20410B

2: Introduction to Active Directory

Domain Services

Presentation: 80 minutes

Lab: 45 minutes

After completing this module, students will be able to:

Describe the structure of Active Directory Domain Services (AD DS).

Describe the purpose of domain controllers.

Install a domain controller.

Required Materials

To teach this module, you need the Microsoft Office PowerPoint file 20410B_02.pptx.

Important: It is recommended that you use Office PowerPoint 2007 or a newer version to display the
slides for this course. If you use PowerPoint Viewer or an earlier version of PowerPoint, all the features of
the slides might not be displayed correctly.

Preparation Tasks

To prepare for this module:

Read all of the materials for this module.

Practice performing the lab exercises.

Work through the Module Review and Takeaways section, and determine how you will use this
section to reinforce student learning and promote knowledge transfer to on-the-job performance.

1
20410B
2: Introduction to Active Directory
Domain Services

2
20410B
2: Introduction to Active Directory
Domain Services

Do not spend too much time on each topic. Remember that this is a class on Windows Server 2012, and
not a class on AD DS.

3
20410B
2: Introduction to Active Directory
Domain Services

Go through the list of physical and logical components. Offer brief descriptions of each.

Physical Components

Data store. Stores the AD DS information. This is a file on each domain controller.

Domain controllers. Contain a copy of AD DS database.

Global catalog servers. Host the global catalog, which is a partial, read-only copy of all the domain
naming contexts in the forest. A global catalog speeds up searches for objects that might be
attached to other domain controllers in the forest.

Read-only domain controllers (RODCs). A special install of AD DS in a read-only form. These are
often used in branch offices where security and IT support are often less advanced than in the main
corporate centers. RODCs are sometimes installed in Server Core installations and can be secured
by using Windows BitLocker Drive Encryption.

Logical Components

Partitions. The partitions that exist in AD DS, which are: domain partition, configuration partition,
schema partition, global catalog, and application partitions.

Schema. Defines the list of attributes that all objects in the AD DS can have.

Domains. Logical, administrative boundary for users and computers

Domain Trees. Collection of domain controllers that share a common root domain.

Forests. Collections of domains that share a common AD DS.

Sites. Collections of users, groups, and computers as defined by their physical locations. Useful
when you plan administrative tasks such as replication of the AD DS.

Organizational Units (OUs). Containers in AD DS that provide a framework for delegating

administrative rights and for linking Group Policy Objects (GPOs). Emphasize that the OU structure
does not necessarily match the organizational chart, but should be designed to meet the
administrative requirements for each situation.

4
20410B
2: Introduction to Active Directory
Domain Services

5
20410B
2: Introduction to Active Directory
Domain Services

Establish clearly to students the difference between OUs and containers: explain that containers are not
OUs. Although they can hold objects, they cannot have GPOs linked to them, so it is necessary to move
the objects into OUs that need to be managed. Examples are user accounts, computer accounts, and
groups.

Remind students that usually the OU structure would not match the organizational chart, but would be
designed to support the delegation of administration, and should be a framework to support the linking of
GPOs. In a large organization, with for example 50,000 users and computers, it would be much more
manageable to divide those objects into OUs.

Discuss some of the criteria that might drive the OU structure design, such as geographical location,
department, object type, and cost center.

6
20410B
2: Introduction to Active Directory
Domain Services

Use this slide to illustrate the different relationships of a child domain or another tree, but emphasize that
there is no administrative difference between the two options, apart from the names.

7
20410B
2: Introduction to Active Directory
Domain Services

Reinforce the concept that the schema defines the rules and syntax of the AD DS database, and provides
the blueprint for any objects that can be created in it.

If you think that your students are having trouble understanding this concept, you could use this analogy
or something similar:

In a restaurant, there is a burger and a cheeseburger on the menu. If you order one of these, there are
certain mandatory components, or attributes, and additional optional extras, as shown in the following
table.

