1. Module 1: Installing Active Directory Domain Services
4/20/2017Course 6425A
Module 1: Installing Active Directory Domain Services
Presentation: 65 minutes
Lab: 75 minutes
This module helps students implement Active Directory Domain Services.
After completing this module, students will be able to:
Install Active Directory Domain Services.
Deploy Read-Only Domain Controllers.
Configure AD DS Domain Controller roles.
Required materials
To teach this module, you need the Microsoft® Office PowerPoint® file 6425A_01.ppt.
Important It is recommended that you use PowerPoint 2002 or a later version to display the slides for this course. If you use PowerPoint Viewer or an earlier PowerPoint version, all the features of the slides might not be displayed correctly.
Preparation tasks
To prepare for this module:
Read all of the materials for this module.
Complete the practices.
This section contains information that will help you teach this module.
For some topics in this module, references to additional information appear in notes at the end of the topics. Read the additional information so that you can prepare to teach the module. During class, ensure that students are aware of the additional information.
Module 1: Implementing Active Directory® Domain Services (AD DS)

2. Module 1: Installing Active Directory Domain Services
4/20/2017Course 6425A
Module Overview
Module 1: Installing Active Directory Domain Services
Installing Active Directory Domain Services(ADDS)
Deploying Read-Only Domain Controllers
Configuring AD DS Domain Controller Roles

3. Lesson 1: Installing Active Directory Domain Services
4/20/2017Course 6425A
Lesson 1: Installing Active Directory Domain Services
Module 1: Installing Active Directory Domain Services

4. What are ADDS?
Active Directory Domain Services (AD DS) provides the functionality of an identity and access (IDA) solution for enterprise networks.
Store information about users, groups, computers, and other identities.
Authenticate an identity.
The server will not grant the user access to the document unless the server can verify the identity presented in the access request as valid.
Kerberos Authentication: a protocol called Kerberos is used to authenticate identi-ties.
Control access
Provide an audit trail

5. Technologies of ADDS
Active Directory Domain Services (Identity): designed to provide a central repository for identity mana gement within an organization.
Active Directory Lightweight Directory Services (Applications): provides support for directory-enabled applications.
Active Directory Certificate Services (Trust): set up a certificate authority for issuing digital certificates as part of a public key infrastructure (PKI) that binds the identity of a person, device, or service to a corresponding private key.
Active Directory Rights Management Services (Integrity): information-protection technology that enables you to implement persistent usage policy templates that define allowed and unauthorized use whether online, offline, inside, or outside the firewall.
Active Directory Federation Services (Partnership):enables an organization to extend IDA across multiple platforms, including both Windows and non- Windows environmen ts

6. Components of an Active Directory Infrastructure
Active Directory data store
Domain controllers
Domain
Forest
Tree
Functional level
Organizational units
Sites

7. Active Directory data store
Stores identities in the directory a data store hosted on domain controllers.
Located by default in the folder %SystemRoot%\Ntds.dit
The database is divided in to several partitions, including the schema, configuration, global catalog, and the doma in naming context that contains the data about objects within a domain—the users, groups, and computers, for example

8. Domain controllers (DC)
DCs are servers that perform the AD DS role.
The Kerberos Key Distribution Center (KDC) service, which Performs authentication, and other Active Directory services.

9. Domain
One or more domain controllers are required to create an Active Directory domain.
A domain is an administrative unit with in which certain capabilities and characteristics are shared.
All domain controllers replicate the domain’s partition of the data store, which contains other things the identity data for the domain’s users, groups, and computers.

10. Forest
A forest is a collection of one or more Active Directory domains.
The first domain installed in a forest is called the forest root domain.
The forest defines a security boundary.

11. Tree Create by the DNS namespace of domains in a forest.
A domain is a subdomain of another domain, the two domains are considered a tree.

12. Functional level
The functional level is an AD DS setting that enables advanced domain-wide or forest-wide AD DS features.
Three domain functional levels:
Windows 2000 native.
Windows Server 2003
Windows Server 2008.
Two forest functional levels:
Microsoft Window s Server 2003.

