WHAT IS ACTIVE DIRECTORY

What is Active Directory?

Active Directory (AD) is Microsoft’s proprietary directory service. It runs on Windows Server and enables administrators to manage permissions and access to network resources.

Active Directory stores data as objects. An object is a single element, such as a user, group, application or device such as a printer. Objects are normally defined as either resources, such as printers or computers, or security principals, such as users or groups.

Active Directory categorizes directory objects by name and attributes. For example, the name of a user might include the name string, along with information associated with the user, such as passwords and  secure shell keys.

The main service in Active Directory is Domain Services (AD DS), which stores directory information and handles the interaction of the user with the domain. AD DS verifies access when a user signs into a device or attempts to connect to a server over a network. AD DS controls which users have access to each resource, as well as group policies..

History and development of Active Directory

Microsoft offered a preview of Active Directory in 1999 and released it a year later with Windows 2000 Server. Microsoft continued to develop new features with each successive Windows Server release.

Windows Server 2003 included a notable update to add forests and the ability to edit and change the position of domains within forests. Domains on Windows Server 2000 could not support newer AD updates running in Server 2003.

Windows Server 2008 introduced AD FS. Additionally, Microsoft rebranded the directory for domain management as AD DS, and AD became an umbrella term for the directory-based services it supported.

Windows Server 2016 updated AD DS to improve AD security and migrate AD environments to cloud or hybrid cloud environments. Security updates included the addition of PAM.

PAM monitored access to an object, the type of access granted and what actions the user took. PAM added bastion AD forests to provide an additional secure and isolated forest environment. Windows Server 2016 ended support for devices on Windows Server 2003.

In December 2016, Microsoft released Azure AD Connect to join an on-premises Active Directory system with Azure Active Directory (Azure AD) to enable SSO for Microsoft’s cloud services, such as Office 365. Azure AD Connect works with systems running Windows Server 2008, Windows Server 2012, Windows Server 2016 and Windows Server 2019.

Major features in Active Directory Domain Services

Active Directory Domain Services uses a tiered layout structure consisting of domains, trees and forests to coordinate networked elements.

Domains are the smallest of the main tiers, while forests are the largest. Different objects, such as users and devices, that share the same database will be on the same domain. A tree is one or more domains grouped together with hierarchical trust relationships. A forest is a group of multiple trees. Forests provide security boundaries, while domains — which share a common database — can be managed for settings such as authentication and encryption.

• A domain is a group of objects, such as users or devices, that share the same AD database. Domains have a domain name system
• A tree is one or more domains grouped together. The tree structure uses a contiguous namespace to gather the collection of domains in a logical hierarchy. Trees can be viewed as trust relationships where a secure connection, or trust, is shared between two domains. Multiple domains can be trusted where one domain can trust a second, and the second domain can trust a third. Because of the hierarchical nature of this setup, the first domain can implicitly trust the third domain without needing explicit trust.
• A forest is a group of multiple trees. A forest consists of shared catalogs, directory schemas, application information and domain configurations. The schema defines an object’s class and attributes in a forest. In addition, global catalog servers provide a listing of all the objects in a forest. According to Microsoft, the forest is Active Directory’s security boundary.
• Organizational Units (OUs) organize users, groups and devices. Each domain can contain its own OU. However, OUs cannot have separate namespaces, as each user or object in a domain must be unique. For example, a user account with the same username cannot be created.
• Containers are similar to OUs, but Group Policy Objects cannot be applied or linked to container objects.

• Trusting terminology

  Active Directory relies on trusts to moderate the access rights of resources between domains. There are several different types of trusts:

  • A one-way trust is when a first domain allows access privileges to users on a second domain. However, the second domain does not allow access to users on the first domain.
  • A two-way trust is when there are two domains and each domain enables access to users of the other domain.
  • A trusted domain is a single domain that enables user access to another domain, which is called the trusting domain.

• Domains vs. workgroups

  The workgroup is Microsoft’s term for Windows machines connected over a peer to peer network Workgroups are another unit of organization for Windows computers in networks. Workgroups allow these machines to share files, internet access, printers and other resources over the network. Peer-to-peer networking removes the need for a server for authentication. There are several differences between domains and workgroups:

  • Domains, unlike workgroups, can host computers from different local networks.
  • Domains can be used to host many more computers than workgroups. Domains can include thousands of computers, unlike workgroups, which typically have an upper limit close to 20.
  • In domains, at least one server is a computer, which is used to control permissions and security features for every computer within the domain. In workgroups, there is no server and computers are all peers.
  • Domain users typically require security identifiers such as logins and passwords, unlike workgroups.
• How To Configure Active Directory In Windows Server 2019

Prerequisites

1. Install Windows server 2019 Standard / Data center on a Hardware.
2. Active Directory Topology
3. Make sure Active directory ports are open.
4. Patch the Server with the latest Windows Updates and hot-fix.
5. Assign the static IP address to Domain Controller
6. Install Active directory domain services (ADDS) Role on the server.
7. Configure ADDS according to requirement.
8. Evaluate the windows event logs to validate the health of ADDS installation and configuration
9. Configure Service and Performance Monitoring
10. ADDS Backup / DR Configuration

Active Directory Topology

In my sample environment, example.com will be the forest root domain. The first domain controller installs on the forest will hold all five FSMO roles. Once additional domain controllers are in place you can place them inapposite locations.

