Windows Server 2019 Active Directory Domain Controller Install | For The Beginner

what is up guys welcome to the sysadmin tutorials YouTube channel in today's video we're going to be taking a look at how you can build a Windows Server 2019 Active Directory domain controller in this video I'm going to be showing you two ways that you can build your domain controller the first way is going to B via the GUI and the second way I'm going to be providing three scripts that I've written that's going to automate the process for you in a matter of minutes now this video has come about with a few people asking me how do I create an Active Directory domain controller and also how do I set up DNS especially since some of the tutorials that I've done on YouTube rely on DNS such as the VMware vCenter server setup so I thought I'd go ahead and create this video and it'll be a step-by-step guide in setting up Active Directory and DNS and then like I said before later on I'll show you some scripts that'll automate the whole process for you but I think it's important to understand how to go through and set it up with the GUI first so you understand what's happening in the background now this video is designed for the beginner but if you have set up Active Directory before then you might want to skip forward to the scripting part where you can have a look and see what I've written and what I've automated and you can use that in your production or in your lab environments so let's dive straight in up on screen we have our windows 2019 server and all I've done is I've done a base install and I've set the password so everything else I haven't touched there's no config changes at all so we're going to log in right now and the first thing that I want to do with my Active Directory domain controller is I want to set a static IP address so we'll go ahead and do that and we'll double-click on tcp/ip v4 will select to use the following IP address and for my IP address I'm going to type in 192 168 1 2 2 2 and the subnet mask will be 255 255 255 dot 0 for my default gateway I'm going to type in 192 168 1.1 and for my preferred DNS server I'm going to type in 127.0.0.1 and that's a local IP address for this server so now we'll just go ahead and close down all these windows so I'll click on OK here and I'll click it ok here we'll close this window and we'll close this window and now I'm going to go ahead and open up server manager I'll then click on local server and a few things that we'll do here first up we will enable RDP so I'm just going to select allow remote connections to this computer and we'll click OK to allow the firewall rules and we'll click OK again next I'll disable the ie enhanced security configuration so I'll click on that and I'm going to turn this off for both administrators and users I'll click OK and lastly we're going to set the server hostname so I'm going to click on the computer name here and we'll click Change and for the computer name I'm just going to call it server dc1 and press Enter now that we've changed the hostname we must reboot the server so we'll quickly do that I'll click OK I'll close that and I'll click on restart now ok once the server is rebooted we will then log in again and we'll open up server manager so we'll click on start and click on server manager will then go ahead and click on add roles and features you're presented with a welcome screen we'll click on next we'll click on next here for role-based or feature-based installation we have our service selected so we'll click Next and here we're going to select Active Directory domain services once you do that there's going to be a list of features that are going to be installed on this server and just make sure that you've got include management tools selected as well and we'll click on add features we'll then click on next now because the features have already automatically been added for you we can simply click on next here now in this demonstration we're only going to be installing one Active Directory domain controller however in production you want to have at least minimum of two Active Directory domain controllers and that's what the first note is mentioning there the second note is highlighting that it's going to install a DNS server which is what we want so we'll go ahead and click on next and up the top here we'll click on restart the destination server automatically if required and then go ahead and click on yes to do you want to allow automatic restarts just make sure that you don't have any files open that you've edited or something like that because the server is going to automatically restart and then we'll go ahead and we'll click on the install button now all the Active Directory components are being installed and we can see up on screen here that the installation is completed successfully now what we want to do is we want to click on promote this server to a domain controller so we'll click on that now and we want to select add a new forest now for our Active Directory domain name we want to type that into the root domain name field here for mine I'm going to type in V lab dot local and then I'm going to click on next now as this is the only Active Directory domain server within my network I'm happy to leave it on Windows Server 2016 however if we drop down the menu you can see that we also have compatibility all the way back to Windows Server 2008 now I want my Active Directory the main server to be a DNS server as well so we'll leave domain name system server selected and it's also going to be a global catalog server so this is because it's the first domain server within the Active Directory environment now for the directory services restore mode password we type in a password here it doesn't have to be the same as the administrator password but I'm going to select a new password here so I'm going to type that in and it's important that you keep that password safe because you need it in the event that