13. Organizational units
Objects in the data store can be collected in containers.
One type of container is the object class called con-tainer
Default containers, including Users, Computers, and Builtin,…
Another type of con-tainer is the organizational unit (OU)
OUs provide not only a container for objects but also a scope with which to manage the objects.

14. Sites
An Active Directory site is an object that represents a portion of the enterprise within which network connectivity is good.
Domain controllers within a site replicate changes within seconds.
For exam-ple, when a user logs on to the domain, the Windows client first attempts to authenticate with a domain controller in its site. Only if no domain controller is available in the site will the client attempt to authenticate with a DC in another site.

15. Requirements for Installing AD DS
4/20/2017Course 6425A
Requirements for Installing AD DS
Module 1: Installing Active Directory Domain Services
Server requirements to install AD DS
A computer running Windows Server 2008
Minimum disk space of 250 MB and a partition formatted with NTFS file system
Mention that Windows Server 2008 is supported on both 32-bit hardware and 64-bit hardware. 64-bit hardware is recommended for domain controllers in organizations that have large numbers of users.
Highlight the importance of Domain Name System (DNS) in the AD DS installation. Mention that the INSERT next module will cover the integration of DNS and AD DS.
References
Active Directory Domain Services Help: Installing Active Directory Domain Services
Requirements for Installing AD DS: 563e-40ba-b74a a mspx?mfr=true
Network configuration
TCP/IP must be configured, including DNS client settings
DNS Server that supports dynamic updates must be available or will be configured on the domain controller
Administrator permissions
Local Administrator permissions to install the first domain controller in a forest
Domain Administrator permissions to install additional domain controllers in a domain
Enterprise Administrator permissions to install additional domains in a forest

16. AD DS Installation Process
4/20/2017Course 6425A
AD DS Installation Process
Module 1: Installing Active Directory Domain Services
Install the Active Directory Domain Services role using the Server Manager 1
Mention that you can skip the first step in the installation by just running DCPromo from a command line. When you choose this option, the AD DS server role is installed and then the Active Directory Domain Services Installation Wizard will start.
The configuration options for step 3 will vary depending on whether this is the first domain controller in a forest, additional domain controller in a domain, or first domain controller in a new domain in a forest. Highlight the differences for each option.
Stress the importance of documenting the Directory Services Restore Mode Administrator Password. Without this password, students will not be able to restore Active Directory in the event of a database failure. Mention that the password can be changed after installation by using the NTDSUtil command-line tool.
References
Active Directory Domain Services Help: Installing Active Directory Domain Services
Installing a New Windows Server “Longhorn” Forest:
Scenarios for Installing AD DS
a mspx?mfr=true  
Run the Active Directory Domain Services Installation Wizard 2
Choose the deployment configuration 3
Select the additional domain controller features 4
Select the location for the database, log files, and SYSVOl folder 5
Configure the Directory Services Restore Mode Administrator Password 6

17. Advanced Options for Installing AD DS
4/20/2017Course 6425A
Advanced Options for Installing AD DS
Module 1: Installing Active Directory Domain Services
To access the advanced mode installation options, choose the Advanced Mode option in the installation wizard or run DCPromo /adv
Describe situations where administrators may choose to use each of the advanced installation options. Mention that the advanced mode installation option is available to address nonstandard domain controller installation options.
Mention that some of the advanced installation options are available only after making initial selections in the wizard. For example, the option to change the domain NetBIOS name is available only when you are installing the first domain controller in a domain, not when you are installing additional domain controllers in the same domain. The options to use backup media as the source for AD DS information, select the source domain controller for the installation, or define the Password Replication Policy for an read-only domain controller (RODC) are available only when installing an additional domain controller in a domain.
References
Active Directory Domain Services Help: Use advanced mode installation
What's New in AD DS Installation and Removal: a mspx?mfr=true
Use the advanced mode options to:
Create a new domain tree
Use backup media as the source for AD DS information
Select the source domain controller for the installation
Modify the default domain NetBIOS name
Define the Password Replication Policy for an RODC

