On the Select features screen, select the check boxes next to the features that you want to install during the AD DS installation process and click Next.
Review the information on the Confirm installation selections screen, then click Install. Note : Information on the progress of the installation displays. Before you can promote the server to domain controller, you must start the remote registry service by using the following steps:. Under Services , right-click Remote Registry and open the Properties menu. After you have installed the AD DS role, you must configure the server for your domain by using the following steps:.
The Notifications Pane opens and displays a Post-deployment Configuration notification. Click the Promote this server to a domain controller link that appears in the notification. Enter your root domain name in the Root domain name field and click Next. Note : These selections affect features and server domain controller eligibility. For further information on domains and forest functional levels, see the official Microsoft documentation. The system checks if all of the necessary prerequisites are installed on the system.
If the system passes these checks, click Install. Note : The server automatically reboots after the installation is complete. Promotion now includes prerequisite checking that validates forest and domain readiness for the new domain controller, lowering the chance of failed promotions.
The Windows Server forest functional level does not implement new features and domain functional level is required only for a subset of new Kerberos features, relieving administrators of the frequent need for a homogenous domain controller environment. These changes may appear more complex, not simpler. In redesigning the AD DS deployment process though, there was opportunity to coalesce many steps and best practices into fewer, easier actions.
This means, for example, that the graphical configuration of a new replica domain controller is now eight dialogs rather than the previous twelve. Creating a new Active Directory forest requires a single Windows PowerShell command with only one argument: the name of the domain. As distributed computing evolves, Windows PowerShell allows a single engine for configuration and maintenance from both graphical and command-line interfaces. It permits fully featured scripting of any component with the same first class citizenship for an IT Professional that an API grants to developers.
As cloud-based computing becomes ubiquitous, Windows PowerShell also finally brings the ability to remotely administer a server, where a computer with no graphical interface has the same management capabilities as one with a monitor and mouse. A veteran AD DS administrator should find their previous knowledge highly relevant. A beginning administrator will find a far shallower learning curve. This topic assumes familiarity with previous releases of Active Directory Domain Services, and does not provide foundational detail around their purpose and functionality.
Windows Server Technical Reference. The Dcpromo. You use a graphical wizard in Server Manager or the ServerManager module for Windows PowerShell in both local and remote installations.
By running multiple instances of those wizards or cmdlets and targeting different servers, you can deploy AD DS to multiple domain controllers simultaneously, all from one single console. Although these new features are not backwards compatible with Windows Server R2 or earlier operating systems, you can also still use the Dism. AD DS role configuration builds on twelve years of field experience and now configures domain controllers based on the most recent Microsoft best practices.
The Server Manager AD DS configuration wizard merges many individual dialogs into fewer prompts and no longer hides settings in an "advanced" mode. The entire promotion process is in one expanding dialog box during installation. It is highly recommended that you discontinue use of Dcpromo. These new features are not backwards compatible to Windows Server R2 or older operating systems.
Attempting to run Dcpromo. Windows Server deprecates dcpromo. Administrators should discontinue its use and switch to the supported Windows PowerShell modules if they wish to create domain controllers from the command-line. Domain controller configuration also implements a prerequisite checking phase that evaluates the forest and domain prior to continuing with domain controller promotion.
This includes FSMO role availability, user privileges, extended schema compatibility and other requirements. This new design alleviates issues where domain controller promotion starts and then halts midway with a fatal configuration error.
This lessens the chance of orphaned domain controller metadata in the forest or a server that incorrectly believes it is a domain controller. This section explains how to install the first domain controller in a forest root domain using Server Manager on a graphical Windows Server computer.
The diagram below illustrates the Active Directory Domain Services role installation process, beginning with you running ServerManager. Any Windows Server computers accessible from the computer running Server Manager are eligible for pooling. Once pooled, you select those servers for remote installation of AD DS or any other configuration options possible within Server Manager.
Active Directory search uses LDAP, requires that the computers belong to a domain, allows operating system filtering and supports wildcards. Click Find Now to return a list of servers from that same Active Directory domain that the computer is joined to, Click one or more server names from the list of servers.
Click the right arrow to add the servers to the Selected list. Use the Add Servers dialog to add selected servers to dashboard role groups. The Add Servers procedure does not validate that a server is online or accessible. However, any unreachable servers flag in the Manageability view in Server Manager at the next refresh.
