Break the Hyper-V cluster on purpose, and watch every number move Start this lab

Why this matters

Knowing what a healthy cluster looks like is only half of it; the other half is knowing what each kind of damage looks like from the outside. Producing contention, paging, a lost storage path and a cluster without quorum on purpose — one change at a time, reading the counters after each — builds the recognition that makes a real incident short.

Concepts

Objectives graded

• Record the healthy baseline score before breaking anything.
• Give every machine on the first node 16 processors, then read the wait time and the ratio.
• Set 96 GB of static startup memory on each of those machines, then read the paging figure.
• Take the second path off ds-gold and read the latency.
• Remove the quorum witness and read what the baseline says about it.
• Make two changes the platform should refuse, and record its exact words.
• Revert everything with 'Revert to the start' and prove the baseline score came back.

MITRE ATT&CK coverage

Degrading a platform on purpose teaches the fingerprints of sabotage: contention, paging, a lost storage path and a cluster that can no longer hold quorum all look like faults, and an operator who has produced each one deliberately recognizes them when somebody else causes them.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20

• A reversible action passed through a human approval gate.

  safety · weight 15

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10

• The cluster was worked in the console rather than described from the ticket.

  investigation · weight 15

• The healthy state was recorded before anything was broken.

  investigation · weight 10 · T1082 System Information Discovery (Discovery)

• Processor contention was produced deliberately and measured.

  investigation · weight 10 · T1082 System Information Discovery (Discovery)

• The ratio behind the wait time was read as well as the wait time.

  investigation · weight 10 · T1082 System Information Discovery (Discovery)

• The memory failure mode was produced and measured, not assumed.

  investigation · weight 10 · T1082 System Information Discovery (Discovery)

• The cost of a single storage path was measured.

  investigation · weight 10 · T1046 Network Service Discovery (Discovery)

• The availability cost of removing quorum was read off the baseline.

  investigation · weight 10 · T1082 System Information Discovery (Discovery)

• A refusal was read and understood rather than worked around.

  configuration · weight 10 · T1078 Valid Accounts (Defense Evasion)

• The limit that cannot be configured away was recognized.

  configuration · weight 10 · T1078 Valid Accounts (Defense Evasion)

Common mistakes

• Breaking several things before reading any counters.
• Assuming a refusal is a bug in the console rather than a rule of the platform.
• Treating the quorum witness as optional because the cluster kept running without it.
• Leaving the range broken for the next person.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.