18. Installing AD DS from Media
4/20/2017Course 6425A
Installing AD DS from Media
Module 1: Installing Active Directory Domain Services
Use Ntdsutil.exe to create the installation media
Ntdsutil.exe can create the following types of installation media:
Summarize the reasons why an organization might choose to use the install from media option when installing a domain controller. The primary benefit is that this will decrease the initial replication time when installing a domain controller in an office location with a slow network connection to another domain controller.
Mention that although the initial AD DS data is extracted from the backup, the domain controller will still replicate with other domain controllers to ensure that the new domain controller has current information.
Considering demonstrating the steps to create the media using Ntdsutil.exe.
References
Installing AD DS from Media: 40ba-b74a a mspx?mfr=true
Active Directory Domain Services Help: Use advanced mode installation
Full (or writable) domain controller
Full (or writable) domain controller without SYSVOL data
Read-only domain controller without SYSVOL data
Read-only domain controller

19. Upgrading to Windows Server 2008 AD DS
4/20/2017Course 6425A
Upgrading to Windows Server 2008 AD DS
Module 1: Installing Active Directory Domain Services
To prepare previous versions of Active Directory for a Windows Server 2008 domain controller installation:
Current Version
Before installing
Command
Windows Windows 2003
Mention that to install a Windows Server 2008 domain controller in an existing Windows 2000 Server or Windows Server 2003 domain, the students must first run the ADPrep command-line tool to prepare the environment for the Windows Server 2008 installation. Details for the ADPrep switches are provided in the Scenarios for Installing AD DS resource.
Resources
Active Directory Domain Services Help: Installing Active Directory Domain Services
Installing a New Windows Server “Longhorn” Forest: Scenarios for Installing AD DS: a mspx?mfr=true  
Additional Resources
Appendix of Unattended Installation Parameters a mspx?mfr=true
Windows Server 2008 domain controllers
adprep /forestprep
Windows Server 2000
Windows Server 2008 domain controllers
adprep /domainprep /gpprep
Windows Server 2003
Windows Server 2008 domain controllers
adprep /domainprep
Windows Server
2003
Windows Server 2008 RODCs
adprep /rodcprep

20. Installing AD DS on a Server Core Computer
Installing Server Core

21. Installing AD DS on a Server Core Computer
Performing Initial Configuration Tasks

22. Installing AD DS on a Server Core Computer

23. Installing AD DS on a Server Core Computer
4/20/2017Course 6425A
Installing AD DS on a Server Core Computer
Module 1: Installing Active Directory Domain Services
To install AD DS on a Server Core computer, perform an unattended installation using an answer file
Use following syntax with the Dcpromo command:
Dcpromo /answer[:filename]
Where filename is the name of your answer
Stress that the only way to install AD DS on a server running Windows Server 2008 Server Core is to use an unattended installation. Mention that there are many additional settings that you can configure during an unattended installation – the slide just highlights those that are most important.
Reference
Appendix of Unattended Installation Parameters a mspx?mfr=true

24. Lesson 2: Deploying Read-Only Domain Controllers
4/20/2017Course 6425A
Lesson 2: Deploying Read-Only Domain Controllers
Module 1: Installing Active Directory Domain Services
What Is a Read-Only Domain Controller?
Read-Only Domain Controller Features
Preparing to Install the RODC
Installing the RODC
Delegating the RODC Installation
What Are Password Replication Policies?
Demonstration: Configuring Administrator Role Separation and Password Replication Policies

25. What Is a Read-Only Domain Controller?
4/20/2017Course 6425A
What Is a Read-Only Domain Controller?
Module 1: Installing Active Directory Domain Services
RODCs host read-only partitions of the Active Directory database, only accept replicated changes to Active Directory, and never initiate replication
RODC
RODCs provide:
If students are familiar with Windows NT 4.0, compare the RODC with the Windows NT Backup domain controller (BDC). These domain controllers are similar, but the RODC provides several more features, such as delegating administration and credential caching.
Mention that RODCs are designed primarily to be deployed in a branch office.
Reference
AD DS: Read-Only Domain Controllers: a mspx?mfr=true
Additional security for branch office with limited physical security
Additional security if applications must run on a domain controller
RODCs:
Cannot hold operation master roles or be configured as replication bridgehead servers
Can be deployed on servers running Windows Server Server core for additional security

