Introducing and Installing Active Directory

0:00[MUSIC PLAYING] All right, as we get started with the AZ-800 course, it's kind of fitting that we really start with Active Directory because, really, Active Directory forms pretty much the underpinnings of Windows Server 2022 and all the versions before it, really, because Active Directory is responsible for so many things in a Windows computing environment. So Active Directory, also known as Active Directory Domain Services or AD DS, this is really just a structured data store of objects.

0:37So you may have already had experience with Active Directory. You may already be very familiar with some of those things. If that's the case, we'll just kind of review this real quick for you. But for some of the rest of you that are getting started with Windows Server and getting started in an Active Directory environment, you might need to know some of this. This is going to be kind of an overview of some of the things that we'll be covering later on in this course. First of all, it's going to be where the users are stored, where the user accounts are stored mostly, mostly. Why do I say that? You can't actually store a user in Active Directory, but you can store their accounts in Active Directory.

1:09And this would include everything, such as their username, their password. You may choose to include an email in there, which department they work in, their address. All kinds of things you can put in there, but the main things that we generally think of in terms of the user account is, of course, going to be the username and password. And the reason why that's significant is because that will then be used to log on that user, and so that they can access resources, either on their own local computer, like a Windows 11 computer, for example, or elsewhere throughout the entire environment.

1:42And also, the computer accounts will be stored there as well. The computers will have a unique identifier. Users and computers both have a unique identifier associated with them. And you may not know it, but computers actually do log on as well. There's not somebody that types in a password there, of course, for the computer, but the computer does have a randomly generated password that gets refreshed every so often, and so it does actually have an identity-- a security identity there. And then, of course, we will have groups. These are all things that are going to be part of the data store in Active Directory.

2:15So you could take users and put those into groups. You can take computers and put those into groups, and you can take groups and put other groups inside of other groups, or nesting groups is another way to say that. And the basic idea there with the groups, of course, is that it's going to make most administration simpler later on down the road when you start to assign resources to-- assign permissions to various resources, such as file permissions, for example. There are other types of objects that we think of there as well that do go into Active Directory. We're not going to exhaust every type of an object that can go in there, but you can have printers that appear in Active Directory.

2:50That makes them easier to find for your users, especially in larger organizations where they might be going into a building in a campus that they've never been in before and they need to find a printer. Well, you can make them easy to find there in Active Directory. Shares can also be easily found in Active Directory. They don't have to be put in Active Directory, but certainly, that's a possibility. And again, it makes it very searchable. That's a big part of what this data store is, by the way, is that it's going to be more easily searchable by its very nature. We'll talk about that again here in a moment. And then we have something called Group Policy Objects, or GPOs.

3:23This is actually a combination of both a file location as well as in Active Directory, group policy objects do exist there as well. And group policies really centrally control most everything that the user can see or do on their computers, as well as many other things related to Windows. So a lot of things involved. They're very, very powerful. Thousands of different separate settings that can be configured in a group policy, and I'll be talking about that in much more detail later on in this course.

3:54Like I said, it is easily searchable. A big part of the reason for that is something called the global catalog which has every object that's in Active Directory. And because of the nature of it and the way that it's stored, it's very easy and fast to search against. Your users don't have to know about that. Even we as administrators don't have to know that we're searching using the global catalog. We just do a search and we get results, thankfully. Active Directory also has security features integrated directly into it. So for example, when these users or computers log on, or we get our credentials checked to see if we are members of certain groups, one of the things that's going to be done involving that will be a security check against our tickets.

4:35There's tickets that are issued in this and that's going way beyond what we need to talk about right now, really, but they're Kerberos tickets is what they're called. And users are issued Kerberos tickets when they log on. They're very secure tickets that can be used, and it's just all integrated into Active Directory. And Active Directory by its very nature is logical and hierarchical. So we'll see this as we go on throughout this course, but for example, you might have at the top of your domain here in kind of diagram fashion. Normally, domains are represented by a triangle like this.

5:08And you may have domains that have child domains like this. So that would be another like a subdomain or a child domain that appears underneath there, for example. And then also within this, you'll also have things such as organizational units. And an organizational unit might be a state or a city. Let's say this is Phoenix. And within Phoenix, you might have a department. So maybe this is HR. That's another organizational unit. You may also have other OUs underneath Phoenix, I don't know, for the IT department. All different kinds of departments, different purposes for these organizational units, and so forth, but the point I'm making here is they're all hierarchical.

5:43Same with our domains and our child domains, if we have any. And it's important that they are logical and hierarchical so that they're easier to think through when you're trying to find things. I mean, yes, they're searchable, but it also helps just as humanly speaking to be able to see the kind of hierarchy that's involved there as well. There's something else in Active Directory called the schema. We're not going to delve into that right now as well, but it's kind of the skeletal structure for things that appear within Active Directory. So for example, if you had a user account, how do we know what we can put into a user account?

6:15Well, I mentioned a few things we could put in there earlier, right? Username, of course, a password, of course, but how about other things, such as which department they work in? Well, the reason why that appears in the user account and you don't have to put it in-- you don't have to enter in something for that, but you can-- the reason why that even appears is because of the schema. It kind of defines all of the various fields, if you will, all the various checkmarks and so forth that you can define within a user account. It defines all of the objects. So an object would be something like a user account, for example, or a computer account.

