Installing Active Directory

1
Installing Active Directory

• Chapter Five

2
Preparing for AD Installation

• Issues to consider
• IP addressing schemes and DNS
• Domain naming context

3
Preparing for AD Installation

• View DNS records
• Ensure that DCs for new domains or additional DCs
  for a domain have the correct DNS addresses and
  that the addresses are registered with DNS server

4
Installing AD

• On a previously configured server, use
  dcpromo.exe to activate the AD Installation Wizard

5
Creating Windows 2003 Domains

• Recall
• Domains - computers sharing a security boundary
• Domain trees - domains sharing a schema, GC, and
  contiguous namespace
• Domain forests - domains trees sharing a common
  schema, configuration, and GC, but not a
  contiguous namespace

6
Using the Active Directory Wizards

• Select the role of the DC

7
Using the Active Directory Wizards

• Select the domain context

8
Using the Active Directory Wizards

• Create the domain name

9
Using the Active Directory Wizards

• NetBIOS domain name

10
Using the Active Directory Wizards

• Specify the AD database and logfile locations

11
Using the Active Directory Wizards

• Specify the shared system volume location
• Contains Policies and is replicated to all DCs

12
Using the Active Directory Wizards

• Install DNS or verify installed.

13
Using the Active Directory Wizards

• Enter AD Restore Mode password
• Not authenticated through AD, uses SAM

14
Using the Active Directory Wizards

• Verify installation selections

15
Using the Active Directory Wizards

• Promoting a member server to a DC
• Needs to be have Enterprise Administrator account
  to add a DC for a new domain
• Needs to be a members server before promotion
  when adding an additional DC for a domain
• Needs to be have Domain Administrator account to
  add an additional DC for a domain

16
Using the Active Directory Wizards

• Promoting a member server to a DC
• select the domain for the new DC

17
Using the Active Directory Wizards

• Demoting a DC to a member server
• use dcpromo.exe

18
Using the Active Directory Wizards

• Demoting a DC to a member server
• set local password for administrator of member
  server

19
Using the Active Directory Wizards

• Demoting a DC to a member server
• verify removal of DC

20
Understanding the Active Directory Database

• Database and database log files are used to
  maintain the directory
• Database file is stored in a file named ntds.dit
• That file is stored in two locations
• systemroot\NTDS\ntds.dit (after promotion)
• systemroot\System32\ntds.dit (during promotion)

21
Understanding the Active Directory Database

• Database log files should be located in a
  separate partition, or on a separate physical
  drive as the database file (fault-tolerance
  measure)
• Circular and noncircular logging

22
Understanding Active Directory Domain Modes

• Windows 2003 supports two modes of operation
• Windows 2000 Mixed mode
• Windows 2000 Native mode
• Windows 2003 Interim mode
• Windows 2003 Native mode

23
Understanding Active Directory Domain Modes

• Windows 2000 mixed mode -supports replication
  with Windows NT DCs
• Use if
• unable to upgrade all DCs
• unable to secure DCs in AD
• lack resources to upgrade DCs
• wish to use NT as a fallback
• SAM replication only for Windows NT, Windows
  2000, and Windows 2003.
• No universal groups, no nesting groups, no group
  conversions

24
Understanding Active Directory Domain Modes

• Windows 2003 Interm-mode supports replication
  with Windows NT DCs
• Use if
• unable to upgrade all DCs
• unable to secure DCs in AD
• lack resources to upgrade DCs
• wish to use NT as a fallback
• SAM replication only for Windows NT and Windows
  2003.
• Must have only Windows 2003 and Windows NT servers

25
Understanding Active Directory Domain Modes

• Windows 2000 Native mode - does not support
  replication with Windows NT DCs
• Netlogon service is disabled Windows NT DCs can
  no longer be added to domain
• Multimaster replication only for Windows
  2000/2003.
• Use if all DCs have been upgraded to Windows
  2000/2003

26
Understanding Active Directory Domain Modes

• Switching to native mode
• select a domain
• Active Directory Domains and Trusts

27
Understanding Active Directory Domain Modes

• Switching to native mode

28
Understanding Active Directory Domain Modes

• Switching to native mode

29
Windows 2000 Native Mode Operation

• Domain uses AD multimaster replication
  exclusively
• Support for NETLOGON replication is halted
• Windows NT DCs can no longer join the domain
• All DCs can perform directory updates using
  multi-master replication
• Windows 2000/2003 native mode universal groups
  are enabled
• Windows 2000/2003 native mode global group
  nesting is enabled
• Domain Renaming

30
Windows 2003 Native Mode Operation

• All features of Windows 2000 Native Mode
• Windows 2003 servers only
• Domain Controller Renaming
• Passwords for inetOrgPerson Objects