26. Read-Only Domain Controller Features
4/20/2017Course 6425A
Read-Only Domain Controller Features
Module 1: Installing Active Directory Domain Services
RODCs provide:
Unidirectional replication
Emphasize the security benefits of running an RODC, including that:
Even if an RODC is compromised, or an attacker gains physical access to the domain controller, the changes made to the RODC will never be replicated to another domain controller.
You can delegate administrative control of the RODC so that a local administrator in the branch office can perform tasks such as install updates. However, this administrator will have no permissions in the rest of the domain or on other domain controllers.
You can configure the RODC to cache no passwords or to cache passwords of specific personnel who will log on to the domain controller. This limits the exposure of user passwords if the RODC is compromised.
By deploying an RODC on a computer running Server Core, you add an additional level of security by removing most of the administration tools that are used to manage Active Directory.
Reference
AD DS: Read-Only Domain Controllers: a mspx?mfr=true
Step-by-Step Guide for Read-Only Domain Controller in Windows Server 2008 Beta 3: a mspx?mfr=true
Credential caching
Administrative role separation
Read-only DNS
RODC filtered attribute set

27. Preparing to Install the RODC
4/20/2017Course 6425A
Preparing to Install the RODC
Module 1: Installing Active Directory Domain Services
Before installing an RODC:
Ensure that the domain and forest is at a Windows Server functional level
The forest functional level must be Windows Server 2003, so that linked-value replication is available. This provides a higher level of replication consistency. The domain functional level must be Windows Server 2003, so that Kerberos constrained delegation is available.
Stress that although an RODC can replicate changes to the schema, configuration, and any application partitions from a Windows Server 2003 domain controller, it can replicate changes only to the domain partition from a Windows Server 2008 domain controller.
Mention that although you can install an RODC in a forest that is configured at the Windows Server functional level, it is a better practice to raise the functional level to Windows Server 2008 before installing RODCs.
Reference
AD DS Help: Delegate read-only domain controller installation and administration
AD DS: Read-Only Domain Controllers: a mspx?mfr=true
Step-by-Step Guide for Read-Only Domain Controller in Windows Server 2008 Beta 3: a mspx?mfr=true
Ensure a writeable domain controller running Windows Server 2008 is available to replicate the domain partition
Run ADPrep /rodcprep to enable the RODC to replicate DNS partitions
Run ADPrep /domainprep in all domains if the RODC will be a global catalog server

28. Module 1: Installing Active Directory Domain Services
4/20/2017Course 6425A
Installing the RODC
Module 1: Installing Active Directory Domain Services
Choose the option to install an additional domain controller in an existing domain 1
Select the option to install an RODC in the Active Directory Domain Services Installation wizard 2
Mention that password replication is covered in a later topic.
When installing an RODC using an unattend file, you can specify additional settings in the file, such as which passwords will be cached on the server, and domain controller will operate as the replication source. However, only the ReplicaOrNewDomain=ReadOnlyReplica setting is required.
Reference
AD DS Help: Delegate read-only domain controller installation and administration
Step-by-Step Guide for Read-Only Domain Controller in Windows Server 2008 Beta 3: a mspx?mfr=true
Choose advanced mode installation if you want to configure the password replication policy 3
To install an RODC on a Server Core installation, use an unattended installation file with the ReplicaOrNewDomain=ReadOnlyReplica value

29. Delegating the RODC Installation
4/20/2017Course 6425A
Delegating the RODC Installation
Module 1: Installing Active Directory Domain Services
To delegate the installation of a RODC:
Pre-create the RODC computer account in the Domain Controllers container
When you pre-create the RODC computer account and delegate permissions, the Active Directory Installation runs as if you are completing the installation. You can specify the password replication policy and assign the local user or group that will have permission to complete the installation.
Reference
AD DS Help: Delegate read-only domain controller installation and administration
AD DS: Read-Only Domain Controllers: a mspx?mfr=true
Step-by-Step Guide for Read-Only Domain Controller in Windows Server 2008 Beta 3: a mspx?mfr=true
Assign a user or group with permission to install the RODC
To complete a delegated RODC installation, run DCPromo with the /UseExistingAccount:Attach switch