6:46And then the attribute would be the specific item that you can select or configure within the user account, within the computer account, or whatever it is. And they are also effectively replicated. So all of this stuff that we have-- let's say that we have this domain here-- in most organizations, you're going to have a domain, but you're going to have a domain controller here as well. And the domain controller is what stores your Active Directory Domain Services. That's all stored usually on a domain controller. But normally, you have more than one because from failover, as well as load balancing and all kinds of other reasons, but you'd have more than one.

7:24And a copy of your users, for example, on this domain controller, as well as everything else that's involved in Active Directory, would be copied over to this other domain controller. It's an exact copy. And it's a peer domain controller. One is not superior to the other in any way. Later on, we'll be talking about something called Flexible Single-Master Operations. And these are also known as FSMOs. And they are special roles that each one might have, but as far as the accounts go, one is not really special compared to another.

7:54And they are called peer domain controllers because they are on kind of a peer level. But regardless, these peer domain controllers have a replication mechanism kind of built into them, where anything that changes-- maybe this user right here changes their password-- well, we need to have that reflected over on the other copy of the user account over on this other domain controller, right? That happens almost instantly in a single site within a single domain. So there's really hardly any lag time there at all. And if you have a domain controller, let's say, that's in a different city, somewhere else in a different site, there's also an efficient replication mechanism that makes sure that that's still replicated over there in a practical and timely fashion.

8:34And that's adjustable a little bit here as well. Again, a lot of these things are just overview topics. We could get into more details with some of these things a little bit later on, but that's just kind of an idea of what Active Directory Domain Services does and the kind of things that it's used for. All right, so that's it for this Nugget. In the next Nugget, we'll be talking about some things that are new in Active Directory Domain Services. I hope this has been informative for you, and I'd like to thank you for viewing.

0:07About a year ago, I got a brand new truck. And it was really cool because it has a lot of computerized new features that I didn't use to have in some of the older cars that I would drive. And it would do things, like, tell me when I'm about to depart out of my lane. Lane departure, I think they call it. It also has this collision avoidance thing where if you come up too fast on a car or if a car slams on its brakes in front of you, then it will beep, and it'll automatically warn you. And then it'll even apply the brake, if necessary. And before all of those whiz bang automatic features to correct your driving, I used to have to depend upon my wife.

0:40That didn't come out right. I still have my wife. It's just that this computer is an upgrade. That's not right, either. Anyway, let's move on. One of the cool things about getting something new is that it has upgraded features, and we certainly have some of those things here in Active Directory Directory Services. One of those things-- and we're going to be talking about a lot of these things in much more detail in this course as we continue on. So we're not going to cover all the details right now, but I want to give you the bullet points of some of the cool things that are included. And then in our next Nugget, we'll actually get started with the installation of Active Directory.

1:13So first of all, some of the things that it includes are something called Privileged Access Management. That's an encompassing term that involves a lot of different things. But some of the new things that are involved in that, first of all, would be something called a bastion forest. And this, again, it's just an overview, a quick top-down look at it. Here's your domain, and then you might have an IT department. You have to have an IT department, right? But the IT department can be this bastion organization where the security requirements are higher, some of the security protections are higher.

1:45It's known good in terms of knowing that there's no breaches in that domain, and everything like that. So the accounts that we can have here are much more highly protected accounts. And in fact, because of the way that it inter-operates with our other domains here, for example, if this gets compromised somehow, it can't even reach down in here. It doesn't have privileges into doing that. I'm way oversimplifying things here, but that's the idea of a bastion forest. It gives you a higher level of protection, and you can put more protected accounts in that domain or in that forest.

2:18And there's also shadow security principles. What this does is it's a special SID that exists in the bastion forest, and it allows you to apply permissions administratively to a resource without actually changing the ACL. Kind of weird, right? Anyway, we also have something called expiring links and this would be useful because we might have somebody right here that we want to perform some administrative task on a resource, but we want them to be able to do that maybe today or even this afternoon. But we don't want them to have permanent access to whatever it is we're granting them.

2:50Well, you can put expiring links on that. So they have access only till the end of the day, and they won't have access tomorrow. It uses a special time to live, or a TTL, that's associated with this specific Kerberos ticket item. In addition, we have something called KDC TTL enhancement. So what that is, let's say I've got this user right here-- and let me clean up a little bit. This user right here is a member of group 1 and of group 2. And let's say that group 1, their ticket-- if you're familiar with Active Directory and Kerberos and all of that, when you log on, you get tickets.

3:22And in your tickets, there's an association with the groups that you're a member of. Well, they have a time to live because you don't want those tickets to live forever because the longer a ticket lives, for example, the more time a hacker or some bad actor has to be able to manipulate it or to exploit it somehow. So on an active login process then, where the user's actually on the computer regularly and stuff like that, it's going to renew itself every now and then. But what we have going on here is we have a TTL, time to live, for maybe each one of these groups that we're a member of.

