Here we go again for anther free video for the free Active Directory course. In this
video I will look at promoting Windows Server 2008 core to a domain controller.
Windows Server 2008 besides the different editions like standard and enterprise comes
in the full and core editions. Server core is a scaled down version of Windows Server.
It has a lot of the same features as the full edition however the major difference is it
has a limited GUI. To perform administration on the server you
need to do it from the command prompt. Server core does support remote desktop, however
when connect to server core by remote desktop you will still get a command prompt.
Server core does support remote administrator tools. If you for example installed DHCP
on a server core computer, you could administrator DHCP remotely using the DHCP admin tool.
Another advantage of server core is that it has a smaller attack surface. The attack surface
is the software or hardware that a hacker could use to hack into the server. Since the
GUI is limited there is less software running on the server. Less software also means less
updates need to be installed on the server. Less software also means less resources running
like memory and CPU. On a busy network you may want to consider
installing a domain controller on server core to try and get more performance. You may also
use server core if you are worried about security. The problem with promoting a server to a domain
controller on server core is that the limited GUI can’t display the wizard for dcpromo.
To get around this, you can use an answer file or specific the options in the command
line. I will now change to my windows server 2008 computer to demonstrate how to promote
a server to a domain controller that is running server core.
This is a fresh install of Windows Serer 2008 enterprise core. Nothing has been configured.
If I run the command echo percentage computer name percentage I will get the computer name.
This is currently set to the random name that Windows assigns the server when it is first
installed. To change this, run the command netdom rename
computer. The netdom command can be run from this computer or a remote computer. For this
reason you need to enter in the computer name. Rather than type in the random string of characters
that Microsoft set to the computer name I will enter in local host.
Next I need to add slash New Name colon and the name of the server which in this case
will be dc2. The computer name is now changed and the server needs to be restarted. I will
make a few other changes before restarting it. It is recommended that you always complete
a name change by restarting the server before promoting a server to a domain controller.
In order for this server to can contact anther domain controller to replicate the Active
Directory database I need to configure an IP address. First I will run the command
netsh interface IPv4 show interfaces. Each interfaces has a name, the default for
the first network connection is local area connection. Rather than typing in a long interface
name like this I will look at the left hand side and get the index number for that connection
and use that in future commands. In this case local area connection has an index number
of 21. The next command that I will run is netsh
interface IPv4 set address. This will set the IP version 4 address for the network
adapter. Next I need to add name equals 21 for the adapter or I could have also put in
local area connection. Following this I need to add source equals static. If I wanted to
use DHCP I could have put in source equals DHCP, remember that for a domain controller
you need at least one static IP address. After this I finally get to put in the IP
address, subnet mask and gateway with the arguments address, mask and gateway.
Next I will set an IP version 6 address. The command starts out much the same,
netsh interface IPv6 set address. After this the name parameter changes to interface equals
21. Next I need to enter in address equals and the IP version 6 address.
Now that I have an IP address on the network adapter I next need to configure the DNS
servers. This is once again done with netsh interface IPv4 followed by add dns
server to tell netsh I am configuring a dns server. After this, once again I need
to put name equals 21 for my network adapter and then address equals and the IP address
of my first DNS server. In this case I will put the IP address of my first domain controller
dc1. It is important to set a DNS server that hold DNS records for that domain otherwise
the promotion to a domain controller will fail.
Windows can have multiple DNS servers so next you need to set which DNS entry that
you want to change. In this case I will set the first one with index equals 1.
Since I will also be installing DNS on this server as well, I will recall the last command
by pressing up and changing the address to the loop back connection 127.0.0.1
I will also add index equals 2 to the end to change the second DNS server entry.
Notice when I run this command I get an error message saying that the DNS server is incorrect
or does not exist. What has happened is that Windows has attempted to contact the DNS
server and has not got a response. This is to be expected because I have not installed
DNS as yet. The second DNS server will still get added regardless so it is safe to
ignore this message. If I want to see which roles are already installed
on this server I can run the command oclist. I still add the pipe more switch so that output
will stop once the screen is full. I could install the DNS role when I promote the
server but sometimes it is easier to install the role separately. When you use the gui
interface it is easy to tick the correct tick box to install the DNS role. When you use
the command line or an answer file it is easy to overlook this as you will see.
