that the server's up and logging, the next step is promoting it to a Domain Controller and building out a small AD environment, so I can start generating real login events and practicing actual log analysis instead of just watching a blank Event Viewer.