Sysadmin

From an admin perspective one of the best things to lab out is setting up a standard SMB server stack, which is 2x domain controllers, 2x DHCP servers, a file server, and a couple of desktop VMs, then practice setting it up to be nicely locked down like in a standard corporate environment. For example:

• redirect user directories to the file server and set permissions so only the user, admins and departmental managers can access files
• setup departmental directories on the share with departmental and managerial permissions
• setup group policies to lock down the desktops so that users just get a standard experience

But also make sure to set this up both in Windows Server with the full "Desktop Experience" as well as on Windows Server Core, and try to do so while following best practices with redundancy, network segmentation, etc. you could even get fancy and setup a remote site with redundant servers and replication to the remote site as well to experiment with how that works.

Then of course, once you have your virtual SMB network setup, try to break it. Fill up some of the VMs so it's out of disk space, corrupt one of the VMs and try to recover it, power off the servers when you shouldn't, cut some important virtual Ethernet connections and leave them severed for a while, or degrade the virtual ethernet connection and see what happens, delete the only domain controller and see what the best path to business continuity is, etc.

This covers a lot of the tickets and critical failures you'll see on a standard SMB network and will give you a good amount of exposure to a lot of what you'll work with in the "real world"