you need to do an authority or non authority of Active Directory domain restore so we'll click Next now because our DNS name V lab dot local will only exist internally it doesn't exist on any external DNS servers we don't need to create a DNS delegation so we'll leave that on ticked and we'll click on next for the NetBIOS domain name this is going to be auto populated and it will be populated as just V lab we'll leave that as default and we'll click on next for the location of our database log files and sysvol I'm just going to leave this on default because I've only got one drive in my server which is the C Drive so I'm happy to leave those paths as default there and we'll click on next and now here is a summary of all the settings that we've selected so far if you're happy with your settings here we can click Next now our prerequisites check has been run and the first warning that presented here is just a security setting that prevent you from connecting to old domain controllers such as Windows NT 4 we don't need to worry about that because we are just running one Active Directory domain server on this network this second warning here is saying that it can't find a parent zone name for our domain name the lab dot local and that's really good because we only want it to exist internally in our Active Directory domain so we don't have to worry about that warning and you can see next that the prerequisites check completed and all prerequisite checks passed successfully so now we can go ahead and click on install now the server is automatically going to be restarted because we selected that option I'm going to click on close here the server has rebooted successfully so now we're going to log back in and noticed here that we're logging into our Active Directory domain now you can notice that by seeing V lab slash administrator so I'll type in our administrator password and this is the same password as you set for your administrator account on the local server when you first set up Windows Server 2013 and if we open up the command prompt again and we type in set s et you can see down the bottom that the user domain is V lab the user DNS domain is V lab local now I'll type in exit now what I like to do on Active Directory domain controllers is I like to create shortcuts either on the desktop on the taskbar of the common tools for example DNS Active Directory users and computers etc so we'll do that now I'll click on start and I'll type in DNS and we'll just right click on DNS and we'll select pin to taskbar and I'm going to do the same for Active Directory users and computers so I'll right-click Active Directory users and computers and I'll select a pin to taskbar now first up we'll have a look at the DNS server so let's click on the DNS icon and I'll just expand the window I'll double click on server dc1 and if I double click on forward look up zones you can see we have a forward look up zone for V lab local and if I click on V lab dot local you can see inside that we have a host record for server DC one resolving two IP address 192 168 1 - - - and we also have an SOA and an NS record now forward lookups are going to resolve names - IPS and what we need to do is we need to set up a reverse lookup so to set up a reverse lookup I'm going to click on reverse look up zones I'll right-click on it and select new zone we'll click Next we'll make it a primary zone and we'll store the zone in Active Directory we'll click Next and we'll replicate this to all DNS servers running on domain controllers within the domain V lab dot local so we'll click Next it'll be an ipv4 reverse lookup zone I'll click Next and here we want to type in the subnet that we're using so my subnet is 192 168 1 0 / 24 so here I'm going to type in 192.168.1 and we'll click on next and we'll allow only secure dynamic updates so we'll click Next and finish now what the reverse look up zone is going to do is normally you would type ping server dc1 and it will resolve the name to the IP address so that's the forward look up zone what the reverse look up zone is going to do is if I type in ping space - a space and then the IP address 192.168.1.1 and have a look at some of those videos on setting up vCenter server you see that in the video I do reference setting up forward and reverse look up zones and here is exactly where you do that so I'll show you step-by-step how to do that in those videos if you want to have a look some other things that we're going to do here is we're going to right click on server dc1 and we're going to go to properties and we're gonna go to forwarders and here you have the option to set up dns forwarders so what that means is if this DNS server cannot resolve the DNS name it will forward to the IP address or to the DNS server that you specify here in this tab if you don't specify a forwarder it's going to use the root hints and you can see them by clicking the root hints tab here I'm not going to be setting up any forwarders in this demo but I just wanted to show you where you do do that now we're going to go ahead and click on the Advanced tab and I'm going to enable automatic scavenging of stale records and we'll leave this set to seven days which is the default and what this is going to do is just going to remove old DNS records that don't need to be there anymore especially records that have been set via automatic secure updates now we'll go ahead and click on the monitoring tab and we're just going to do a simple DNS test so we're going to do a query against the DNS server and then we're going to do a recursive query to other DNS servers so make sure those two boxes are ticked and we'll click on test now when you click on test now you want to make sure that simple query has passed and you want to also make sure that the recursive query is passed as well so we'll click on apply and okay now because we've turned on automatic scavenging of stale records we're going to also enable a setting within the V