Domain Restructuring Designing RODC

Transcription

1 Domain Restructuring Designing RODC Introduction: This document will describe design decision to implement Read Only Domain Controller in the existing Active Directory Forest. The infrastructure is assumed to have the fully operational Active Directory forest which is hosted on Microsoft Hybrid cloud infrastructure. Requirement: Sun-Corp is a car manufacturing organization and hosts their infrastructure in New South Wales. There are 3 major sites connected with high speed LAN, the infrastructure is hosted on Microsoft Hybrid Cloud infrastructure. The Headquarters is in Sydney followed by Secondary site in Melbourne and stand by site in Perth. Sun-Corp is currently expanding their infrastructure and would like to add additional Read Only Domain Controllers to their existing Active Directory Forest. With data security as prime consideration, Sun-Corp has proposed the idea of installing RODC ( Read only Domain Controller ) in their infrastructure. Sun-Corp is engaging AVA, a Microsoft Premier Consulting firm to perform the domain restructuring. AVA will conduct initial assessment of the infrastructure and provide the detail design plan. Solution Diagram:

2 ISP ISP ISP ISP GW 3845 GW 3845 L L LB 4710 L L LB 4710 LB 4710 L L Main Link RWDC RWDC Server Farm BackUp Link RODC Server Farm SQL RODC Headquarters Sydney Melbourne Perth AVA will provide the professional services to install and configure the Read Only Domain Controllers in Melbourne and Perth sites respectively. Technical Diagram:

3 Application Write Request Password Changes SPN Updates Last Logon Time Stamp Read Write DC Replication DFS Replication Read Only DC RODC Sends Referral Application Writes To RWDC User Application Server Solution Overview: AVA approach to the solution involves Enterprise methodology for installing and configuring Read Only Domain Controller in the existing Active directory forest. AVA uses Microsoft premier standards, Microsoft Operations Framework and proven methods to perform the task. AVA uses Sun-Corp Service desk utilities to leverage on the change requests and the follows the procedure defined by Flex-Corp. The solution is designed and implemented on Microsoft Hyper-v virtualization stack and AVA consulting to provide the Server requirements, Firewall ports requirements, Name-Space requirements, and Accounts privileges. AVA will follow the existing server hardening rules provisioned by Sun-Corp.

4 Advantages of Staging Read Only Domain Controller: Following are the advantages of staging the RODC in any Active Directory infrastructure. AVA has outlined few of the major advantages for introducing the RODC. a) Password Replication Policy ensures more security in case of compromised scenario. b) Unidirectional replication should be enabled from Melbourne (RWDC )to Perth (RODC) which provides enhanced security for the data on the Read Only Domain Controllers. In the event of RODC compromise, no data can be retrieved c) Enterprise applications can point to specific RODC and restrict their replication of data to other RODC, this ensures that critical and secured Applications data will not write to RODC. Pre-requisites: AVA assumes that following are provisioned by Sun-Corp respectively a) Provision of Virtual Servers which includes Hardware, Network and Memory is configured by Sun-Corp professionals. b) Installation and Configuration of the Windows Server 2012 (Full edition) Operating System is performed by AVA consultants c) Network devices and ports are configured by Sun-Corp engineers and ensure the firewall ports are opened for Domain Controller communications across the sites. d) Remote Monitoring for the servers are provisioned and desired firewall ports are enabled for AVA consultants to access the servers on different farms e) Ensure the patching of the servers are compliant with the Sun-Corp standards f) Ensure the auditing of the servers is performed prior installing of the Domain Controller. g) Ensure all the relevant applications (eg: Anti-virus ) are installed and configured on the server which is going to get promoted as Read Only Domain Controller. Assumptions: - This document will not provide detail step-step visual information about the installation of the RODC - This document will provide best practices to install the RODC RODC Considerations: a) As Perth datacenter is not vulnerable, AVA will not install Bit locker on the RODC. If the Bitlocker is installed, for every OS patch, the Server needs to be restarted. b) The RODC approach is based on Direct Approach and not Staged Approach.

5 c) RODC should never be deployed in the site which has RWDC installed. Installation Steps Following are the installation steps for staging Additional Domain Controller on the Sun-Corp Data Center 1) Check the Domain Controller Server Virtual Machine RAM which should be 4GB or more, VLAN trunk validation, volumes configured and Service Pack levels for the Operating system. 2) Check the basic networking connectivity on the Server and ensure the server is opened for the following Ports Protocol and Port UDP 389 TCP 636 TCP 3268 TCP 3269 UDP 88 UDP 53 UDP 445 AD and AD DS Usage Forest Level Name Resolution, Replication, User and Computer Authentication, Group Policy, LDAP LDAP SSL LDAP GC LDAP GC SSL Kerberos DNS TCP 25 Replication SMTP TCP 135 Replication RPC, EPM TCP Dynamic Replication, User and Computer Authentication, Group Policy, Type of traffic SMB,CIFS,SMB2, DFSN, LSARPC, NbtSS, NetLogonR, SamR, SrvSvc RPC, DCOM, EPM, DRSUAPI, NetLogonR, SamR, FRS TCP 5722 File Replication RPC, DFSR (SYSVOL) UDP 123 Windows Time, Windows Time UDP 464 Replication, User and Computer Authentication, Kerberos change/set password

6 UDP Dynamic UDP 138 Group Policy DFS, Group Policy TCP 9389 AD DS Web Services SOAP DHCP DCOM, RPC, EPM DFSN, NetLogon, NetBIOS Datagram Service UDP 67 and UDP 2535 UDP 137 TCP 139 Note DHCP is not a core AD DS service but it is often present in many AD DS deployments. Replication DHCP, MADCAP NetLogon, NetBIOS Name Resolution DFSN, NetBIOS Session Service, NetLogon 3) Ensure the Read Only Domain Controller is configured with Static IP address. Validate the subnet mask and Default gateway configured on the server Strictly no multi home networks 4) Ensure the account provisioned to promote the server has required permissions to install the Domain Controller The user should be part of Domain Admin groups ( enterprise admin groups is not recommended) 5) Verify that the disk partition is formatted with NTFS 6) The Server which you are promoting should point to Forest Root Domain Controller which is the Primary DC for DNS server 7) Verify the DNS records using NSLookup before promoting the server 8) Use PortQry to get the Port status ( Opened / blocked ) and raise the request to open the ports if blocked. 9) Launch dcpromo from the command prompt ( DCPROMO/adv will be used when creating Domain controller using backup ). 10) Configure the DNS settings and complete the installation. Ensure Dynamic updates are enabled on the DNS zone. 11) Select the RODC option during the installation and join to Melbourne FRD name space

7 12) If the RODC is installed in different subnet as compared to FRD or parent domain controller, the logical route should be enabled in Active Directory using Active directory sites and services by Creating Subnet, site object and map the Server object accordingly 13) Post server configuration, necessary application queries can be directed to the new Active Directory Domain Controller. 14) Server hardening should be performed by ensuring the necessary groups to be created and privileges are configured to allow certain groups to have access privileges on the RODC. Do Not : a) Install SQL server on Domain Controller b) Install Sharepoint server on Domain Controller c) Install PKI root CA on the Domain Controller d) Install Hyper-v on the domain controller e) Install Exchange server on domain controller.