8. Installing AD DS from Media
When you add domain controllers to a forest, data from existing
directory partitions are replicated to the new DC. In an environment
with a large directory or where bandwidth is constrained between a new
DC and a writable DC from which to replicate, you can install AD DS
more efficiently by using the IFM option. Installing from media
involves creating installation media—a
specialized backup of Active Directory that can be used by the Active
Directory Domain Services Installation Wizard as a data source for populating the
directory on a new DC. Then the new DC will replicate only updates
from another writable DC, so if the installation media is recent, you
can minimize the impact of replication to a new DC.
Remember that it is not only the directory that must be
replicated to a new DC but SYSVOL as well. When you create your
installation media, you can specify whether to include SYSVOL on the
installation media.
Using IFM also allows you to control the timing of impact to
your network bandwidth. You can, for example, create installation
media and transfer it to a remote site during off hours, and then
create the domain controller during normal business hours. Because the
installation media is from the local site, the replication burden on
the network is reduced, and only updates are replicated over the link
to the remote site.
To create installation media:
-
Open an elevated Command Prompt on a writable domain controller, running Windows Server 2008
R2.
The installation media can be used to create both
writable and read-only DCs. -
Type ntdsutil.exe, and then
press Enter. -
At the ntdsutil prompt, type activate
instance ntds, and then press Enter. -
Type ifm, and then press
Enter. -
At the ifm: prompt, type one
of the following commands, based on the type of installation media you want to create:
-
create sysvol
full Path Creates
installation media with SYSVOL for a writable domain
controller in the folder specified by
Path
-
create full
Path Creates
installation media without SYSVOL for a writable domain
controller or an Active Directory Lightweight Directory Services
(AD LDS) instance in the folder specified by
Path
-
create sysvol
rodc Path Creates
installation media with SYSVOL for a read-only domain
controller in the folder specified by
Path
-
create rodc
Path Creates
installation media without SYSVOL for a read-only domain
controller in the folder specified by
Path
When you run the Active Directory Domain Services Installation
Wizard, select the Use Advanced Mode Installation check box, and you
will be presented with the Install From Media page later in the
wizard. Choose Replicate Data From Media At The Following Location.
You can use the ReplicationSourcePath
installation option in an answer file or on the Dcpromo.exe command
line.
9. Removing a Domain Controller
You can remove a domain controller by using Dcpromo.exe, either
by launching the Active Directory Domain Services Installation Wizard
or from a command prompt, specifying options at the command line or in
an answer file. When a domain controller is removed while it has
connectivity to the domain, it updates the forest metadata about the
domain controller so that the directory knows the DC has been
removed.
To use an answer file, provide the following options and
values:
[DCINSTALL]
UserName=DOMAIN\username (in Administrators group of the domain)
UserDomain=FQDN of user specified by UserName
Password=password for user specified by UserName
AdministratorPassword=password will be assigned to local Administrator
RemoveApplicationPartitions=yes
RemoveDNSDelegation=yes
DNSDelegationUserName=DOMAIN\username with permissions to remove DNS delegation
DNSDelegationPassword=password for the account
Run Dcpromo.exe with the /unattend:“answer file
path” and the /UninstallBinaries
options, as in the following example:
dcpromo /uninstallbinaries /unattend:"c:\rodcanswer.txt"
All the options just shown in the answer file can also be
specified or overridden directly on the command line. Just type a
command similar to the following:
dcpromo /unattend /uninstallbinaries
/UserName:contoso\dan /password:* /administratorpassword:Pa$$w0rd
If a domain controller must be demoted while it cannot contact
the domain, you must use the /forceremoval option
of Dcpromo.exe. Type dcpromo
/forceremoval, and the Active Directory Domain Services
Installation Wizard takes you through the process. Warnings appear
related to any roles that the domain controller hosts. Read each
warning and, after you have mitigated or accepted the impact of the
warning, click Yes. You can suppress warnings by using the
demotefsmo:yes option of Dcpromo.exe. After
removing the DC, you must manually clean up the forest
metadata.
Practice Deploying Domain Controllers
Practice Deploying Domain Controllers
In this practice, you perform the steps required to install
an additional domain controller in the contoso.com domain. You
install AD DS and configure an additional DC, using the Active
Directory Domain Services Installation Wizard. You will
not complete the installation. Instead, you save the
settings as an answer file and use the settings to perform an
unattended installation, using the
Dcpromo.exe command with installation
options.