3:53Maybe this one has a time to live-- let's say some time has elapsed. They have one hour left. And this ticket here has two hours left on it. And what happens is this KDC TTL enhancement, it will default to the lesser of the two. So if we're a member of a shadow group, which we talked about just a moment ago, if we're member of a shadow group, then what will happen is it'll default to the lesser of the two values here in our two groups. We also have improved monitoring, which makes collecting of the data for monitoring your Active Directory much simpler.

4:26We have Windows Hello for Business. Now if you're familiar with Windows-- what it'd start in? Windows 8, I think it was. And we also had it in Windows 10 and now in Windows 11. Windows Hello was where you can log on with a camera. I've got a camera right over here. It's a webcam that has infrared capabilities and it's Windows Hello capable. And so when I log on to my computer every day, I just use that camera. I just look into the camera, and about a second or even less, it logs me on. I also have a fingerprint scanner under my desk somewhere and I also have a key. So several different ways that I can log on here.

4:56It's a key-based authentication mechanism. Well, that has now been also transferred into Active Directory here as well. That's part of the capabilities here. And what happened here is it avoids passwords. So, for example, I'll be honest. Time for true confessions here. This computer, I've been using it for maybe a year, and I know I set a password on. I haven't used the password for over a-- I don't even remember the password. There's ways of recovering it if I actually have to use it, but I've been using this camera over here for the whole time. I don't even remember my own password anymore.

5:28And that's good in a certain way. Why? Because I'll never type it in because I'm using that camera, or I can use my fingerprint scanner. Therefore, there's no password to exploit. There's no keystroke logger or spyware that can capture my password at this point. So even though I'm not using a password, it actually increases my security. And, again, you can use things like a pin as well. That's also considered part of Windows Hello, and it's associated, by the way, only with this one computer. So I couldn't use that same pin and log on to another computer. A lot of this also involves things like Trusted Platform modules, or TPM chips, which can store cryptographic or authentication data within them.

6:04And it can be-- and it's isolated to that one computer because it's a physical device on the motherboard. Now also we have something called Azure Active Directory Join. This has actually been growing. This is part of what I was talking about earlier when I was saying not all of this is strictly new with Server 2022 and Active Directory. This has been going on for a while because Azure has been a growing technology and a growing cloud service from Microsoft that we've been able to use. Azure Active Directory Join is available under many different versions of Active Directory. But the basic idea here is, when you use it, you can join your own local Active Directory on-prem by using a connector tool to Azure Active Directory.

6:43And then you can have resources from both that are interchangeable or exchangeable. You can get modern settings using a corporate account. And when we say modern settings, what does that mean? Well, that means you can do things like access the Microsoft Store using your work account. You can have Live Tiles that are associated with it. You can have things like backup and restore. Some personalization settings that will transfer back and forth between maybe a work computer and a home computer, or something like that. So there's a lot more of an interoperability and an exchange that goes on here when we have Azure Active Directory Join.

7:14What this also allows us to do is to access corporate resources even if you're not joined to the domain. That's what I was just talking about there. And a lot of that has to do with bringing your own devices items, BYODs. Also, we have single sign-on for things like Office 365, your organizational applications that you may have developed that are part of the Microsoft Store, for example. Websites, things like that. So this has really greatly simplified the access that users have so that they can use work devices or BYOD devices or work from home, and still be able to access all the resources they need both from their home computer and from work devices.

7:55And with their own devices, the BYOD devices, part of that's going to be involving the fact that they can add a work account to their own device. And just for giggles, I thought I'd go ahead and show you what I was talking about when I talk about accessing work resources with a BYOD device. So, for example, this is my own personal computer here, but if I needed to connect to a corporate resource or an educational resource like a university computers or something like that, then I could do that right here. I would go down into Accounts right here. This is Windows 11 by the way, but it's similar in Windows 10.

8:25The UI is a little different, but same basic idea. And I would just go down here, and then I would go down to Access Work or School. And then you can add or work or school account here, and connect it. And then you'd have to just fill in the credentials and everything else that you need there, your email address and so forth. And then, henceforth, you could do things like transmit back and forth your personalization settings between your working personal computer. Or you can access Microsoft Store applications that are available because of your work account. You could use Office 365 here on your own personal computer at home even though the licensing is all from your company.

9:02All right. That's enough for this Nugget. Stick around for the next Nugget, where we'll actually get to work installing Active Directory. I hope this has been informative for you, and I'd like to thank you for viewing.

0:07All right, I promised you in our last Nugget that we are going to start installing a domain controller. And that's exactly what we're going to do here. Before we do that, however, I think it is important to discuss a little bit about what privileges you need to have. And I want to, again, go over the hierarchy of a domain environment here because that's something that especially if you're not used to domains and Active Directory domains can be confusing at the beginning. So here we'll have-- we'll start off with a single forest in a single domain. Let's call this nuggetlab.com because that's what we normally use in our labs.

0:40And by the way, we can have labs that you can do with this as well if you want to later on when I get started installing. I'll give you more details about that later. So that might be all I ever have. So this would be a domain of nuggetlab.com. And it would be a single forest. How do you spell forest? F-O-R-E-S-T, forest. So in other words, this forest, the way it looks now, consists of only a single domain. That's it. Now what else could I do here, though?