You cannot fully manage servers running operating systems older than Windows Server The computer you are running Server Manager on pools itself automatically. That option only allows Remote Desktop Service in a multi-server distributed workload. If you select it, AD DS cannot install. The Server Selection dialog enables you to choose from one of the servers previously added to the pool, as long as it is accessible. The local server running Server Manager is automatically available.
In addition, you can select offline Hyper-V VHD files with the Windows Server operating system and Server Manager adds the role to them directly through component servicing.
This allows you to provision virtual servers with the necessary components before further configuring them. Select the Active Directory Domain Services role if you intend to promote a domain controller.
All Active Directory administration features and required services install automatically, even if they are ostensibly part of another role or do not appear selected in the Server Manager interface. Server Manager also presents an informational dialog that shows which management features this role implicitly installs; this is equivalent to the -IncludeManagementTools argument.
The Active Directory Domain Services dialog provides limited information on requirements and best practices. The Confirmation dialog is the final checkpoint before role installation starts. It offers an option to restart the computer as needed after role installation, but AD DS installation does not require a reboot. By clicking Install , you confirm you are ready to begin role installation.
You cannot cancel a role installation once it begins. The Results dialog shows the current installation progress and current installation status. Role installation continues regardless of whether Server Manager is closed. Verifying the installation results is still a best practice. If you close the Results dialog before installation completes, you can check the results using the Server Manager notification flag.
Server Manager also shows a warning message for any servers that have installed the AD DS role but not been further configured as domain controllers. At the end of the AD DS role installation, you can continue with configuration by using the Promote this server to a domain controller link.
This is required to make the server a domain controller, but is not necessary to run the configuration wizard immediately. For example, you may only want to provision servers with the AD DS binaries before sending them to another branch office for later configuration.
By adding the AD DS role before shipping, you save time when it reaches its destination. You also follow the best practice of not keeping a domain controller offline for days or weeks. Finally, this enables you to update components before domain controller promotion, saving you at least one subsequent reboot.
Selecting this link later invokes the ADDSDeployment cmdlets: install-addsforest , install-addsdomain , or install-addsdomaincontroller. You remove the AD DS role like any other role, regardless of whether you promoted the server to a domain controller. However, removing the AD DS role requires a restart on completion. Active Directory Domain Services role removal is different from installation, in that it requires domain controller demotion before it can complete.
This is necessary to prevent a domain controller from having its role binaries uninstalled without proper metadata cleanup in the forest. Do not use Dism. Server Manager begins every domain controller promotion with the Deployment Configuration page. The remaining options and required fields change on this page and subsequent pages, depending on which deployment operation you select. To create a new Active Directory forest, click Add a new forest.
You must provide a valid root domain name; the name cannot be single-labeled for example, the name must be contoso. For more information on valid domain names, see KB article Naming conventions in Active Directory for computers, domains, sites, and OUs. That name should be unique and unlikely for web traffic. For example: corp.
A new forest does not need new credentials for the domain's Administrator account. The domain controller promotion process uses the credentials of the built-in Administrator account from the first domain controller used to create the forest root.
There is no way by default to disable or lock out the built-in Administrator account and it may be the only entry point into a forest if the other administrative domain accounts are unusable. It is critical to know the password before deploying a new forest.
The Domain Controller Options enables you to configure the forest functional level and domain functional level for the new forest root domain. By default, these settings are Windows Server in a new forest root domain. The Windows Server forest functional level does not provide any new functionality over the Windows Server R2 forest functional level.
The Windows Server domain functional level is required only in order to implement the new Kerberos settings "always provide claims" and "Fail unarmored authentication requests. In other words, you can specify Windows Server domain functional level only domain controllers that run Windows Server can host the domain.
This allows you the flexibility of a more homogeneous or heterogeneous forest in terms of which operating systems are permitted to be run on domain controllers. For more information about domain controller Location, review Directory Service Functions. The only configurable domain controller capability is the DNS server option. Microsoft recommends that all domain controllers provide DNS services for high availability in distributed environments, which is why this option is selected by default when installing a domain controller in any mode or domain.
The Global Catalog and read only domain controller options are unavailable when creating a new forest root domain; the first domain controller must be a GC, and cannot be a read only domain controller RODC.
The specified Directory Services Restore Mode Password must adhere to the password policy applied to the server, which by default does not require a strong password; only a non-blank one.
0コメント