Active Directory Port Details

Active Directory communications comprise of the number of ports, below table explains ports with its details.

Active Directory Default Ports

 

Port	Type	Description
135	TCP/UDP	RPC endpoint mapper
137	TCP/UDP	NetBIOS name service
138	UDP	NetBIOS datagram service
139	TCP	NetBIOS session service
445	TCP/UDP	SMB over IP (Microsoft-DS)
389	TCP/ UDP	LDAP
636	TCP	LDAP over SSL
3268	TCP	Global catalog LDAP
3269	TCP	Global catalog LDAP over SSL
88	TCP/ UDP	Kerberos
53	TCP/ UDP	DNS
1512	TCP/ UDP	WINS resolution
42	TCP/ UDP	WINS replication
Dynamically-assigned ports, unless restricted	TCP	RPC

 

Active Directory Replication

Port	Type	Description
135	TCP	RPC endpoint mapper
389	TCP/UDP	LDAP
636	TCP	LDAP over SSL
3268	TCP	Global catalog LDAP
3269	TCP	Global catalog LDAP over SSL
53	TCP/UDP	DNS
88	TCP/UDP	Kerberos
445	TCP	SMB over IP (Microsoft-DS)
RPC	TCP	Dynamically-assigned ports (unless restricted)

Active Directory Authentication

Port	Type	Description
445	TCP/UDP	SMB over IP (Microsoft-DS)
88	TCP/UDP	Kerberos
389	UDP	LDAP
53	TCP/UDP	DNS
RPC	TCP	Dynamically-assigned ports (unless restricted)

 

---

Installation Steps

 

Step 1: Login as Local Admin

To start the configuration, log in to Windows server 2019 server as the local administrator.

 

Step 2: IP Config

We already changed the name of the server to a meaningful one. Then need to check the IP config. in my initial configuration, it shows DHCP IP.

We need to change it to static first, with PowerShell

Step 3: Static IP

To set the static IP, we can use below PowerShell command.

Note: Here we assigned IP based on my network requirement. Hence use the IP address according to your Infrastructure.

Step 4: Find InterfaceIndex

In above, InterfaceIndex can find using Get-NetIPAddress command.

Step 5 : DNS

Next step is to set DNS Ip addresses. The primary dc also going to act as DC so we need to set it as the preferred DNS. We can do this using below command.

After config, we can verify it using ipconfig /all.

Step 6: Install AD-DS Role

Before the AD configuration process, we need to install the AD-DS Role in the given server. In order to do that we can use the Following command.

Note: Reboot is not required to complete the role service installations.

Now we have the AD-DS role installed, the next step is to proceed with the configuration

Step 7:AD-DS Configuration

Below is the power-shell configuration file / script for configuring the ADDS.

Following explain the Power-Shell arguments and what it will do. Install-WindowsFeature

This cmdlet will allow to install windows role, role services or windows feature in la ocal server or remote server. It is similar to using windows server manager to install those.

IncludeManagementTools

This cmdlet will allow to install windows role, role services or windows feature in  local server or remote server. It is similar to using windows server manager to install those.

This will install the management tools for the selected role service.

Install-ADDSForest

This cmdlet will allow to setup a new active directory forest.

• DomainName: This parameter defines the FQDN for the active directory domain.
• CreateDnsDelegation Using this parameter can define whether to create DNS delegation that reference active directory integrated DNS.
• DatabasePath; this parameter will use to define the folder path to store the active directory database file (Ntds.dit).
• DomainMode: This parameter will specify the active directory domain functional level. In above I have used mode 7 which is windows server 2016. Windows Server 2019 doesn’t have separate domain functional level.
• DomainNetbiosName This defines the NetBIOS name for the forest root domain.
• ForestMode; This parameter will specify the active directory forest functional level. In above I have used mode 7 which is windows server 2016. Windows Server 2016 doesn’t have separate forest functional level.
• InstallDns: Using this can specify whether DNS role need to install with the active directory domain controller. For new forest, it is the default requirement to set it to $true.
• LogPath: Log path can use to specify the location to save domain log files.
• SysvolPath
• SysvolPath | This is to define the SYSVOL folder path. Default location for it will be C:\Windows
• NoRebootOnCompletion: By default, the system will restart the server after domain controller configuration. using this command can prevent the automatic system restart.
• Force: This parameter will force command to execute by ignoring the warning. It is typical for the system to pass the warning about best practices and recommendations.

Step 8 : Prompt for the Safe Mode Admin Pass

After executing the command it will prompt for the Safe Mode Administrator Password. This is to use in Directory Services Restore Mode (DSRM).

Make sure to use the complex password (According to windows password complexity recommendations). Failure to do so will stop the configuration.

Step 9 : Reboot & Login

When configuration complete, reboot the domain controller and log back in as domain administrator.
Step 10 : Confirm the Installation

To confirm the successful installation of the services.

Above command will list down the status of the active directory related services running on the domain controller.

Step 11 : Run Get-ADDomainController

It will list down all the configuration details of the domain controller.

Step 12 : Run Get-ADDomain example.com

It will list down the details about the active directory domain.

Step 13 : List The AD Forest Details

Same way Get-ADForest example.com will list down the active directory forest details.

Step 14 : Check if DC Sharing The SYSVOL Folder

Get-smbshare SYSVOL will show if the domain controller sharing the SYSVOL folder.

Drop your comment