30. What Are Password Replication Policies?
4/20/2017Course 6425A
What Are Password Replication Policies?
Module 1: Installing Active Directory Domain Services
The password replication policy determines how the RODC performs credential caching for authenticated user
By default, the RODC does not cache any user credentials or computer credentials
Discuss the balance required when designing the RODC password replication policies. Caching no accounts, or very few accounts, may increase the security for the RODC, but it also has the potential of increasing user dissatisfaction because users cannot log on to the domain when the Wide Area Network (WAN) connection between the site with the RODC and a site with an writeable domain controller is unavailable.
Discuss the three options:
- No credentials cached. Provides maximum security by requiring access to a writeable domain controller for users to log on.
- Enable credential caching on an RODC for specified accounts. Add users or groups in the branch office to the password replication policy.
- Add users and groups from the domain to the Domain RODC Password Replication Allowed Group. This group applies to all RODCs and provides least security.
Reference
AD DS Online Help: Specify Password Replication Policy
Options for configuring password replication policies:
No credentials cached
Enable credential caching on an RODC for specified accounts
Add users or groups to the Domain RODC Password Allowed group so credentials are cached on all RODCs

31. Lesson 3: Configuring AD DS Domain Controller Roles
4/20/2017Course 6425A
Lesson 3: Configuring AD DS Domain Controller Roles
Module 1: Installing Active Directory Domain Services
What Are Global Catalog Servers?
Modifying the Global Catalog
Demonstration: Configuring Global Catalog Servers
What Are Operations Master Roles?
Demonstration: Managing Operation Master Roles
How Windows Time Service Works

32. What Are Global Catalog Servers?
4/20/2017Course 6425A
What Are Global Catalog Servers?
Module 1: Installing Active Directory Domain Services
Domain
Global Catalog Server
Global Catalog
Result
Query
The global catalog is a distributed data repository that contains a searchable, partial representation of every object in every domain in a multidomain Active Directory forest. The global catalog is stored on domain controllers that have been designated as global catalog servers and is distributed through multimaster replication.
Stress that global catalog servers also must be domain controllers. A global catalog server is a domain controller that, in addition to its full, writable domain directory partition replica, also stores a partial, read-only replica of all other domain directory partitions in the forest.
The global catalog provides a resource for searching an Active Directory forest.
By default, only the first domain controller installed in a forest is a global catalog server. In most cases, you should designate at least one global catalog server in each Active Directory site.
Client computers must have access to a global catalog server to log on. Therefore, in most cases, you must have at least one global catalog server in every site to take advantage of the benefits of minimizing network traffic that using sites provides.
Reference
What Is the Global Catalog?: 9ce8-471da6a3a mspx?mfr=true

33. Modifying the Global Catalog
4/20/2017Course 6425A
Modifying the Global Catalog
Module 1: Installing Active Directory Domain Services
Common Attributes
Changed Attributes
firstName
lastName
address
accountExpires
distinguishedName
department
firstName
lastName
address
accountExpires
distinguishedName
Mention that the global catalog server contains an object’s most common attributes for every object in the entire forest. Applications and users can query these attributes. For example, you can find a user by first name, last name, address, or other common properties of a user account.
To decide whether to add an attribute to a global catalog server, use these considerations:
- Add only attributes that users or applications in your organization frequently query or to which they refer.
- Determine how frequently an attribute is updated during replication. Active Directory replicates all attributes that are stored in the global catalog to every global catalog server in the forest. The smaller the attribute, the lower the impact on replication. If the attribute is large, but seldom changes, it has a smaller replication impact than a small attribute that changes often.
Mention that installing some applications, for example Exchange Server, also can make changes to the global catalog. When you install Exchange Server, it adds specific attributes for to the Active Directory schema and adds attributes to the global catalog.
Reference
How the Global Catalog Works (Global Catalog Partial Attribute Set section): da6a3a mspx?mfr=true
Create additional attributes
Global Catalog Server
Add only the additional attributes that you query or refer to frequently