Burger Cheeseburger Attributes

Meat Meat Mandatory

Bun Bun Mandatory
Cheese Mandatory
Onions Onions Optional
Pickle Pickle Optional
Lettuce Bacon Optional
Cheese Ketchup Optional
Bacon Lettuce Optional

In a similar way, the schema defines the objects that reside in the AD DS database, and defines the
mandatory and optional attributes, and the syntax and the relationships between them. Notice that the
attributes are defined first, and then the objects are defined based on the underlying attributes. Thus, an
attribute that is optional for one object might be mandatory for another.

Optionally, you can demonstrate the Schema Management tool to show how the objects are defined from
attributes.

You also can show the hierarchy of objects and the inherited attributes. For example, the parent object for
User is Organizational Person, the parent object for Organizational Person is Person, and the parent
object for Person is an object called Top.

Point out to students that attributes are defined at each level in the hierarchy, so the User object contains
all of the attributes that are defined on the User class, and all of the attributes defined farther up the
objects hierarchy (Organizational Person, Person, Top).

8
20410B
2: Introduction to Active Directory
Domain Services

This lesson describes the purpose of domain controllers and introduces the concept of the global catalog.
It also describes in detail the logon process. This lesson covers the importance of DNS, particularly
service resource (SRV) records, to the logon process. It also examines various operations master roles
and how they contribute to the functioning of the AD DS domain.

Question
Why would you make a domain controller a global catalog server?

Answer
Queries that are directed at the forest (rather than the domain) need to be directed to a global catalog
server. This is because a domain controller that is not a global catalog only holds information about the
objects in its own domain. As a best practice, you should configure every domain controller to be a global
catalog, even in a single domain forest.

9
20410B
2: Introduction to Active Directory
Domain Services

Emphasize to students that the database and services are stored on servers called domain controllers.

Domain controllersservers that perform the AD DS rolehost the Active Directory database, SYSVOL,
the Kerberos authentication service and other Active Directory services. For redundancy purposes, it is
best to have at least two available domain controllers.

Highlight that all domain controllers in a domain essentially are equal. Each domain controller contains a
copy of the directory store, and updates can be made to the AD DS data on all domain controllers except
for RODCs.

Emphasize the importance of having multiple domain controllers in each domain. This provides load
balancing, but more importantly, it also provides recoverability if a server failure occurs.

Mention that all domain controllers engage in authentication and authorization, thus making it a redundant
system with fewer fail points.

This topic does not provide much information about best practices. If students are interested, you can go
into more detail about installing domain controllers in remote sites to protect against an unavailable wide
area network (WAN) connection. You can also talk about increasing the number of domain controllers to
account for redundancy and performance.

10
20410B
2: Introduction to Active Directory
Domain Services

Describe the role of the global catalog server when searching for objects across domains in a forest.
Define a global catalog as a domain controller that replicates the partial attribute set for each domain in
the forest. The domain controller does not need the partial attribute set for its own domain because it
already has the full copy of the domain database, and only needs the changes made to other domains.
That is why, in a single domain environment, making every domain controller a global catalog server adds
no significant replication.

Question
Should a domain controller be a global catalog?

Answer
Every domain controller should be a global catalog. (In some extreme situations, there might be a reason
not to do so.) However, most large, distributed organizations are doing just that, so it also makes sense for
less complex, smaller organizations.

11
20410B
2: Introduction to Active Directory
Domain Services

Use this slide to illustrate how the logon process works.

In the first phase, the user account is authenticated to DC1.

In the second phase, the user account applies to the domain controller for a ticket to gain
authorization to connect with the local computer.

A centralized directory service such as AD DS provides a single identity store, authentication

service, and point of management for administration.

Emphasize the advantages of a single identity store for security and manageability.

12
20410B
2: Introduction to Active Directory
Domain Services

Demonstrate the SRV records in Domain Name System (DNS) briefly, or as appropriate for the level of
student experience or interest.

After showing the sub-domains that start with an underscore, explain that domain controllers register
several SRV records so that they are searchable in multiple ways. Look for an SRV record in
_tcp.Default-First-Site-Name._sites.adatum.com that is offering the Kerberos authentication service.
Examine the record and show that server LON-DC1.adatum.com is offering the Kerberos authentication
service over TCP port 88, and that the server is answering for the site Default-First-Site-Name. This is
the preferred domain controller to connect to because the domain controller is in the same AD DS site as
the client computer.