To perform this exercise, you need a second server running
Windows Server 2008 full installation. The server must be named
SERVER02, and it should be joined to the contoso.com domain. Its configuration should be as
follows:
-
Computer Name: SERVER02 -
Domain Membership: contoso.com -
IPv4 address: 10.0.0.12 -
Subnet Mask: 255.255.255.0 -
Default Gateway: 10.0.0.1 -
DNS Server: 10.0.0.11
EXERCISE 1 Create an Additional DC
with the Active Directory Domain Services Installation
Wizard
In this exercise, you use the Active Directory Domain
Services Installation Wizard (Dcpromo.exe) to create an additional
domain controller in the contoso.com domain. You do not complete
the installation, however. Instead, you save the settings as an
answer file, which will be used in the next exercise.
-
Log on to SERVER02 as CONTOSO\Administrator. -
Click Start, click Run, type Dcpromo.exe, and then press
Enter.
Active Directory binaries are installed. -
Click Next. -
On the Operating System Compatibility page, review the
warning about the default security settings for Windows Server
2008 R2 domain controllers, and then click Next. -
On the Choose A Deployment Configuration page, select
Existing Forest, select Add A Domain Controller To An Existing
Domain, and then click Next. -
On the Network Credentials page, type contoso.com in the text box, select My
Current Logged On Credentials, and then click Next. -
On the Select A Domain page, select contoso.com and
click Next. -
On the Select A Site page, select
Default-First-Site-Name and click Next.
The Additional Domain Controller Options page appears.
DNS Server and Global Catalog are selected by default. -
Clear the Global Catalog and DNS Server check boxes, and
then click Next.
An Infrastructure Master Configuration Conflict warning
appears.
-
Click Do Not Transfer The Infrastructure Master Role To
This Domain Controller, I Will Correct The Configuration
Later. -
On the Location For Database, Log Files, And SYSVOL
page, accept the default locations for the database file, the
directory service log files, and the SYSVOL files and click
Next.
The best practice in a production environment is to store
these files on three separate volumes that do not contain
applications or other files not related to AD DS. This best
practices design improves performance and increases the
efficiency of backup and restore. -
On the Directory Services Restore Mode Administrator
Password page, type a strong password in both the Password and
Confirmed Password boxes. Click Next.
Do not forget the password you assigned to the Directory
Services Restore Mode Administrator. -
On the Summary page, review your selections.
If any settings are incorrect, click Back to make
modifications. -
Click Export Settings. -
Click Browse Folders. -
Select Desktop. -
In the File Name box, type AdditionalDC and click Save.
A message appears, indicating that settings were saved
successfully. -
Click OK. -
On the Active Directory Domain Services Installation Wizard Summary
page, click Cancel. -
Click Yes to confirm that you are cancelling the
installation of the DC.
EXERCISE 2 Add a Domain Controller
from the Command Line
In this exercise, you examine the answer file you created in
Exercise 1, “Create an Additional DC with the Active Directory
Domain Services Installation Wizard.” You use the installation
options in the answer file to create a Dcpromo.exe command line to
install the additional domain controller.
-
Open the AdditionalDC.txt file you created in Exercise
1. -
Examine the answers in the file. Can you identify what
some of the options mean?
Tip: Lines beginning with a semicolon are comments or
inactive lines that have been commented out. -
Open a command prompt.
You will be building a command line, using the options
in the answer file. Position the windows so you can see both
Notepad and the command prompt, or print the answer file for
reference. -
Determine the command line to install the domain
controller with the configuration contained in the answer
file.
Parameters on the command line take the form
/option:value, whereas in the answer file
they take the form option=value. -
Type the following command and press Enter:
dcpromo /unattend /replicaornewdomain:replica
/replicadomaindnsname:contoso.com /sitename:Default-First-Site-Name
/installDNS:No /confirmGC:No /CreateDNSDelegation:No
/databasepath:"C:\Windows\NTDS" /logpath:"C:\Windows\NTDS"
/sysvolpath:"C:\Windows\SYSVOL" /safemodeadminpassword:password
/transferimroleifnecessary:no
where password is a complex
password. -
Installation completes, and the server reboots.
EXERCISE 3 Create Installation
Media
You can reduce the amount of replication required to create
a domain controller by promoting the domain controller, using the IFM option. IFM
requires that you provide installation media, which is, in effect,
a backup of Active Directory. In this exercise, you create the
installation media.
-
Log on to SERVER01 as Administrator. -
Open a command prompt. -
Type ntdsutil and press
Enter. -
Type activate instance
ntds and press Enter. -
Type ifm and press
Enter. -
Type ? and press Enter to
list the commands available in IFM mode. -
Type create sysvol full
c:\IFM and press Enter.
The installation media files are copied to
C:\Ifm.
|
