Here is an uncomfortable ranking. If you sorted every topic in an IT support course by how often an entry-level tech touches it on the job, Active Directory would sit at or near the top. Password resets, lockouts, group membership, access requests: that is tier 1’s daily bread, and it is all directory work.
Now sort the same topics by how hard they are to teach hands-on in a classroom, and AD lands near the top again. It needs a domain, which traditionally needs Windows Server, which needs hardware, licensing, and someone to keep the whole arrangement alive between semesters. Many programs quietly resolve this tension by teaching AD from slides. The students then meet a real directory for the first time during a job interview, which is a bad time to meet anything.
The tension is solvable. Here are the actual options.
Windows Server in virtual machines
The classic move: students run Windows Server in a VM, promote it to a domain controller, join a client VM to the domain, and suddenly the diagram from the lecture is a thing they built. Evaluation licenses make the software cost effectively zero, and building a domain from scratch teaches things no other format does.
The cost is everywhere else. Each student needs a machine with the RAM to run two Windows VMs at once, which rules out most Chromebook rooms on the spot. And you inherit a fleet of student-built domains in various states of disrepair, because a domain a student built wrong in week three fails mysteriously in week nine. If your hardware can carry it, it is a genuinely great capstone. As the daily driver for a semester, it is a part-time job you were not hired for.
Cloud VMs
Same lab, hosted on Azure or AWS, so student hardware stops mattering. Education credits can cover a surprising amount of it, and it sidesteps the broken-laptop problem entirely.
What it does not sidestep is billing anxiety. Cloud VMs cost money while running, students forget to deallocate things, and the failure mode is an instructor refreshing a billing dashboard at 11pm. There is also real setup friction per student, enough that the first two weeks of the unit risk becoming a course about cloud portals instead of directories.
A simulated directory
The third option drops “students build the domain” and keeps “students work in one.” The simulator ships a working Active Directory already populated with users, groups, and machines, wired to a company of simulated employees who generate the tickets. A user calls about a lockout; the student finds the account, sees the locked state, unlocks it, and the caller confirms they are back in. Group membership questions arrive attached to a person who needs access, not as step 4 of a worksheet.
What students lose is the experience of promoting a domain controller, which, for a support course, I will argue is fine: tier 1 techs administer within directories, they do not build them, and even Group Policy reaches them as something to recognize and diagnose rather than author. What students gain is volume. Fifty lockout tickets with a human-shaped reporter attached is better interview preparation than one hand-built domain, because the questions they will actually face are about resolving directory tickets, not forest design.
It also runs in a browser on whatever the room has, resets itself, and gives you a per-student dashboard instead of a grading pile.
What I would actually do
If your program has the hardware and you have the maintenance appetite, run the VM build as a capstone unit; nothing else delivers that particular understanding. For the weekly hands-on hours where students need directory reps, the classroom simulator is the option that works on any hardware and costs you no evenings. A 7-day trial with a real class comes with your quote, no card, and setup is one lesson. The slides, at last, can go back to being the supporting material instead of the whole lab.