1:11Let's say we have another domain that we want to install here that's a child domain of that original domain here. So instead of nuggetlab.com, now I'm going to have-- let's just call this phoenix.nuggetlab.com. It might be for a number of different things. It could be a subsidiary that we have. It could be geographic, like this-- Phoenix, it could be a department, something like that. A lot of different reasons for creating a child domain. Or I might have different security requirements down there that require a different domain. But regardless, I now have a child domain here connected to the same namespace.

1:46So this is just Phoenix, but now it's phoenix.nuggetlab.com So this is another domain in the same forest. This domain down here is a member of the same forest. It's hierarchically connected, The other thing we could do here would be to create another tree. This one might be more likely to be the case if I did have a totally different business unit, but I wanted it to be within the same forest. So maybe this one is called accusource-- that's the name of one of my domains-- so accusource.com-- .net.

2:17Excuse me. I'm forgetting the names of my own domains. Accusource.net-- I'm just going to abbreviate that. So I could join that. It's a different namespace. But when I create that and I join and I create that domain, I can join it to this existing forest right here. It could be its own forest if I decided to do that. Or in this case, I join it to an existing forest. The name is different. But in terms of its schema and its identity and its Active Directory existence, it's part of the same forest right here.

2:49Now, expanding that a little further, in each one of these domains, what do you have to have in order to have a domain in Active Directory? You have to have a domain controller. So when we first created this existence, this forest here with this nuggetlab.com domain, we had a domain controller. Very likely, we have multiple other domain controllers, especially in a larger organization. But even in a smaller one, you want to have more than one domain controller for failover, possibly for load balancing, but mostly it's going to be for failover. And as I mentioned in a previous Nugget, these are peer domain controllers.

3:22Likewise, in this child domain, I also have two or more domain controllers. And in this other tree over here, this is a separate tree in the same forest, which, again, may have its own children as well, then I'll also have two or more domain controllers for all of this over here. Now, what's the significance of this, and why am I emphasizing that? Because when we talk about Active Directory installation, I want you to be aware of credentials that might be required there.

3:52So let me clear the screen here and talk about that. When I created a new forest-- remember, that's what I created that first triangle way up at the top there-- all I have to have there in order to install that first forest is a local administrator account. We're going to see that coming up here in the lab. Also, if I had a new child domain-- remember, I created-- what was it? Phoenix.nuggetlab.com-- in order to create that domain, all I would have to have for credentials there would be an Enterprise Admin. Now, the Enterprise Admin account, it's actually a group.

4:23I have to be a member of that group up here in the forest root. Now, that account that's a member of this security group can install this child domain. Or if it's a member of the Enterprise Admins security group could also create another tree with a totally different namespace, like accusource.net. So this user here, remember, if it's a member of the Enterprise Admins group, they could also create this other tree over here when they install the domain controller over there. Now, if I wanted to add an additional domain controller to an existing domain-- remember, because we have more than one-- then all I have to have there in terms of credentials are Domain Admins security membership, security group membership, in the same domain.

5:07So if I created this second domain controller here, the second peer domain controller in the forest root, that's all I'd have to have is a Domain Admin privilege. Also, down here in this child domain, all I would have to have to create this second domain controller over here would be membership in Domain Admins in that domain. And likewise, again, over here, I would have to have Domain Admins membership in this domain over here in order to create that second domain controller. Now, on your lab machines, as well as this machine that I'm working on right here, there should be a static IP address.

5:41So I'm going to right-click on the little network icon down here, Open Network and Internet Settings, go to Ethernet, choose Change adapter options, and then right-click on our ethernet connection there to choose Properties. Once I've done that, I'm going to TCP/IPv4 here. And I've already entered in my settings here. Your IP address may not be the same as these. But it should be a static IP address that we'll have there. And we're going to point to ourselves, to our own loopback address of 127.0.0.1 for the preferred DNS server.

6:12Now, the reality is we don't have DNS set up yet here. Now, you may have a different preferred DNS server down there. If you do, just go ahead and enter in the loopback address that you see there, 127.0.0.01. Even though this is not yet a DNS server, it will be in just a few moments. Now, here we'll go ahead and go to Add roles and features. This is how we would do all the rest of this through the UI. So once I click on that, it just gives you an introduction here. It looks like I've scrolled down here. Let me bring that up a little bit. So then once that's been opened up, we'll click on Next.

6:43Then it says, role-based or feature-based installation? Ever since 2000, Windows 2000, 21 years ago or so, they've never made a very good distinction between what's a role and what's a feature. So I still don't even know. I just click Next until I find what I need. And then what I want to do is to install, to select a server from the server pool, which is just this local server that we have right here. Otherwise, I could choose to enter in a name here. But we're really just going to do this locally. You can also install this stuff remotely if you want to, though.

7:15And then what I'm going to do is to add Active Directory Domain Services that you saw me select right there. And it automatically adds in several other tools that are needed. And you can see here that's it's also clicked right here by default to install those tools. There's not really much reason not to do that. I guess if you wanted to make this a dumb server, so to speak, so that there was no real interaction, no real configuration that can be done here-- and that's sometimes the case if you have a server that's just sitting in a rack that you want to always remotely administrate. I guess you could do it that way because you'll have the administrative tools on your local machine.