Point out that, because domain controllers register SRV records in many different ways, it is possible to
find an alternative if the preferred domain controller is not available. Alternatively, you could also open C:
\windows\system32\config with Notepad, and demonstrate netlogon.dns to illustrate all of the SRV records
that each domain controller will register in DNS.

Note that SRV records are registered in DNS by the Net Logon service that is running on each domain
controller. If the SRV records are not entered in DNS correctly, you can trigger the domain controller to
reregister those records by restarting the Net Logon service on that domain controller. This only
reregisters the SRV records. If you want to reregister the host record information in DNS, you must run
ipconfig /registerdns from the command line, just as you would for any other computer.

Preparation Steps

1. If it is not already running, start 20410B-LON-DC1, and then sign in to Adatum\Administrator

with the password Pa$$w0rd.

2. Open DNS Manager to demonstrate the SRV Records, and use Notepad to display the contents of
the netlogon.dns file.

(More notes on the next slide) 13

20410B
2: Introduction to Active Directory
Domain Services

Demonstration Steps

View the SRV records by using DNS Manager

1. On LON-DC1, sign in with the user account Adatum\Administrator and the password Pa$$w0rd.

2. In Server Manager, click the Tools menu.

3. In the Tools list, click DNS.

4. In the tree menu, expand LON-DC1, expand Forward Lookup Zones, expand adatum.com, and
show the following four DNS subzones:
_msdcs
_sites
_tcp
_udp

5. Expand Forward Lookup Zones, expand adatum.com, expand _sites, expand

Default-First-Site-Name, expand _tcp, and then, in the right pane, show the following record:
_ldap Service Location (SRV) [0][100][389] lon-dc1.adatum.com.

6. If the students have sufficient expertise and interest, open c:\windows\system32\config, and then
open the netlogon.dns file in Notepad. Show all the SRV records that this domain controller will
register in DNS.

14
20410B
2: Introduction to Active Directory
Domain Services

Discuss each of the operations master roles in as much depth as you feel is appropriate for the students.

Be sure to point out that most master roles are so specific that the master could be offline for a while
without causing any problems. For example, you do not need the schema master until you make changes
to the schema, and you do not need the domain naming master until you add or remove a domain in the
forest.

Point out that other domain services can be slowed or disrupted if a domain controller is offline and not
available. Be sure to point out to students that these roles all run on a domain controller, so the loss of a
domain controller could cause serious problems.

Domain Flexible Single Master Operations (FSMOs) are needed on a more regular basis than those in the
forest root domain, particularly the primary domain controller (PDC) emulator.

The relative ID (RID) master provides a pool of RIDs to each domain controller. If this master is not
available, eventually a domain controller will attempt to create an account and will be unable to do so.

Talk through the five PDC functions to the level of detail that is provided in the student handbook. Enforce
that if the PDC emulator master is not available or is slow to respond, you are more likely to have issues in
the domain.

You can find which domain controllers are FSMO holders by typing the following at a command prompt,
and then pressing Enter:

Netdom query fsmo

15
20410B
2: Introduction to Active Directory
Domain Services

Depending on the students experience with AD DS, you might have to explain in more detail the
implications of no longer being able to run the dcpromo.exe tool as a GUI wizard. This tool is only used in
Windows Server 2012 for an unattended installation. Mention to students that you can remotely promote a
server to be a domain controller by using Server Manager running on Windows Server 2012.

Emphasize to the students that this module is only concerned with installing domain controllers by using
the GUI tools. There are other ways of installing domain controllers by using scripting tools such as
Windows PowerShell or VBScript.

Question
What is the reason to specify the Directory Services Restore Mode password?

Answer
If the AD DS database must be restored from backup, the domain controller must be restarted into
Directory Services Restore Mode. You then must use the Directory Services Restore Mode password to
log on to the domain controller when it starts in Directory Services Restore Mode.