lab local domain here forwarding domain we'll right-click on that we'll go to properties and we're going to click on aging and then we're going to turn on scavenge stale resource records and we'll leave that set to seven days for no refresh interval and also seven days for the Refresh interval we'll click on OK and ok again now that completes the DNS setup so we'll now close that and now we'll go into Active Directory sites and services so if we click on start and I'll just type in sites and we'll open up Active Directory sites and services I'll just make the window a little bit bigger once in Active Directory sites and services will expand sites and just select subnets folder here we'll right-click on subnets and we'll select new subnet for the prefix I'm going to type in 192 168 1 dot 0 slash 24 as that's my local IP subnet and then I'm going to select default first site name now this default the first site name is where my active directory server is installed to and I'm just going to show you that in one second but first we'll click OK here and if I expand default first site name and I expand servers you can see that my server dc1 is registered here so what that means exactly is that if we're in a multi-site environment and we have multiple subnets and multiple domain controllers when a user logs in from a specific subnet it will use the domain controller that that subnet is tied to so if I'm coming from 192 168 1.0 then in this setup it knows to use server DC 1 for the default first site name you can right click on it and select rename and you might rename it something like site a site B or maybe a location like a country or a city or something like that I'm going to leave mine on default first site name and we'll close the active directory sites and services and then we're going to open up Active Directory users and computers I'll just make that window a little bit bigger and I expand the V lab dot local domain you can see here that we've got a few folders firstly the computers folder now this is if I join a computer to the active directory domain my computer name and object is going to go into this folder and it's going to be located here on the right hand side in the next folder we've got domain controllers so this is going to be a list of domain controller objects you can see here on my first domain controller server DC one and lastly you've got users so here I have my administrator user and then I also have some groups so you can create additional users in the users folder or what you can do is you can right-click on the lab dot local or your domain and you can select new and you can then create organizational units so if I click organizational unit I can type in here Windows admins and you have the option to protect the container from accidental deletion so you can turn that on or off I usually leave that as on and we'll click OK and from in here we can right click and we can go new and then select a user and we can just follow this wizard it's pretty straightforward to create a new user will type in the first name and last name will then type the user login name and we'll click on next we'll give the user our password and here you can select if the user must change the password at next logon the user cannot change the password or password never expires or the account is disabled because this is an admin account I'm gonna tick user must change password at next logon and I'm gonna click on next and then I'm going to click on finish so we want to make this one a administrator so we're going to double click on this user account and we're going to click on the member of tab we'll click on add and here we're going to type in domain admins we'll click on check name to make sure that it resolves ok against Active Directory well then click on OK we'll select domain admins select set primary group and then we'll go to domain users and we'll remove that group do you want to remove the windows admin one from the selected group select yes and we can click on ok and that's how you can create a admin user I'm going to go ahead and close Active Directory users and computers so that pretty much completes the steps involved in setting up an Active Directory domain troller using the GUI method as you can see there's quite a lot of steps involved in doing it this way and if you're going to be setting up multiple domain controllers you definitely want to automate this process unless you enjoy sitting here clicking along on all the buttons next next next and filling in fields and all this kind of stuff so what I want to do now is I want to show you how we can automate this entire process and make this installation much much faster and and we can repeat this much easier as well using PowerShell so with this server what I've done is I've taken a snapshot back when it was a base system so it was just after the Windows Server 2019 installation and I've just said a user password that's it I haven't done any other configuration and then we're going to use PowerShell to complete the setup of the server and also of Active Directory so what we're going to do now is I'm going to restore the server back to the basis snapshot and then we'll boot the server up again I'm going to copy across the three PowerShell scripts onto the desktop and then we're going to have a look at those scripts and I'm going to explain what each step does so I'm going to do that now and what I'll do is I'll pause the video and then we'll come back once the system has been restored to the base image ok guys we're back and we're going to log into our windows 2019 domain controller so press ctrl alt delete and we'll log in with the password and what I'm going to do here is I'm going to copy my three scripts onto the desktop ok and here they are on the desktop so we'll click on number one we'll right-click on it and we'll select edit this is going to open up PowerShell ISE in the first script we're going to be going through and configuring