7:48Usually that's going to be a Windows 10, Windows 11 computer that has administrative tools installed on it. I'm getting out of scope here a little bit. But a lot of times, that's how we administer these machines is remotely. But we're going to do everything locally here just to make it a little bit more intuitive. Then we'll just click on Add features here. Then we'll click on Next. Now, the other thing we have here is that notice that there's also a Group Policy Management feature that's going to be added in here. That's an essential part of Active Directory. So we'll click on Next there.

8:19And then there's a new thing here that didn't appear in some of the previous versions of Windows Server, where it's now emphasizing Azure Active Directory. Again, we're going to have a lot on that coming up, especially from Daniel as he continues on from some of our Azure integrations here. But there's the Azure Active Directory Connector Tool and some other things that we can do to make this interoperate with our cloud services. So we'll just put a push pin in that for now and click on Next. And then what we're going to do is click on Install. Now, once we click on Install, you can see that it gets started here, and it's going to continue to do its business.

8:53I'm going to let it continue to do that. And then later on, what I'm going to do is I'm actually going to end the lab and come back in here and do this using PowerShell instead so you can see how that works. It's actually pretty easy. But all this is doing right now, by the way, is installing the skeletal structure, the tools that we will need to have Active Directory. Active Directory itself is still not installed. In the old days, we would use a tool called DCPromo, and you would type that from a command prompt, and then it would open up a wizard and you'd Next, Next, Finish your way through it.

9:24Here we're just going to choose this option. It pops up right now, in fact-- Promote this server to a domain controller. So we'll choose that option there. And then we'll choose whichever option applies to us. Add a domain controller to an existing domain-- remember, we're not doing that. We're getting started from scratch, installing the forest and everything. Add a new domain to an existing forest-- that might be like if we had a child domain, or if we wanted to install another tree in the forest. But we're going to Add a new forest. And I'll have to enter in the root name of this forest. So I'm going to call this nuggetlab.com, and then we'll click on Next.

9:59Now, I do want to emphasize-- I guess, supposedly, in a lab it's probably OK to do it this way. But you could do nuggetlab.local or somedomain.local. A lot of organizations used to do that in the past because they didn't want to confuse their local-- let's say we did have a company called nuggetlab.com. And we had an internet presence, and people can order our products by going to our website and all that kind of stuff. But we also had a nuggetlab.com for our users, joe@nuggetlab.com or email addresses, and that was the name of our Active Directory domain.

10:31Well, the concern there was that we did not want DNS to get confused and to route internet requests to our internal network somehow or to create a vulnerability or any of that kind of stuff. There's other ways of resolving that, Split-Brain DNS and some other things, but one of the ways that people used to do that as well would be they would say, you know what? Instead of nuggetlab.com, which is our website and our internet presence, we're going to change this to nuggetlab.local. And it actually worked OK for a while. But there were some other DNS complications that came up as a result of that, not the least of which is if you have Apple computers, they see .local in a little bit of a different way.

11:09So that kind of fell out of favor a few years back. So now you have to use either Split-Brain DNS or some other DNS tricks or just have to get creative with your naming and call this, I don't know, internal-nuggetlab.com or something like that. That's just a side note. But that is something to be aware of in your naming. You have to figure that all out in advance. That has to be done through meetings and writing on whiteboards and all that kind of stuff. Anyway, we've decided to use nuggetlab.com, so we're going to click on Next.

11:42The next thing here is it's going to ask us for our forest functional level and our domain functional level. Now, here's the trick. The most recent one you can use is Windows Server 2016. There's different versions of this. You see it goes down to 2008. Previous versions besides that are deprecated. You can't use those anymore. And in fact, you almost always want to use the most recent one you can. So 2016 would be our preference here. The reason for that is with each one of these, as it progressed up through the versions, it added new features to Active Directory.

12:14And if you want to make sure that you have the most features available to you-- and some of these are security-related, too, so that's a good idea-- then you'd always want to go with the most recent one that you possibly can. Also note that we're going to install a DNS server here. And we're going to make it a global catalog server. Remember, I talked about that in a previous Nugget. The global catalog is just a copy of every object that you have in Active Directory. And you can think of it as an index. So it makes things searchable much faster. It's faster to search against the global catalog than it would be to search against actual Active Directory.

12:47And then we could also make it a read-only domain controller, which is a discussion for a different day. But that's exactly what it sounds like. It's read-only. Then we will enter in the password. Now, this is going to be important. You need to make sure you keep a hold of this. Have it stored somewhere secure because what this will allow us to do is to boot into a special version of-- Directory Services Restore Mode is what it's called. And you can see that right there. And this is what we would do if we needed to recover some deleted objects, or if we needed to repair Active Directory, or something catastrophic had happened like that, or to restore it.

13:21So be aware of this. So we'll go ahead and click on Next there. This is about delegations. We always get this message. We have since the beginning of Active Directory. It's not really relevant in our case because we're creating the root of a new DNS infrastructure with a new forest and everything, so it doesn't have to have the ability to be found by any external DNS servers. So that's not going to be an issue for us. So we'll click on Next. And then what's going to happen is this broadcasting right now. We can't really see that happening. But it's shouting out and saying, is there a NetBIOS name of nuggetlab anywhere in my organization?