Notice the role is listed as DNS Server Core Role. It is important to take note of
correct spelling, upper case and lower case letters and the use of hyphens or the next
command will not work. To install the DNS role, run the command start with the w switch.
The start command will run anther command and the w switch will ensure that Windows
waits until the install is complete. Without the w switch Windows would return back to
the command line without any delay and you would not know when the install is complete.
After the w switch enter the command that you want to run, in this case ocsetup and
the DNS role. Make sure that you use the correct spelling including correct case and
hyphens. The DNS install does take a few minutes to complete so I have speed up the
process. You won’t be given any messages telling you the install was successful but
you know it has complete due to you been given back control of the command line.
Before I promote the server to a domain controller I need to reboot it so the name change I did
before will take effect. I can do this with the command shutdown slash r slash t 0. This
tells windows to reboot the server and wait for 0 seconds before doing so.
Once the server has rebooted I will run the command IP config slash all pipe more to
check the changes. At the top you can see that the host or computer name has changed
to dc2. Down further you can see that network configuration like IP addresses and DNS
server have also changed. There are two ways you can promote a server
to a domain controller. Using an answer file or using the command line. First I will look
at using an answer file. To do this I will map a drive to my other domain controller.
In the previous video I exported the dcpromo settings to a text file. This text file I
will copy to this computer. Once copied I will open the file in notepad
one of the very few gui based software that works on server core. This file was created
based on being the first domain controller in the forest. Since I am installing an additional
domain controller in the same domain some changes needs to be made to the file before
I can use it. If I was to use this file the install would fail.
If you would like a full list of options for this file, please look up Microsoft KB article
947034. First of all I need to change the top setting replica or new domain. Current
this is set to domain, since this is another domain controller in the same domain I need
to change this to replica. Replica simply means anther copy of an existing domain controller.
The next option below this is new domain. Since this is not a new domain I will comment
this line out by putting a semi colon at the start of the line. Below this is the option
New Domain Name, this needs to be changed to replica domain DNS name since we are
adding a domain controller to an existing domain.
Next I need to add the domain, user name and password for an account that has access to
add domain controllers to that domain. This account will need to be a member for the domain
administrators group. For new domains it will need to be a member of the enterprise administrators
group. The user account is added with the user domain, user name and password options.
The last option that I need to set is the Safe Mode Admin password. This is used to
recovery Active Directory and boot Active Directory into recovery mode. One point I
will make with passwords is Windows will edit this file after you use it and remove all
the passwords. This is done so if the file falls into the wrong hands after you use it
they won’t know what passwords you used. Once I exit and save the file I can now run
dcpromo with the slash unattended switch followed by colon and the file name for the
answer file. If I were to now press enter this server would be promoted to a domain
controller using the answer file to answer any setup questions.
Creating an answer file will allow you to promote a server core computer to a domain
controller, but let’s face it creating an answer file can be a lot of work especially
if you had to create it from scratch. Once point I will make is that all the options
I used in the answer file can be added to the command line so you don’t have to make
an answer file at all. To demonstrate this, I will use all the options in the answer file
as command line switches. First I will add slash replica or new domain
colon replica. This tells dcpromo that this additional domain controller in an existing
domain. Like the text file, I will add slash replica domain DNS name colon and the domain
name ITFreeTraining.local. The next switch I will add in slash confirmGC colon
yes. I did not change this in the text file as it was already present. What this does
is makes the domain controller a global catalog server. I will cover global catalog servers
in the next video so don’t worry if you don’t understand how they work quite yet.
Next I will add the switches for user domain, user name and password with a user that has
permissions to add domain controllers to the domain. Lastly I need to add the Active Directory
recovery password. Once I press enter the server will be promoted
to a domain controller. Like the gui version Windows will check to see if the binaries
are installed, if not it will install them for you. The process does take a few minutes
but once complete the server will connect to anther domain controller and start replicating
the Active Directory database. The process takes about 5 to 10 minutes to complete so
I fast forward the video to the end. Once complete the server will reboot.
When the server returns from reboot it will now be a domain controller. Notice also that
the server was automatically added to the ITFreeTraining domain. If the server was
already part of the domain it could be promoted as well. Windows will simply add it to the
domain if it needs to be. We hope you have enjoyed this video on promoting
a server core computer to a domain controller. In the next video I will look at the global
catalog server in more detail. The global catalog server works as index in Active Directory.
Once again thanks for watching.