Already know Windows and have a safe AD lab? Try delegating one administrative task within one fictional organizational unit, then test that the authority doesn't extend elsewhere.
This develops a more specific capability than installing another server. It connects an administrative action to its intended scope.
Treat “weekend” as a scope suggestion, not a setup-time guarantee. Establish the isolated environment first, use fictional accounts, and keep personal and production identities out of the exercise.
Define the administrative task and its boundary
Use fictional users in two separate test organizational units.
Choose one narrow task, such as a password-reset operation for ordinary test users in the first unit. The second unit provides a comparison scope where the operator should not receive the same delegated authority.
Write the expected behavior before configuring anything. The project is about delegated administration, not proving that a broad administrator can perform an administrative action. Keep the operator's ordinary account separate from the account used to set up the lab.
Read the delegation model before using the wizard
Microsoft's Delegation of Control guidance explains how tasks can be delegated to users or groups at a chosen scope.
Pay attention to what objects are included under the selected container and what permissions the chosen task grants.
Do not select the domain root casually because it is convenient.
Use a dedicated lab group for the operator and document the intended scope. The configuration should reflect the narrow requirement rather than rely on a powerful membership that makes every test succeed.
Establish the baseline before delegating
Using the fictional operator's ordinary session, check the relevant action against an ordinary test user in each scope.
Record the expected and observed results. The baseline helps you distinguish the effect of the delegation from permissions the operator already possessed.
If the operator can already perform the task everywhere, investigate that before continuing.
A project that begins with unexplained broad authority cannot demonstrate a narrow delegation boundary clearly. Fix the test setup or choose a clean operator account appropriate to the exercise.
Test the delegated task inside and outside its approved scope
Use an authorized setup account to configure only the task and boundary in the requirement.
Then switch to the fictional operator's ordinary session:
| Test | What it checks |
|---|---|
| Perform the task in the approved test unit | The intended authority is usable |
| Try the comparable task on an ordinary user in another unit | The authority is appropriately bounded |
Record actual results and relevant session conditions. The comparison—not the wizard's completion screen—is the main evidence.
If both operations succeed unexpectedly, investigate the actual permission path. Don't silently broaden the requirement to match the configuration.
The exercise should show that you understand where administrative authority applies and how you verified that boundary. A screenshot of the setup is context; it is not a substitute for the operator tests.
Document recovery and cleanup
Record how the delegated permission can be reviewed and removed in your lab. Verify the resulting state after cleanup using an appropriate test method.
Do not assume that deleting a screenshot or closing the console reverses the configuration.
Keep the test accounts clearly fictional and avoid including passwords or other secrets in the public writeup.
Use the reasons administrative permissions need deliberate boundaries to explain why the project matters beyond the mechanics of the wizard.
Present the project as a bounded administrative-control example
Your portfolio page should include the task, approved scope, baseline, configuration summary, allowed test, denied test, and cleanup result.
State what you did not test, such as protected accounts, other administrative tasks, or broader organizational delegation designs.
That makes the example credible without inflating it into a complete privileged-access deployment.
The Six-Figure IAM Career Playbook helps connect familiar IT skills with identity responsibilities and practical portfolio evidence. The $9 guide includes three core IAM lab directions and a 90-day plan for choosing the next useful step.
The useful weekend result is not another machine. It is a clear demonstration that administrative authority can be limited, tested, and explained.