13:56And if it can't find one, then it will return nuggetlab right here as available. On the other hand, if it had broadcast for nuggetlab, and it got an answer back from some server somewhere or some identity, then it would say, oops. That's already been taken. And then we'd have to get creative and call it nuggetlab-1 or something like that. But we're OK here. So we'll click on Next. And then it asks us where we want to store all of our files related to Active Directory. There's the database folder itself, NTDS, which also contains the log files.

14:29And you can see that there as well. And the SYSVOL folder, which contains a lot of components of Active Directory. But more particularly, it also contains files associated with Group Policy objects. And those will be also, then, replicated to other peer domain controllers in our organization and other domain controllers. So that's where the location is. Now, the significance of this is changed a little bit over time. When Windows 2000 came out, and we had these default locations on C, a lot of administrators would recommend putting those elsewhere because, they'd say, well, we don't want it to get-- we don't want the database and the logs and SYSVOL to get hammered on the domain controller.

15:05So put it on a different drive on the same computer. That way, you split the burden off. Well, think about when that was in Windows 2000. Now, 21 years later, we have SSDs. We have much faster computers. Everything is faster. So it's not really as much of an issue to put that on the same drive now as it used to be. So I'm not really reluctant to put those there. I'll just leave them in place, and that'll be fine. Then we'll click on Next. It gives us a handy little summary. But here's what I want you to see-- View script. This is what we would do in order to make this an Active Directory domain controller using PowerShell.

15:41I'm going to come back to that here. So put a push pin in that for now and be aware of the fact that this option does exist. What we could do next is to click on Next. And it would actually perform all of the installation. What I'm going to show you here is all the PowerShell commandlets. So let me make this a little bigger so I can see it a little bit better. And this is what we're going to do. So the first thing that we did when we were in Server Manager before was we wanted to install Active Directory Domain Services, including all the tools.

16:11Well, this is the PowerShell commandlet that'll do that. Very, very simple. The next thing we could do, all the things with the pound symbols or the hashes here, those are all just remarks. So don't pay attention to those. But this is where I could put in additional commandlet arguments if I wanted to. But I don't really need to in our case. And then down here, I would import the module for Active Directory Domain Services Deployment, or ADDS Deployment. And then it would pull in those modules that would allow us to do further Active Directory PowerShell commandlets.

16:45Then I want to do this. I would install the active ADDSForest. I just pulled this, by the way, from that script that I showed you a moment ago, back when we were first installing everything, remember? So this is just pulled directly from that. And you can look at those and pause the screen if you want to and look at these. And you can see all of this stuff that it's doing. It pretty well explains itself. But what I'm going to do is I'm going to just Control-A to select all of this, and press Control-C to copy it. And you can do the same if you like. And then what I'm going to do is go down here to this PowerShell icon on the taskbar and Run ISE as Administrator.

17:18And the reason why I'm doing that is simply because I like to run it out of that only so that I can-- wow. That looks weird. I'm not sure what happened with our visual there. Let me try that again. Let me close that and open it up again. I don't know why it's doing that. It's something weird going on in my machine right now. But I think we'll still be able to get everything to work. But I'm just going to paste all of that in. And then don't pay attention to the checkerboard looking thing down here at the bottom. That's weird. So we're just going to run the first line here. But I'm going to put my cursor in this first line right here.

17:49I can't run all of this at once because it doesn't all exist yet. But I'm going to run that first line here to install the Windows feature of Active Directory Domain Services. And you can see now that it's actually just doing that. And after a little while, it finishes. And we do get this message here-- Active Directory Domain Services, Group Policy, everything success. And then, now we have all the tools that we need. But remember, Active Directory itself is not installed yet. So what I want to do there is to do all the rest of this. And this, again, you can pause and look at this, if you want to, in a little bit more detail.

18:20But we're now going to do all of this stuff right here. So I've selected all of that. And now I'm going to click the little Play button again. Sorry about this checkerboard. I can't seem to get it to go away. But anyway, SafeModeAdministratorPassword, this is the Directory Services Restore Mode password that we need to use. This is interactive. So I'm going to enter that in. And you can also click off to the side there where it shows the password. And it should click right in here. But I'm typing mine in. And then we'll just click OK. And that's pretty much it. It'll give you some of the same messages that we got previously when we saw the installation of Active Directory in the UI.

18:56But those were innocuous. Nothing really to be concerned about. And we'll just let it do its thing. And then notice that the system will reboot, because after installing Active Directory, it does have to do that. And now notice that it's prompting me to sign into nuggetlab here because the domain now exists. And that's exactly what I'll do. And here we go. Now just to make sure that this car we bought actually has an engine under the hood, let's look under the hood and see what's here. And for that, I'm going to go down-- I'm going to minimize Server Manager here. We don't really need to use that. We can get to the tools that we want through Server Manager.

19:28For example, there's ADDS, which just popped up, and DNS, which just popped up as well. It's a little bit cumbersome, though. Most administrators, instead what we'll do is we'll go into something like Administrative Tools here. And then anything that we need to access frequently, we'll just put a shortcut somewhere. So Active Directory Users and Computers is one of the most commonly used Active Directory tools, so I'll right-click there. And I can pin that to the taskbar. There it is, pinned to the taskbar. And then, now it appears here. Similarly, we could do-- what's another one?