34. What Are Operations Master Roles?
4/20/2017Course 6425A
What Are Operations Master Roles?
Module 1: Installing Active Directory Domain Services
Role
Description
Schema Master
One per forest
Performs all updates to the Active Directory schema
Domain Naming Master
Manages adding and removing all domains and directory partitions
RID Master
One per domain
Allocates blocks of RIDs to each domain controller in the domain
PDC Emulator
Minimizes replication latency for password changes
Synchronizes time on all domain controllers in the domain
Infrastructure Master
Updates object references in its domain that point to the object in another domain
Mention that Active Directory uses operations master roles to perform specific tasks to ensure consistency and to eliminate the potential for conflicting entries.
Also mention that Active Directory uses multimaster replication, which means that changes can be made on any of a domain’s controllers. However, multimaster replication also can allow conflicting updates that potentially can lead to problems when data is replicated throughout the domain or forest. Operations masters are designed to prevent conflicting changes.
Stress that some operation master roles are forest wide and some are domain wide.
For students that are not familiar with how security identifiers (SIDs) are assigned, you may need to provide some information on how the SID is made up of a domain SID, and a relative identifier (RID). To ensure that each security principal in the domain gets a unique SID, one domain controller must be responsible for distributing the RIDs to each domain controller.
The infrastructure master role can be difficult to understand for students. One way to illustrate the server role is to use a group that contains a user account from a different domain. When the user account display name is modified in its home domain, the infrastructure master updates the display name on the group membership list.
Avoid spending too much time on discussing the design implications for the operations masters placement. Refer students to Course 2282: Designing a Microsoft® Windows Server 2003 Active Directory® and Network Infrastructure if they want more details on these designs.
Reference
What are Operations Masters? f f1033.mspx?mfr=true

35. How Windows Time Service Works
4/20/2017Course 6425A
How Windows Time Service Works
Module 1: Installing Active Directory Domain Services
Domain controllers
PDC Emulator
Client computers
Windows Time service (W32Time) provides network clock synchronization for domain controllers and client computers
The Windows Time service is essential to the successful operation of Kerberos authentication and, therefore, to Active Directory–based authentication. Any Kerberos-aware application, relies on time synchronization between the computers that are participating in the authentication request. If the client’s time is more than five minutes different than the domain controller time, authentication will fail.
Active Directory domain controllers also must have synchronized clocks to help ensure accurate data replication. One of the criteria for determining which updates need to be replicated is the attribute time stamp. Inconsistent times on domain controllers will result in inconsistent replication.
Mention that a best practice is to configure the PDC emulator to use an external time source. See the resource Configuring a time source for the forest for information on how to do this.
Reference
What Is Windows Time Service?: 41b3-b0e8-240f8236e mspx?mfr=true
How Windows Time Service Works: 41b3-b0e8-240f8236e mspx?mfr=true
Configuring a time source for the forest: a b6e5-b7406d9f91f01033.mspx?mfr=true
In a Windows Server 2008 forest, the PDC Emulator is used to provide the authoritative time for all other computers
Time synchronization is important because:
Kerberos authentication includes a time stamp
Replication between domain controllers is time stamped

36. Module 1: Installing Active Directory Domain Services
4/20/2017Course 6425A
Beta Feedback Tool
Module 1: Installing Active Directory Domain Services
Beta feedback tool helps:
Collect student roster information, module feedback, and course evaluations.
Identify and sort the changes that students request, thereby facilitating a quick team triage.
Save data to a database in SQL Server that you can later query.
Walkthrough of the tool

37. Module 1: Installing Active Directory Domain Services
4/20/2017Course 6425A
Beta Feedback
Module 1: Installing Active Directory Domain Services
Overall flow of module:
Which topics did you think flowed smoothly, from topic to topic?
Was something taught out of order?
Pacing:
Were you able to keep up? Are there any places where the pace felt too slow?
Were you able to process what the instructor said before moving on to next topic?
Did you have ample time to reflect on what you learned? Did you have time to formulate and ask questions?
Learner activities:
Which demos helped you learn the most? Why do you think that is?
Did the lab help you synthesize the content in the module? Did it help you to understand how you can use this knowledge in your work environment?
Were there any discussion questions or reflection questions that really made you think? Were there questions you thought weren’t helpful?