such options as enabling remote desktop disabling the IE enhanced security and setting the hostname of the computer after it's gone through and done that it's going to wait 30 seconds and then it's going to reboot the server now enabling remote desktop or disabling that I enhance security configuration is optional and we can turn it on or off by selecting the variable here for enable RDP it's it on yes at the moment so that is going to enable RDP but we can simply type no there and it will not enable RDP same for the disabled ie enhanced security configuration if that is set to yes it is going to go through and disable the ie enhance security but if it's set to no then it will not but first let's start with the network variables so with the network variables we've got the Ethernet alias now the Ethernet alias value here Ethernet 0 we get that by right-clicking on the network going to open network and internet settings clicking on Ethernet and then clicking on change adapter options and you can see here that my adapter is called Ethernet 0 so whatever your says there is what we put into that variable so I'm just going to close these two screens and next up we've got the IP address that we wish to set on the server so I'm going to be setting 192 168 1 dot 2 2 2 if you want to use a different IP address you can simply change that IP address there and put the one that you want to use in for the prefix length this is the subnet mask the subnet mask for my network is 255 255 255 dot 0 so that is a 24 prefix length so we set 24 there and for the default gateway I'm using 192 168 1.1 so I put that there again if you need to change it you can simply change that IP address and for the DNS the primary DNS of this server where it's going to set that as 127.0.0.1 because this server is going to be a Active Directory domain controller next we have the Remote Desktop variable so we can set that as yes or no to enable RDP and same for disable ie enhance security we can set that as yes or no and the last variable that we need to set is the computer name so I'm calling mine server DC 1 however if you want to change hostname and call it something different you can simply replace this value here and you can type in the value that you want to use so let's have a look at the script so the first bit here we're going to be setting the network IP address and that is this command on line 33 and as you can see here it is using the variables that we set earlier such as 'if I P address eath prefix length eath default gateway and eath alias and then we go on and on line 34 we set the DNS primary server so that was the 127.0.0.1 address and you can see that it is using the variable dollar if dns and it's setting it on the adapter with eath Elias on line 35 we go through and we write to the console that the IP address was successfully set to the variable that we set and the subnet for the subnet variable default gateway for the default gateway variable and the dns to the dns variable now if something does go wrong if there is an error in either setting the IP address or setting the DNS server you can see at the end of the script that we've got error action stop and what this means is that it is going to stop the script from executing any further and it is going to come down into this catch section here so in the catch section it's going to write a warning on to the screen saying failed to apply network settings and then it's going to show you the error after and the error is this dollar underscore dot exception message and then it's going to break so it's going to stop the script entirely if we scroll down we have the set our DP section so because this statement is true enable our DP equals yes that means it's going to execute line 46 and what that does is it's going to change the property in the registry to enable our DP and then on line 47 it's going to open up the firewall and allow port 3389 and we've got the same thing here that if there is an error to stop the script and come down here and write the warning message next we have if enable RDP is not equal to yes then just write to the host RDP remains disabled now we have the same condition here for disabling ie enhanced security configuration so if disable ie config equals yes then it's going to execute line 65 and 66 and with that it's going to set to registry entries and it's going to be disabling the administrator and the user ie security configuration we also have error action stop at the end of these lines and it's going to go down into the catch section if there is an error it's going to write the warning and it's also going to display the error message as to why it stopped if disabled IESA config is not equal to yes then it's just going to write the host that ie enhanced security configuration remains enabled the second last bit to the script is setting the hostname so here we rename the computer to what it currently is and that's using this variable here dollar env : computer name and we set it to the new name that we set in our variables on the top of this script which is dollar computer name and once again we have error action stop and the catch section down here once all that's done it's going to write a message to the console telling you to save all your work the computer is rebooting in 30 seconds then it's going to wait 30 seconds on line 92 after the 30 seconds is up it's then going to restart the computer if there is any error with restarting the computer it's going to come down to the cut section again and it's going to display a warning message so that's what script number 1 does so let's go ahead and we'll run this script and down the bottom in the blue section you will see the output so I'm going to go ahead and click on play the script you are about to run will be saved so that's fine we'll click OK so you go the IP address has successfully been set RDP has been enabled I enhance security configuration has been successfully disabled and