Microsoft Windows Server 2008 R2 : Installing and configuring Active Directory domain services

We will now walk through installing and configuring AD DS for a new domain. This process involves adding the AD DS role and then running the dcpromo process. After installing AD, we will explore postinstallation steps. To install AD domain services, perform the following tasks:

1. Log on to the server with an account with local administrator rights.

2. Open Server Manager and then click on the Roles node in the left pane; then click the Add Roles link. This will launch the Add Roles Wizard. Click Next.

3. Select the Active Directory Domain Services option. You will be prompted to add .Net Framework 3.5.1 Features. Click Add Required Features; then click Next to continue. You will be taken to the AD introduction page. Click Next to continue.

4. Confirm that you do want to install AD DS and then click Install. After the install completes, you should see a success confirmation page. Verify whether the install was successful, then click Close.

Now that the AD role has been installed, you need to perform the dcpromo process which will promote the server to a DC. Go to Start | Run. Type dcpromo in the run box and then click OK. This will launch the AD DS Wizard.

1. At the Active Directory Domain Services page (see Figure 1), click Next to begin.

   

   Figure 1 Active Directory Domain Services Wizard.

2. You will be taken to the OS compatibility page. Click Next to continue.

3. You must now choose whether this DC will be part of an existing forest or used to establish a new forest (see Figure 2). For our example, choose Create a new domain in a new forest since we are creating a new forest and domain. Click Next.

   

   Figure 2 Create a New Active Directory domain.

4. You now need to enter the FQDN for the new domain. Enter it into the text box as seen in Figure 3, then click Next. The wizard will then verify that the chosen domain does not already exist on the network.

   

   Figure 3 New domain name.

5. You now need to select the Forest Functional Level to use for the new forest being deployed. If you are building a new domain that will only use Windows Server 2008 R2 DCs, you can select the Windows Server 2008 R2 functional level (see Figure 4). Then click Next.

   

   Figure 4 Choosing Forest Functional Level.

6. You can now select whether you want to include DNS as part of the install as well as set the option to designate it as a GC (see Figure 5). Since this is the first DC in a new domain, it is required to be a GC. If you were adding a DC to an existing domain, you could optionally check the option to make this an RODC. Ensure that the option for DNS is selected, then click Next.

   

   Figure 5 Select DNS, global catalog, and Read-Only DC options.

7. If you receive a warning like the one in Figure 6, click Yes to continue. This warning is notifying you that you should ensure you own the domain you are using for AD.

   

   Figure 6 Active Directory DNS zone warning.

8. You now need to select the drive and path to install AD files (see Figure 7). In most simple installations, you can accept the defaults; however, you may choose to install the AD Database, Log Files, and SYSVOL folder on different disk drive spindles providing better performance. After selecting the paths to install AD files, click Next to continue.

   

   Figure 7 Active Directory File locations.

9. In the next step, you need to create a Directory Services Restore Mode password. This password is used to access the system when you boot it into Active Directory Services Restore mode. Be sure to use a strong password and keep it somewhere safe. You will be required to create a Directory Services Restore Mode password for each DC you install. Click Next to continue.

10. Verify the AD options on the summary page, then click Next to start the dcpromo process.

11. During dcpromo, you can monitor the process from the wizard window as seen in Figure 8.

    

    Figure 8 Active Directory dcpromo in progress.

12. After the dcpromo process completes, you will be taken to the Completing the AD DS Installation Wizard page. Click Finish to complete the wizard.

13. For the dcpromo process to complete, the server needs to be rebooted. Click Restart Now at the restart prompt as seen in Figure 9.

    

    Figure 9 Restart after dcpromo.

When the server restarts, it will restart as a DC in the new domain. Log on to the server with the same credentials used for the administrator account when the server was in a workgroup. The local administrator will have now been promoted to the domain administrator account.

If you open Server Manager, you should now see the AD DS and DNS roles listed under the Roles node. By expanding the AD DS node, you will see two subnodes named ADUC and AD Sites and Services (see Figure 10).

Figure 10 Active Directory Role.

By running the BPA, you can clear up any additional configuration tasks that are necessary and ensure that no major problems are found with your fresh installation. The initial run of the BPA will flag a few issues that should be corrected immediately. These include:

• The PDC emulator in this forest should synchronize with a valid time source—As a best practice, you should synchronize your PDC emulator with an Internet time server. The BPA will give you the command w32tm/config/computer:<name of your DC>/manualpeerlist.time.windows.com/syncfromflags:manual/update

• The domain has only one functioning domain controller—You should immediately deploy a second DC for redundancy. With only one DC deployed, a DC failure would cause your entire domain to be offline. To add a second DC, perform the following tasks:

  1. Set up a new Windows Server 2008 R2 server.

  2. Set a static IP address and set the first DC as the primary DNS server.

  3. Install the AD DS role and run dcpromo.

  4. When prompted, select the option Add domain controller to an existing domain.

  5. Select the existing domain name.

This will promote the DC into the existing domain. You should then be able to log on to the new DC as the domain administrator account setup when promoting the first DC. You can perform the aforementioned steps for each additional DC you want to add to the domain.

• The directory partition has not been backed up—You should set up backups as soon as possible after performing the dcpromo process. To backup AD, backup the system state on the server.

After correcting the aforementioned initial issues, run the BPA again to ensure they were properly corrected. Once you have resolved BPA issues, you should have a reliable and supportable Active Directory Domain.

The task you will need to complete is setting up your initial AD site. Even if you currently have only one site, you should define the subnets to properly set up AD's site configuration.