19:59Group Policy Management is another frequent one that we use. I could add that if I wanted as well. But I'll just go ahead and click this for Active Directory Users and Computers. And then when I open this up, we'll see that there indeed is our domain. And then what I could do is to add a user account if I wanted to. There's all the groups that we have. The other thing I'd want to check is DNS because if DNS is not working, Active Directory is not going to work either. Very dependent upon DNS. So we'll go to Administrative Tools here again and go down to DNS. And once I'm in this, we just confirm that.

20:30Yep, there, sure enough, there's my DNS server, which is also in this case, my domain control. That, by the way, is a common role for domain controllers to share. Many, many domain controllers are also DNS servers. And these are also pure DNS servers, by the way. So I can select that and open it up. And we can see our forward lookup zones. There's my nuggetlab.com. Here's the host record for my server. I guess it applied a different static IP address to it, but that's all right. And then what we also have here is how it's located.

21:00Now, it's going to get a little bit beyond our scope for what I want to show you here. But just so you know, your clients on the network-- so, for example, you get someone logging on to a Windows 11 computer using their domain credentials for the user account that exists in Active Directory. That computer has to find the domain controller somehow. How does it do that? Through DNS. And it does that in its site. So, for example, if it's in the same site, then it can locate it through TCP here. And it can find, for example this LDAP record, which is Lightweight Directory Access Protocol.

21:32This is part of how it finds the domain controllers, through all of this stuff here-- its kerberos server, which is another name for, in this case, a domain controller. It uses these SRV records to be able to find that. So that's all we're going to talk about there for the time being. But that's why DNS is so critical to Active Directory because that's how it gets located. All right, wow. That's a lot for one video. I hope this has been informative for you, and I'd like to thank you for viewing.

0:06All right, then real quick here at the end of this particular skill, I wanted to show you how you would add computers to an existing domain, how you would create a new child domain, for example, in the same forest, or how you would even create a new tree. Actually, those two things are very similar. But let's take a look at how we would add in an additional domain controller to an existing domain. So in a previous Nugget, we had dc01-22. That's our domain controller, the first domain controller that we installed, interactive directory forest of nuggetlab.com.

0:37And here we have another computer. They look the same. The wallpaper's the same and all that. But if I take a look at this and go to the system, you'll see here that this computer is dc02, and it's not a member of a domain. It's just a standalone server. You can see that a little more clearly if you go to Advanced system settings over on the right. This is how we always used to do it in the old days before Microsoft had us using these fancy settings. But you can see here that it's just a member of a Workgroup. One thing I could do, if I wanted to just join this computer to my existing domain, is I could click on Change and then I could choose Domain and then add in nuggetlab.com right here.

1:16And then henceforth, once I click OK and possibly enter credentials-- might be necessary, as well-- then it would restart and it would be a member of that domain. I could do the same thing for a workstation, like a Windows 10 or 11 computer, for example. But that's not what we want to do here. And that's not how I would make this an additional peer domain controller. So let me close everything up there. And then what I would do here is I would do a similar thing to what I did in a previous Nugget, where I created our domain controller. I would add roles and features. And again, there's several different ways you can do this.

1:47This is one of the ways. And I can Next, Next, Finish my way through. Or since Microsoft wants us to use PowerShell instead for whatever we can, let me just do it that way. And so I'm going to go to my search area down here at the bottom and just type PowerShell. PowerShell right there. I'm not going to use ISE this time. It kind of gave me a weird result last time. So I'm just going to use Windows PowerShell. And there's not that much to what we're about to do, anyway. But remember, what I can do is to just type in the command again, Install-WindowsFeature.

2:17And I don't know why PowerShell has it this way by default, but the little gray areas here for the options are very difficult to see. I guess we could change that. But just so you know, this says -name or hyphen name. And then what we're going to install is Active Directory Domain Services. That's similar to what we did, and actually, like the same thing that we did using a command line in our last Nugget. And then -IncludeManagementTools. And then I added in a -WhatIf, just so that you can know about that. When you use a -WhatIf, that will show you what would happen if I were to run that cmdlet with those options.

2:52But it doesn't actually commit to making any of those changes. So I could just press Enter. And then here, you can see it looks like it would install all of these tools. It tells me that it would be successful if it were to attempt to do those things. And it says Restart, Maybe. Now why is that? Because it knows that if I were to use those tools to join this computer to an existing domain or any other domain-related function, such as becoming an additional domain controller, creating a child domain, creating another tree, all those types of things, those domain controller-ish things, then it would require a restart for those things.

3:26Actually installing the tools that by themselves does not require a restart, though. So what I can do here is now I'm going to do the same thing, but I'm going to take off the -WhatIf. And this is just going to exactly do the same thing, like I showed you on our last Nugget, doing it as if I had done it in the UI. It's just using PowerShell instead. And when it's finished, it just gives me the exit code that it was successful. And so we're now good to go. And then I'm going to actually use PowerShell ISE because I'm not getting that weird checkerboard that I had in the last Nugget. So we have two cmdlets.