the computer name has been set to serve a dc1 so after 30 seconds the computer is going to reboot I'm just going to speed this up a little bit and there we go the server is rebooting okay we'll log back into the server and we're going to go ahead and open up server manager so we'll click on start and we'll go to server manager will then go ahead on the left-hand side and click on local server and here you can see that the computer name is being set to server dc1 remote desktop has been set to enabled and ie enhance security configuration is now off so that was all set with PowerShell and now we'll jump into the command line and we'll just have a look at the IP configuration so we'll click on start we'll type in CMD click on command prompt and here we'll type in ipconfig /all and up on screen next to ipv4 address you can see that IP address that we've set with the powershell script you can also see the subnet mask default gateway and the dns servers so I'm going to type in exit and we're going to right click on script number 2 and we'll select edit I'm just going to maximize the window and within this script we only need to set one variable and that variable is what do you want your Active Directory domain to be called so Man 1 I'm going to be calling a V lab dot local so just replace that value with the domain that you want to use and let's go ahead and look at the script and see what it does now on line 20 this is where it's going to be adding the windows feature ad domain services and then on line 21 and this is where it's going to be installing the remote to server administration tools for active directory management and you can see again we've got the error action stop we've got the right host when it's successful and if it's not successful it will go down into the catch area and all say it failed to install Active Directory domain services and with the error message now in the next section this is where we're going to be installing the a DDS forest and this is on line 31 so we're gonna be doing that with the domain name that we set on the variable at the beginning of this script so if you remember my one was called V lab dot local and the variable name was dollar domain name it's also going to go ahead and install DNS after doing that component it's not going to reboot the server just yet it's going to move on and we're going to reboot the server manually here so I put in a thing here or right host to say save all your work the computer is rebooting in 30 seconds we've got the sleep 30 again like we did in the previous script and then it's going to go through and reboot the computer so with that being said let's click on play okay so the Active Directory domain services has installed successfully as you can see up on screen it's now prompted us to enter in the Safe Mode administrator password so I'm going to do that here in this field and then I'll click on OK and I'm going to type the password again in the confirm field and we'll click on OK again and we'll click on yes to continue with this operation ok Active Directory domain services has been configured successfully so we are all good to go I'm just going to scroll up quickly and you can see that these warning messages are the same warning messages that we got when we configured Active Directory domain services in the GUI I will scroll down and in just a second the server is going to reboot now that the computer has returned to the login screen we will press ctrl alt delete and entering the password we're now going to move on to script number 3 so we'll right click on that and select edit I'll maximize the window again ok here we have a few variables that we need to set the first one I've called global subnet and for me the subnet that I'm using is 192 168 1 dot 0 slash 24 and that variable is going to be used for the reverse look up zone and also be used for Active Directory sites and services subnet we then go on to the subnet location so for me it's Sydney so I've typed in Sydney we then have the NTP or the time servers so I've allocated to time service here that are going to be set on this Active Directory domain controller and we'll now scroll down to the settings so we can see here on line 26 that we add the dns reverse lookup zone for the global subnet which is 192 168 1 dot 0 / 24 and if we keep scrolling down we then set the DNS scavenging just exactly the same as what we did on the GUI setup so we've got that now in PowerShell so that's line 35 down to 41 and this DNS scavenging section sets the scavenging on the server and also on the zone we then scroll down to line 43 and this is where we create the active directory sites and services subnet and you can see on line 45 that we reference the global subnet here when we create the new Active Directory replication subnet and that subnet is tied to the default first site name in Active Directory sites and services so same thing as we did in the GUI lastly on line 53 or the section from 53 down to 70 we then go through and we set the NTP servers on this active directory server the NTP servers are going to be set on your PDC so what I've done here on line 55 i've queried the Active Directory domain controllers and I've just selected the domain controller that contains the PDC emulator role so once it finds that it'll put it into the variable server PDC and then on line 57 it's saying that if the variable server PDC exists or there is some value tight then run the following now online 60 we're calling the W 32 TM Exe file and we're running their file with the arguments slash config slash manual peer list with the NTP servers 1 & 2 sync from Flags manual is it a reliable Time sauce yes and update once we've set all that we then on line 61 stop at the W 32 time service we wait for two seconds and then we start the service again and that's the process to set an NTP reliable time source for your Active Directory domain controller so we'll scroll back up and we'll click on play