16
20410B
2: Introduction to Active Directory
Domain Services

Use Server Manager to run through the initial process of installing an AD DS domain controller. Show the
option to choose the local server or a remote server from the server pool. Explain that the initial pass
installs the binaries for AD DS, and then you can continue to configure the AD DS installation.

17
20410B
2: Introduction to Active Directory
Domain Services

Describe the command displayed on the slide, and refer to the answer file (answerfile.txt). Remind the
students that dcpromo.exe cannot be used in GUI format in Windows Server 2012, but can still be typed at
a command prompt when doing an unattended install.

18
20410B
2: Introduction to Active Directory
Domain Services

19
20410B
2: Introduction to Active Directory
Domain Services

Point out to students that because they are installing the domain controller using the IFM method, they
should select the Install from media path check box. The next step is to type the path to the snapshot file
in the Install from media path box.

20
20410B
2: Introduction to Active Directory
Domain Services

Before the students begin the lab, read the lab scenario and display the next slide. Before each exercise,
read the scenario associated with the exercise to the class. The scenarios give context to the lab and
exercises, and help to facilitate the discussion at the end of the lab. Remind the students to complete the
discussion questions after the last lab exercise.

Exercise 1: Installing a Domain Controller

Users have been experiencing slow logons in London during peak usage times. The server team has
determined that the domain controllers are overwhelmed when many users are authenticating
simultaneously. To improve logon performance, you are adding a new domain controller in the London
data center.

Exercise 2: Installing a Domain Controller by Using IFM

You have been assigned by management to manage one of the new branch offices that are being
configured. A faster network connection is scheduled to be installed in a few weeks. Until that time,
network connectivity is very slow.

It has been determined that the branch office requires a domain controller to support local logons. To avoid
problems with the slow network connection, you are using IFM to install the domain controller in the
branch office.

Instructor Note: Once the domain controller is established by using the IFM media, when it reboots it
connects to other domain controllers and receives any updates and changes that occurred since the IFM
backup was created.

21
20410B
2: Introduction to Active Directory
Domain Services

22
20410B
2: Introduction to Active Directory
Domain Services

Question
Why did you use Server Manager and not dcpromo.exe when you promoted a server to be a domain
controller?

Answer
In Windows Server 2012, dcpromo.exe is deprecated and its uses are limited. For example, it is only
used at a command prompt, such as to perform an unattended installation of AD DS, or when it is
necessary to do a complete domain controller promotion from a commandline interface. Server Manager
is the preferred tool to use, or you can use Windows PowerShell or some other scripted method.

Question
What are the three operations masters found in each domain?

Answer
The three operations masters are:
Relative ID (RID) masters
Infrastructure master
Primary domain controller (PDC) emulator masters

Question
What are the two operations masters that are present in a forest?

Answer
The two operations masters that are present in a forest are the schema master and the domain naming
master.

Question
What is the benefit of performing an Install From Media (IFM) install of a domain controller?

Answer
When you have an unreliable wide area network (WAN) link, performing an IFM install reduces the use of
the WAN link and provides for a more reliable installation process.

23
20410B
2: Introduction to Active Directory
Domain Services

Review Questions

Point students to the appropriate section in the course so that they are able to answer the questions that
this section presents.

Question
What are the two main purposes of OUs?

Answer
The two main purposes of OUs are to provide a framework for delegations of administration and to provide
a structure to enable the targeted deployment of GPOs.

Question
Why would you need to deploy an additional tree in the AD DS forest?

Answer
You would want to deploy an additional tree in the AD DS forest if you needed more than one DNS
namespace.

Question
Which deployment method would you use if you had to install an additional domain controller in a remote
location that had a limited WAN connection?

Answer
You would use the IFM option, because it eliminates the need to copy the entire AD DS database over the
WAN link.

Question
If you needed to promote a Server Core installation of Windows Server 2012 to be a domain controller,
which tool or tools could you use?

Answer
To promote a Server Core installation of Windows Server 2012 to a domain controller, you could use the
following tools:
Server Manager, which would allow you to install AD DS remotely
Windows PowerShell 3.0
Run the command dcpromo /unattend on the Server Core server

24