Welcome back to your free Active Directory training course. In this video I will look
at installing the first domain controller and thus creating an Active Directory environment.
Before you start setting up a domain controller using Window Server 2008, there are first
a few perquisites that you need to meet. Firstly you need to ensure that Windows Server 2008
has a static IP address. Next Active Directory requires DNS infrastructure
to work. If you don’t have any existing DNS infrastructure you can install Microsoft
DNS during the domain controller install. Later on in the course I will cover DNS
in a lot more detail. For the present I will install DNS with the domain controller accepting
all the defaults. This way I can concentrate on Active Directory. I promise that later
in the course I will cover DNS in a lot more detail.
Active directory requires DNS infrastructure but it does not have to be Microsoft’s.
If you have an existing DNS infrastructure like a UNIX based DNS you can use that as
well. The next perquisite that needs be meet for you first domain controller is that you
need to ensure that you are a member of the local administrators groups.
Once you are ready to install your first domain controller or add an additional domain controller
to any existing network, run the command dcpromo. The process of changing a server
into a domain controller is called promotion. It is common to for people to say I am going
to promote this server to a domain controller. I will now change to my Windows Server 2008
server to demonstrate the process of promoting a server to a domain controller.
I have already installed a fresh clean install of Windows Server 2008 R2 on this computer.
When the server boots up for the first time you be presented with the initial configuration
tasks screen. In order to make this server a domain controller I first need to assign
it a static IP address. To do this from the initial configuration
tasks, select the option configure networking. This will show all the network adapters on
your server. Form here opens the properties on the network adapter. In this case I will
configure an IP version 4 address, you could also configure an IP version 6 address or
both if you preferred. Domain controllers work equally well with either or both.
Notice that when I set the DNS servers IP address I have set it to 127.0.0.1.
This is the loopback IP address. This will direct all DNS queries back to this
server. Since I will install DNS at the same time I promote this server to a domain
controller this is not a problem. Once I exit out of the network configuration,
in the initial configuration tasks I also get the option to change the computer name.
If I go into here notice that I have already set the computer name to DC1. Changing the
computer name does require a restart. I would recommend changing the computer name and rebooting
the server before promoting the server to a domain controller. If you change the computer
name and don’t reboot the server, this may cause some problems with promoting the serer
later on. Right down at the bottom you have the option
add roles. This will launch the add role wizard. You could also get to this step by running
server manager from the start menu and selecting the option add roles.
Once past the welcome screen, select Active Directory domain services from the list of
roles. Active Directory Domain Services requires dot net frame work so you will be promoted
to add this as well. Once I next my way to the install part of
the wizard I am ready to install Active Directory domains services. Notice that I was not asked
any configuration questions, all I was given was an information screen about Active Directory
domain services. Just to prove a point I will now cancel the
wizard and thus not install the role. If I had finished the wizard the Server would not
have been promoted to a domain controller. Remember that to promo a server to a domain
controller you need to run the command dc promo. To do this I will open a command prompt.
Notice that when I run d c promo it will check to see if the Active Directory binaries are
installed and if not it will install them. The process does take a few minutes to complete.
If you know in advanced that you are going to promote a server to a domain controller,
often an administrator will install the Active Directory domain services role ahead of time
using server manager. By doing this you save time promoting the server to a domain controller
because you don’t have to wait for the binaries to be installed.
Since the process does take a few minutes I will fast forward the wizard. In this example
I will run the wizard in basic mode. Notice that you have the option use advanced mode
installation. Later on in the course I will over these options, in this example I will
keep it simple and stick to basic mode. On the next screen you have warning about
old NT style cryptography and Windows Server 2008. This is only a problem if you have Windows
NT computers or devices that use old style cryptography. Microsoft has raised the bar
with Windows Server 2008 in regards to the cryptography that it supports. By default
these old clients will not be able to use a Windows Server 2008 domain controller.
On Windows Server 2008 you can change some settings so that older clients can use Windows
Server 2008. On Windows Server 2008 R2 these clients are not able to use Windows Server
2008 R2 by design. You can’t change a setting and enable them.
Once past this warning screen you need to decide if these servers are joining an existing
forest or creating a new forest. Since this is the first domain controller that I am deploying
it will be in a new forest. Next I need to type in the FQDN or fully
qualified domain name for the domain. In this case I will use ITFreeTraining.local.
In this case I could also use ITFreeTraining dot com since I own the domain name. The choice
of a public domain name or a private domain like dot local will be different depending
on the companies security needs. Using dot local offers more security because it can’t
be resolved from the internet. No DNS server on the internet will be able to resolve this
domain name back to a client. If you use a dot com address, the problem
occurs because you are probably going to have some hosts that need to be resolved by computers
on the internet. Mostly likely addresses like www and your mail servers. When you use
the same DNS name space for the computers on your internal network as your public computers
you risk the DNS records for your internal network being captured by an external party
if you don’t secure them correctly. Whether or not you feel this is a big risk is up to
you. Active Directory also supports adding UPN
or universal principal names. Using a UPN you could create a domain name like dot
local and add a dot com UPN. The UPN would allow the user to login using the dot com
address. For example, joe@ITFreeTraining dot local could login using this address or
using joe@ITFreeTraining.com. Either address will work just as well.
The advantage of using UPN’s is that all your DNS records in your domain will still
be using the dot local address. If a hacker was to get hold of your DNS records, if
designed correctly, they would only be able to get hold of your public DNS records and
not the internal DNS records used by your company.
