Installing Active Directory

Installing Active Directory 119 Installing Active Directory Installing Active Directory is an easy and straightforward process as long as you planned adequately and made the necessary decisions beforehand. In this section, you ll look at the actual steps required to install the first domain controller in a given environment. With early versions of the Windows NT operating system, you had to determine during installation the role of your server as it related to the domain controller or member server. Choices included making the machine a primary domain controller (PDC), a backup domain controller (BDC), or a member server. This was an extremely important decision because, even though you could promote a BDC to a PDC, you had to completely reinstall the operating system to make any changes to the server s role between a domain controller and a member server. Instead of forcing you to choose during setup whether or not the machine will participate as a domain controller, Windows Server 2008 allows you to promote servers after you install Active Directory. Therefore, at the end of the setup process, all Windows Server 2008 computers are configured as either member servers (if they are joined to a domain) or stand-alone servers (if they are part of a workgroup). The process of converting a member server to a domain controller is known as promotion. Through the use of a simple and intuitive wizard, systems administrators can quickly configure servers to be domain controllers after installation. Later in this section, you ll follow the steps you need to take to install Active Directory by promoting the first domain controller in the domain. These steps are performed using the Active Directory Installation Wizard (DCPROMO). This tool is designed to be used after a server has been installed in the environment. As part of the promotion process, the server creates or receives information related to Active Directory configuration. The first step in installing Active Directory is promoting a Windows Server 2008 computer to a domain controller. The first domain controller in an environment serves as the starting point for the forest, trees, domains, and the Operations Master roles. Exercise 3.2 shows the steps you need to follow to promote an existing Windows Server 2008 to a domain controller. In order to complete the steps in this exercise, you must have already installed and configured a Windows Server 2003 or 2008 computer. You also need a DNS server that supports SRV records. If you do not have a DNS server available, the Active Directory Installation Wizard automatically configures one for you. Promoting a Domain Controller 1. Start the Active Directory Installation Wizard by clicking Start Run and typing dcpromo. 2. When the Welcome screen appears, check the box that says Use Advanced Mode Installation and then click Next

120 Chapter 3 Active Directory Planning and Installation 3. The Choose a Deployment Configuration box appears. Choose the second option, Create a new domain in a new forest. Then click Next. 4. A warning box may appear stating that the local administrator account will become the domain administrator account. If this box appears, click Yes. 5. The Name the Forest Root Domain box appears, asking you to enter the full DNS name of your domain. Enter your domain s DNS name and click Next. (Use mycompany.com if you do not have a domain name.) 6. After the DNS name gets verified, a NetBIOS name box appears with your default NetBIOS name (for example, mycompany). Leave the default and click Next.

Installing Active Directory 121 A NetBIOS name can be up to 15 characters. To make it easier to remember and type the name, you should limit yourself to the English alphabet characters and numbers. 7. The Set Forest Functional Level box appears. Use the pull down menu and choose Windows Server 2003 or Windows Server 2008 and then click Next. 8. When the Additional Domain Controller Options page appears, make sure DNS Server is checked (if you need to install DNS). Also notice the option labeled Read-Only Domain Controller (RODC). This is where you will create your RODC (RODC installation and configuration are covered in later chapters of this book). Since this is the first domain controller in your new domain, the RODC option is grayed out. Click Next.

122 Chapter 3 Active Directory Planning and Installation 9. A Static IP Assignment box may appear. If it does, choose the Yes option and configure a static IP address for your computer. If this box does not appear, go on to the next step. 10. In the Location for Database, Log Files, and Sysvol page, specify the filesystem locations for the Active Directory database and log files. Microsoft recommends that these files reside on separate physical devices in order to improve performance and to provide for recoverability. The default filesystem location is in a directory called NTDS located within the system root. However, you can choose any folder located on a FAT32 or NTFS partition (Sysvol requires NTFS). After you ve specified the filesystem locations (you can leave the defaults if you like), click Next. 11. On the Directory Services Restore Mode Administrator Password page, provide a password to be used to restore Active Directory in the event of its loss or corruption. Note that this password does not have to correspond with passwords set for any other account. For this exercise, use the following password: P@ssw0rd

Installing Active Directory 123 After confirming the password, click Next. 12. Based on the installation options you ve selected, the wizard presents a summary of your choices. It is a good idea to copy and paste this information into a text file to refer to later. Verify the options, and then click Next to begin the Active Directory installation process. A box with a book that is being written to will appear as Active Directory is installing. 13. Once Active Directory has been installed, you are prompted to reboot the system. After the reboot, you can access the administrative tools that are related to the configuration and management of Active Directory.

124 Chapter 3 Active Directory Planning and Installation Verifying Active Directory Installation Once you have installed and configured Active Directory, you ll want to verify that you have done so properly. In the following sections, you ll look at methods for doing this. Using Event Viewer The first (and perhaps most informative) way to verify the operations of Active Directory is to query information stored in the Windows Server 2008 event log. You can do this using the Windows Server 2008 Event Viewer. Exercise 3.3 walks you through this procedure. Entries seen with the Event Viewer include errors, warnings, and informational messages. In order to complete the steps in this exercise, you must have configured the local machine as a domain controller. EXERCISE 3.3 Viewing the Active Directory Event Log 1. Open the Event Viewer snap-in from the Administrative Tools program group. 2. In the left pane, under Applications and Services Logs, select Directory Service. 3. In the right pane, you can sort information by clicking column headings. For example, you can click the Source column to sort by the service or process that reported the event.

Verifying Active Directory Installation 125 EXERCISE 3.3 4. Double-click an event in the list to see the details for that item. Note that you can click the Copy button to copy the event information to the Clipboard. You can then paste the data into a document for later reference. Also, you can move between items using the up and down arrows. Click OK when you are done viewing an event. 5. Filter an event list by right-clicking the Directory Service item in the left pane, and selecting the Filter tab. Note that filtering does not remove entries from the event logs it only restricts their display. 6. To verify Active Directory installation, look for events related to the proper startup of Active Directory, such as Event ID 1000 (Active Directory Startup Complete) and 1394 (Attempts To Update The Active Directory Database Are Succeeding). Also, be sure to examine any Error or Warning messages because these could indicate problems with DNS or other necessary services. 7. When you re done viewing information in the Event Viewer, close the application. Gaining Insight through Event Viewer Despite its simple user interface and somewhat limited GUI functionality, the Event Viewer tool can be your best ally in isolating and troubleshooting problems with Windows Server 2008. The Event Viewer allows you to view information that is stored in various log files that are maintained by the operating system. This list of logs includes the following: Application Stores messages generated by programs running on your system. For example, SQL Server 2005 might report the completion of a database backup job within the Application log. Security Contains security-related information, as defined by your auditing settings. For example, you could see when users have logged onto the system or when particularly sensitive files have been accessed. System Contains operating system related information and messages. Common messages might include a service startup failure or information about when the operating system was last rebooted. Directory service Stores messages and events related to how Active Directory functions. For example, details related to replication might be found here. DNS server Contains details about the operations of the DNS service. This log is useful for troubleshooting replication or name resolution problems.