Creating a New Domain Tree in the Forest

Transcription

1 Creating Domain Trees and Forests 163 Creating a New Domain Tree in the Forest 1. Open the Active Directory Installation Wizard by clicking Start Run, and typing dcpromo. Click the Use Advanced Mode Installation box. Click Next. 2. On the Choose a Deployment Configuration page, select Existing Forest and then click Create A New Domain In An Existing Forest. Check the box Create a new domain tree root instead of a new child domain. Click Next.

2 164 Chapter 4 Installing and Managing Trees and Forests 3. A warning box might appear stating that the local administrator account becomes the domain administrator account for the new domain. If it appears, Click Yes to continue. 4. On the Network Credentials page, specify the full name of the domain that you installed in the previous chapter. Click the Set button and enter the username and password for the domain administrator of a domain in the forest you wish to join. Click Next. 5. On the Name the New Domain Tree Root page, you need to specify the full name of the new domain you wish to create. Note that this domain may not share a contiguous namespace with any other existing domain. Once you have entered the appropriate information, click Next.

3 Creating Domain Trees and Forests On the Domain NetBIOS Name page, you are prompted for the NetBIOS name of the domain controller. This is the name previous versions of Windows use to identify this machine. Choose a name that is up to 15 characters in length and includes only alphanumeric characters. Click Next to continue. 7. If the Select A Site screen appears, choose any site and click Next. (You may not have any sites created on your forest. This server will then be added to the DefaultFirstSite.) 8. On the Additional Domain Controller Options page, make sure DNS Server is checked and click Next.

4 166 Chapter 4 Installing and Managing Trees and Forests 9. If a delegation for DNS message appears, click Yes. 10. The Source Domain Controller screen appears. Click the button labeled This Specific Domain Controller and highlight the domain controller that you created in Chapter 3. Click Next. 11. On the Location For Database, Log Files, And SYSVOL page, specify the database and log locations. These settings specify where the Active Directory database resides on the local machine. Click Next.

5 Creating Domain Trees and Forests In order to be able to recover this server in the event of a loss of Active Directory information, you need to provide a Directory Services Restore Mode Administrator password. This password allows you to use the built-in recovery features of Windows Server 2008 if the Active Directory database is lost or corrupted. Enter P@ssw0rd, confirm it, and then click Next. 13. On the Summary page, you are given a brief listing of all of the choices you made in the previous steps. Click Next to continue. 14. The Active Directory Installation Wizard automatically begins performing the steps required to create a new domain tree based on the information you provided. Note that you can press Cancel if you want to abort this process. When the setup is complete, you are prompted to reboot the system. Go ahead and do so, and once the process is finished, you will have a new domain tree. Adding Additional Domain Controllers In addition to the operations you ve already performed, you can use the Active Directory Installation Wizard to create additional domain controllers for any of your domains. There are two main reasons to create additional domain controllers: Fault tolerance and reliability You should always consider the theory of disaster recovery (DR) and have a plan, sometimes referred to as a Disaster Recovery Plan (DRP). If you re part of one of those organizations that rely upon their network directory services infrastructures, you need Active Directory to provide security and resources for all users. For this reason, downtime and data loss are very costly. Through the use of multiple domain controllers, you can ensure that if one of the servers goes down, another one is available to perform the necessary tasks, such as user authentication and resource browsing. Additionally, data loss (perhaps from hard disk drive failure) will not result in the loss or unavailability of network security information since you can easily recover Active Directory information from the remaining, still functional domain controller.