3:56One, I'm going to import the module for ADDSDeployment. We talked about that in our last Nugget. And I'm going to install ADDSDomainController. Too many Ds in here. I'm like, A-D-D-D-D-S. Anyway, so oh also, let me point this out. You'll see that there's this strange little mark right here. It's kind of like a backwards apostrophe. That's a backtick. And in PowerShell, normally, you would enter in the cmdlet, which is -Install-ADDSDomainController in this case, and then followed by hyphen and then whatever else you want.

4:26So -NoGlobalCatalog, all of these other things. Normally, those would all appear on one line. In order to make it more readable, though, you can do a backpick, which is kind of that backwards apostrophe that we see there, and then put those all on a separate line and it'll be treated as if it's all on a single line. OK, so that's basically all that's really doing. Now let me run this. Hopefully, I'm entering in the credentials correctly, I didn't enter any typos in the password there. We'll enter in the safe password and do that again.

4:58This is very similar to what we did when we joined created a domain controller in the first place. And then now we see it's going ahead and doing all of its various functions. And we see that it's installing the domain controller. I don't know if you saw it. It kind of flashed up real quick there. But it showed that it was replicating all the schema objects and everything, all that kind of stuff. So remember, it does have to restart since it's going to be a domain controller now. So let me close all of this up. And it should restart. There it goes. I was going to restart it manually if it didn't restart soon. And then now when it comes back up, we'll see that we have a peer domain controller in the same domain.

5:30OK, and here you can see the computer has restarted. I've gone to Server Manager and to ADDS. You can see that the server name is DC02. That's this computer. That's not the original domain controller, which is DC01. And now I am a domain controller. From here, I can access the administrative tools, such as Active Directory Users and Computers. And if I create a user account, for example, then it would also appear on DC01 because we are peer domain controllers. And in the same site, it's almost instantaneous, any changes to Active Directory. So in fact, I'll just click the little icon to create a user real quick.

6:03I'm just going to call this person Joe User. Enter in a password, and then Next and Finish. There's my Joe user right there. And then if I flip over real quick to my other server, and here I am on DC01-22, then if I go into Active Directory Users and Computers and go to Users, you can see that, sure enough, there's Joe user, because that account, remember, was created on DC02. We're in the same domain, peer domain controllers on the same site. It gets replicated almost immediately to this local copy of Active Directory, as well.

6:35So I now have two effective domain controllers in the same site. All right, now using the magic of snapshots-- or checkpoints, actually, they're called in Hyper-V-- I've gone back in time to the previous point where we were, where I had just installed the Domain Services here, but I did not make this a domain controller. And likewise on the domain controller, DC01, I reset that back to its previous point, as well. Now what I'm going to do is to install a child domain. How about phoenix.nuggetlab.com? And I'm just going to use the UI for this one for expediency's sake right now. But up here, we get that little warning symbol, and it says, Promote this server to a domain controller.

7:10I'm going to go ahead and do that. But in this case, I'm going to add a new domain to an existing forest. So this will now be a child domain. Remember, I can also choose a tree domain. If I did that, I would have to enter in the name of the new domain that I wanted. That would be more of like a lateral domain that's connected. Here I'm going to make it a child domain, phoenix.nuggetlab.com. And my parent domain is nuggetlab.com, of course. My new domain I'll enter in down here will be phoenix. I'll need to enter in probably some credentials for this because I'm not a member of the domain on this computer right now.

7:43So I'll enter those in right here. And I'm just doing this as nuggetlab. So I'll enter in nuggetlab as the domain and the administrator account with the password. And then we'll click on Next. And then most of the rest of this is similar to what you would do when you install the first domain controller at the root domain. Just here, we're installing a new domain as a child. And then, of course, for this one, we are creating a DNS delegation, because we have to point it up to the root domain where there's a domain controller and a DNS server that already exists.

8:19We'll enter in the DNS domain name, NetBIOS domain name. We probably don't need to enter anything here. It should be able to pick it up automatically. There it is. PHOENIX does appear. And then we just click on Next. Again, our paths for the various types of files that will be created. If you want to view the script, you can certainly do that here, as well. Some of the notable differences would be that we are installing a child domain, as you can see right here. And then we enter in the new domain name, as well as the NetBIOS name of the domain. But let's go ahead and click on Next and let it do its thing.

8:50Looks like all of our checks come out OK, so we'll click on Install and let it complete. And then you can see when the computer reboots and it's a domain controller in the PHOENIX domain, then it's asking me for credentials in that PHOENIX domain. So I'll enter those in and here we go. And then from within Server Manager, if I go into Active Directory Domain Services and go to this domain controller, then we can go to Domains and Trusts. And you kind of see visually again how this all connects. So there's my child domain that is part of the nuggetlab.com forest and part of the same namespace, as well.

9:24And then remember, if I were to add another tree in the same forest, it would just be a different namespace. So it might be my domain, which is accusource.net. But in the schema and its identity, it would actually be associated with and part of the nuggetlab.com forest. It's a little bit confusing because the namespaces are different. But when you configure it, the schema will be associated with nuggetlab.com forest. All right, I hope this has been informative for you, and I'd like to thank you for viewing.