Every command this range teaches, decoded. Pick one on the left, or search above.
LOCKOUT · WINDOWS · difficulty 3 · ~25 min · 14 steps
The domain controller locked every admin out. Recover it from the boot up.
The attacker disabled every Domain Admin account on DC01 and set their own logon script to run at every reboot. Nobody can log into the domain. A domain controller has a back door built for exactly this: Directory Services Restore Mode, a boot state with its own local administrator that exists outside Active Directory. You have console access through vCenter. This is a recovery, and it teaches how Windows authentication is layered.