and within a matter of seconds you can see that the script is executed and has applied all those settings throughout our server so the reverse look up zone was set successfully and then we moved on to setting the scavenging so that was all done successfully as well we added the subnet with in Active Directory sites and services that was successful we then moved on and set the NTP config for this server and after that it stopped to the windows time service and then started the windows time service again so once it did that that meant that the NTP config was complete and you can see there that on screen it says successfully set the NTP servers with the two NTP servers there so now that we've applied all these PowerShell scripting everything let's go and verify that all the settings have been put in correctly so we've already verified that the settings from script number 1 have been applied successfully so what I'm going to do is I'm going to open up script number 2 and in script number 2 if you remember we went and installed Active Directory domain services and the remote management tools for Active Directory as well so I'm going to open up Active Directory users and computers and I'll just make the screen a bit bigger and here we have it we have our V lab local domain and we have all the folders that we saw in the GUI setup I'm also going to open up Active Directory sites and services I'll maximize this window as well and we'll expand sites and you can see here that we've got our default first site name if I expand that and I expand service we have our server dc1 here now if we go back to the script we'll move on to script number 3 so this is where we added a reverse DNS zone so I'm going to open up DNS now and I'll make this window large as well and here we'll expand a server dc1 and we'll expand reverse look up zones and here we have our 192 168 dot one reverse lookup zone will then go back to the script and the next section was setting the DNS scavenging so within DNS I'll right click on the server dc1 server object we'll go to properties and we'll click on the Advanced tab and you can see that enable automatic scavenging for style records is ticked and it was set at 7 days so we'll cancel that one and we'll also go on to the forward look up zone for V lab local we'll right click on that select properties and then we'll click on the aging button and we can see here that scavenging has also been turned on and it's been sets for seven days for both the no refresh interval and the Refresh interval so we'll click on cancel and we'll go back to the script we'll scroll down a little bit so the next bit was setting the active directory sites and services subnet so we'll go to sites and services and we'll expand the subnets folder and you can see here that we've got our 192 168 1 dot 0 slash 24 subnet if I right-click on that subnet and go to properties we can see that it is tied to the site default the first site name so we'll click on cancel there and we'll go back to the script again we then configure the NTP service for this domain server to verify that the NTP servers have been set correctly we're going to click on start and we're going to go to the command prompt and within the command prompt we're going to paste in this command W 32 TM space forward slash query space forward slash configuration we'll press ENTER on that and just to the right of NTP servers we can see that we've got the two NTP servers that we specified within the powershell script so hopefully in this demonstration even if you have never had any experience with powershell i've been able to show you how you can easily create an Active Directory domain controller using these PowerShell scripts and the way that I started with PowerShell I didn't just open it up and start writing scripts like these I actually just looked for the component that I wanted to configure so let's say for example all I want to do is configure the windows hostname I will then go to google I'd search on how to create a Windows hostname or how to change the windows hostname in PowerShell I'd get that command I'd put it in I'd see how that worked and then I'd move on to the next bit so maybe the next bit was enabling RDP so I would go to Google that have a look and I'd see how to enable RDP I would put that into the script and then I would just build the script a bit by bit like that as you can see I have put in a few like tries and caches and error messages and all these kind of things which is custom so if you're looking or if you're just starting to use PowerShell that's probably the best way to learn and just get your hands dirty and get into it use a virtual machine it takes snapshots I'll revert from revert to this previous snapshot if you make a mistake it's really a great way to learn okay that completes this video on setting up your Windows Active Directory domain controller we've gone through setting up your domain controller with the GUI method and also with the PowerShell scripting method just out of interest I'd be keen to know which one you prefer do you prefer the GUI method or do you prefer the PowerShell scripting method leave a comment below and also if you have any questions whatsoever especially around the PowerShell scripting if you're quite new to it then also leave a comment below and I'll do my best in getting back to you if you liked the video then please leave a big thumbs up if you haven't subscribed already hit the subscribe button if you are a returning subscriber thank you very much for your support and we're going to see you again in the next video so take care and bye for now

Channel: sysadmintutorials

Views: 30,083

Keywords: active directory, domain controller, microsoft, windows, server, 2019, beginner, powershell, automation, script, sites and services, users and computers, dns, fsmo, ntp, fqdn, server manager, remote desktop, rsat

Id: 0tONNzREopw

Length: 42min 14sec (2534 seconds)

Published: Mon May 04 2020