My lab has no Windows in it, and a directory should not be the reason to add some. FreeIPA gave me a Kerberos realm and an internal CA on a thin client, and a DNS migration that took the longest.
Flipping msDS-SupportedEncryptionTypes is one line. I have never once been nervous about the line. I am nervous about the call two days later: a nightly job stopped, and nobody can say why. The attribute is trivial. The blast radius is not.
My AD test environment module still had service account passwords sitting in plain text. This adds PowerShell SecretStore for setup, storage and retrieval, without making the lab harder to spin up.
A PowerShell module that fills a lab domain with a thousand-plus realistic users, groups and OUs in about a minute, and tears them back down cleanly when you are done.
Deleting an AD account does not remove the security references pointing at it; they sit in ACLs as orphaned SIDs. An over-engineered PowerShell solution to find them at scale, with batching, logging and full test coverage.
Kerberoasting depends on RC4 still being available. How to inventory encryption types across the domain and automate the move to AES without locking anyone out.