Once Windows verifies that no other domain controllers are on the network using the same
name the wizard will move on. The forest function level I will talk about later on in the course.
For the present know that you can raise a forest level to a higher level but you can’t
go back. The higher the forest level the more features.
Currently the forest level is set to Windows Server 2003. This means that only Domain controllers
that are Windows Server 2003 or above can be added to this forest. If you are not sure
what setting to use set it low, you can always raise it later. The choice of forest level
only effects domain controllers. Regardless of which setting you use has no bearing on
which computers you can use on your network. On the next screen is the domain functional
level. The same applies to the domain function level, you can raise it but you can’t lower
it. We will talk more about forest and domain functions level in a later video. If you are
not sure select the lowest level. You can always raise it later. Just remember the domain
level you set here determines which domain controller operating systems you can add to
the domain. On the next screen you can select to install
Microsoft DNS server at the same time the server is promoted. Since this is the first
domain controller I can’t set any additional options. Later in the course I will go over
these options. If you were using an existing DNS infrastructure you could de select the
DNS option. Once I press next I will get a warning message.
This message states that Windows could not find a delegation for the DNS zone. In simple
language this means that no DNS zone could be found for IT Free Training. Since DNS
has not been installed yet this is to be expected. When Active Directory is installed it will
create the missing DNS zone for you automatically. The next screen will ask you where you want
to store the Active Directory database. In this case I will leave them on the same hard
drive. On a busy domain controller you may want to consider putting the database on a
separate hard disk. You could also put the log files on a separate hard disk if you wanted
to. The log files record changes as they happen allowing the database to be recovered if the
hardware was too suddenly crash. The next option is the sys vol folder. This
folder contains all the login scripts and group policy settings for the domain. This
data is replicated throughout the domain to every domain controller in the domain. In
most cases you will leave this on the defaults. The next screen will ask you for a directory
services restore mode password. This password is different from any other username and password
on the system. It does not allow you access to the domain or to any services. It is included
to provide access to the database for recovery tools when things go wrong. It kind of provides
a back door if you will. In a later video I will go through how to use this password
with the recovery tools. For the present, choose a password that you are going to remember.
The next screen of the wizard gives you a summary of all the settings that you have
configured. Notice that I have an export settings button. When I press this button I can save
the settings that I used for this install to a file. If you are planning on installing
anther domain controller later on, you can use this file to automate the install so you
don’t have to answer all the questions in the wizard again. This file I will also use
in the next video installing Active Directory on server core.
Once the settings have been exported and I press next, Active Directory domain services
will now start installing. The process of installing Active Directory for the first
time does take some time to complete. You have the option to automatically reboot the
server once the complete, however I will leave this clear and speed up the video to the end.
The wizard took about 5 minutes to complete. I now reboot the server and return once it
has started back up again. Once the server has rebooted and I have logged
back in again, notice that once again I am taken to the initial configuration tasks screen.
Notice at the bottom the roles DNS server and Active Directory domain services have
now been installed. Since I have finished with the initial configuration
of this server, I will tick the box do not show this window at logon and close initial
configuration tasks. When I close this window, Windows will automatically open server manager.
From server manager, if I select roles I can see the Active Directory domain services roles
administration section. Under this is the section Active Directory users and computers.
Active Directory users and computers is where you can add and remove users from the domain.
This tool can also be run from the start menu under administrative tools without the need
to open server manager. Server manager however does group a lot of tools together making
it easier to configure your server. If I open users I can see all the default
users that are present in this domain. One thing that I want to point out is if I open
local users and groups from the start menu. If you have configured local users on Windows
Server or clients like Windows 7 you would have used a tool like this one.
Once I open the local users and groups notice that I get an error message. When you promote
a server to a domain controller the local users on the domain controller are no longer
available. This only happens on domain controllers. Local users are not as secure as domain users
and disabling the local users help protect the domain controller.
Without local users, if you need to give access to a folder or resources on a domain controller,
you would simply use a domain user or group rather than a local user or group.
If I now open Windows explorer and open the Windows folder and the sub folder NTDS,
this is where the Active Directory database is stored. Notice the file ntds.dit.
This is essentially the heart of Active Directory. Notice there are also a number of other files
in this folder as well. These files are the log files. These don’t hold Active Directory
data but can be used to help recover Active Directory if there is a problem.
If I go back a directory and open the Sys vol folder, this is the folder that contains
all the login scripts and group polices. This folder is replicated to all domain controllers
in your domain. Notice under the domain folder you have the folders polices and scripts.
Polices holds group policy while scripts holds login scripts. In most cases you won’t have
to edit data directly in there. Microsoft supplies a lot of tools that edit the files
directly for you. In some troubleshooting scenarios it pays to understand where these
files are located. If I now go back to server manger there is
section just for Active Directory domain services. This will show you any events that have been
generated and the services used with Active Directory. There is also a section for documentation
including best practices. The service that I would like to point out
in particular is Active Directory domain services. This service can be stopped and Active Directory
will be stopped. This means that Active Directory can be restarted without having to reboot
the server. Previously you would need to reboot the server to restart Active Directory.
Now that I have installed my first domain controller and thus created a domain, the
next step is to add a second domain controller. This will be the topic of the next video in
which I will install Active Directory on Server core.
For the rest of this course please have a look at our web page or you tube channel.
Once again, thanks for watching.