Ludus Defender Lab

Ludus range config and Ansible roles for a Windows security lab pre-staged for MDE and MDI, with a fully misconfigured ADCS installation for detection coverage testing.

Requirements

• Ludus installed and configured
• LUDUS_API_KEY set in your environment
• VM template: win2022-server-x64-template

Deploy

# Install roles (run on Ludus host with API key set)
cd roles/
./install-roles.sh

# Set config and deploy
ludus range config set -f zsec-mde-mdi-lab.yml
ludus range deploy

MDE and MDI are not auto-installed. Onboard both from security.microsoft.com after the range is up:

1. MDE — Endpoints → Device management → Onboarding → Windows Server 2022. Run the onboarding script on both DC01 and WKS01.
2. MDI — Settings → Identities → Sensors → Add sensor. Download and run the sensor installer on DC01.

# Snapshot after onboarding so you can revert without repeating the process
ludus range snapshot create --name post-onboarding

Environment settings

Environment-specific values (domain name, passwords, hostnames) appear inline throughout the config. A reference table at the top of the file lists every value and where it's used — update with find-and-replace before deploying.

Shared MDE prerequisite settings live in global_role_vars (applied to all VMs). DC-specific overrides live in DC01's role_vars and take precedence automatically.

Compound FQDNs in dns_rewrites and SPN strings need updating separately.

Roles

All roles live in roles/. The install script handles everything.

Community role installed via Ansible Galaxy: badsectorlabs.ludus_adcs (DC01).

Credits

enable_asr and enable_mdi_gpo are derived from @curi0usJack's work at curi0usJack/Ludus-MDE-MDI-Roles. This repo extends those roles into a unified DC↔WKS setup and adds the ADCS misconfiguration layer, MDE prerequisites hardening, WEF pipeline, and additional roles.

AD CS lab is a snippet from my course