Skip to content

Windows Enterprise Deployment Guide

This site is a deployment blueprint, not a theory manual. It is designed to be reused across customer environments while staying concrete enough to execute in a real Proxmox-based Windows infrastructure rollout.

At a glance:

  • Platform: Proxmox + RouterOS + Windows
  • Validated scope: CHR, AD, DHCP, DNS, GPO, templates
  • Method: runbooks, evidence, and validation gates
  • Standard publication rule: validate the intended first deployment in the lab first, then document the proven method
  • Windows automation standard: PowerShell-first, with transport documented separately from script logic
  • Publication rule in navigation: only deploy-validated operational pages stay under Runbooks; anything else moves to Review
  • Current operational phase model:
  • P01 = MikroTik CHR
  • P02 = Golden images
  • Design standards such as OU structure live under Standards, not under Runbooks

What this v1 includes

  • A canonical HQ lab built on the current state:
  • HQ-CHR01 on Proxmox as VMID 4010
  • Windows Server golden template as VMID 4000
  • A reusable documentation contract based on task runbooks with validation gates.
  • A first end-to-end lab flow for a 15-user company using representative endpoints instead of fake enterprise scale.
  • Client overlay pages so customer-specific values can be added without rewriting the base blueprint.

Core design rules

  • The lab is the source of truth for the first deployment model.
  • No operational standard is published until it has been validated successfully in the lab.
  • The lab may reduce endpoint quantity for practicality, but it must still validate every required day-zero infrastructure role.
  • Reusable Windows configuration logic must be captured in PowerShell.
  • Script logic and execution transport must be documented as separate concerns.
  • Use Windows Server Core by default for supported server roles to reduce footprint and attack surface.
  • Manage Windows servers from a dedicated management workstation instead of relying on local interactive administration on each server.
  • Every critical task must have prechecks, execution steps, validation, evidence, and rollback notes.
  • Expected outputs are mandatory. Screenshots are supplemental.
  • Base blueprint content stays generic and reusable.
  • Customer-specific values live in overlays through structured placeholders.
  • Growth guidance is expressed as decision triggers, not long theory sections.

Current lab target

The first validated lab represents the company's first headquarters deployment model with:

  • VLAN 20 servers
  • VLAN 30 workstations
  • VLAN 40 printers
  • VLAN 70 guest
  • VLAN 90 backup
  • VLAN 100 hypervisor
  • VLAN 110 build

The lab must prove routing, DHCP, DNS, Active Directory, baseline GPO, SMB access, segmentation, and internet access before the blueprint is considered ready for broader customer reuse.

Current deployed baseline from the source conversation

The guide now reflects the exact deployment data already used in the live lab:

  • HQ-CHR01
  • VMID 4010
  • RouterOS 7.21.5 Long-term
  • local-zfs
  • net0 -> GEILWAN
  • net1 -> GEILLAN
  • WAN 172.31.255.2/30
  • gateway 172.31.255.1
  • QEMU Guest Agent enabled
  • Windows template
  • VMID 4000
  • TPL-WS2025
  • VLAN 110 build network
  • 172.20.110.10/24 during build

The runbooks below preserve those values as the authoritative lab baseline.

Standards coverage in this site now includes:

  • authoring and publication rules
  • naming and placeholder conventions
  • identity and namespace strategy for corp.gntech.me and gntech.me
  • enterprise OU design using the approved day-zero GNTECH baseline
  • baseline GPO reference
  • validation model and functional gates

CHR coverage in this site now includes:

  • deployment
  • baseline configuration
  • VLAN creation
  • interface lists and foundation services
  • NAT
  • firewall
  • Windows service flows
  • trial licensing to avoid the default throughput limitation of an unlicensed CHR instance

Windows Server template coverage in this site now includes:

  • golden image standard for VMID 4000
  • exact Proxmox creation commands for TPL-WS2025
  • Windows installation on VLAN 110
  • VirtIO guest tools and QEMU Guest Agent
  • PowerShell 7 installation and validation
  • a corrected QGA runner flow for Proxmox VE 9
  • final validation, cleanup, DHCP reset, Sysprep, and conversion to template
  • validated rebuild lifecycle with clone-test before template publication
  • separate Windows Server Core template guidance

Windows client template coverage now includes:

  • TPL-W11E for general corporate workstations
  • TPL-W11-IOT-LTSC for dedicated-purpose endpoints
  • validated rebuild lifecycle using:
  • unattend
  • interactive Sysprep
  • clone-test before final template publication

Domain controller coverage in this site now includes:

  • first forest and domain creation
  • DNS, DHCP, and enterprise OU baseline
  • AD Recycle Bin
  • first System State backup and backup-target preparation
  • PDC Emulator time-source configuration
  • baseline GPO seeding for domain controllers, servers, and workstations
  • a dedicated GPO reference page for later consultation
  • an operator-facing script catalog for direct sysadmin execution inside Windows guests
  • Sites and Subnets preparation before workstation rollout

Workstation onboarding now assumes:

  • domain readiness first
  • Windows 11 golden image creation second
  • basic workstation join validation after clients are deployed from the approved image
  • file services after basic workstation validation
  • workstation resource access validation only after HQ-FS01 is operational

Current phase grouping in the guide:

  • P01 covers HQ-CHR01 deployment, baseline, VLANs, NAT, firewall, relay, licensing, and Cloudflare tunnel container work.
  • P02 covers Windows Server, Windows Server Core, Windows 11 Enterprise LTSC, and Windows 11 IoT Enterprise LTSC golden images.
  • P03 covers Active Directory, core Windows services, workstation validation, and resource-access validation.
  • Enterprise OU structure is documented under Standards because it is a design standard, not an execution runbook.
  • The next operational phase numbering should only be assigned after its scope is defined.
  • Any operational page not re-proven against the current lab is published under Review until it is validated and promoted back into Runbooks.

Execution model for Windows automation in this guide:

  • The reusable configuration logic should be written in PowerShell.
  • For operational Windows server and workstation deployment, the sysadmin executes the validated PowerShell logic directly inside the guest OS.
  • QEMU Guest Agent is used only where the runbook explicitly defines it as part of image engineering or validation transport.
  • Real customer deployments may execute the same scripts through another supported transport such as WinRM, Hyper-V, VMware, or direct interactive administration.

Publication model for this guide:

  1. validate the method in the lab
  2. correct it until it is repeatable
  3. capture the actual PowerShell logic used
  4. document the validated execution path
  5. run strict documentation validation
  6. then commit and push