Configuring a forest root domain on Windows Server 2008 R2
This scenario is suitable mostly for test environments because it is very rarely that someone wants to do that in production (because it already exists). But of course, maybe you start creating domain environment for new company which doesn’t have it. Then this article is also for you.
This article describes only single forest, single domain scenario.
We need some details before we will start configuration.
- Company name – which will be helpful in choosing forest/domain name
- Network configuration – valid IP addresses range for our company, router’s IP (as default gateway)
- ISP DNS servers on any public DNS servers – to be able to access the Internet resources from our company
- Services we need to run – what additional services will be required to fulfill a company requirements
Let’s start to prepare them all.
- Company name – Test Environment
- Network configuration – IP addresses range 192.168.1.0/24; the last available IP address is a router (default gateway)
- Public DNS servers – 220.127.116.11 and 18.104.22.168 (Google public DNS servers)
- Services – Active Directory: Directory Services, DNS server(s), DHCP server(s)
Now, we can install our first Windows Server 2008 R2 and configure it. After that we will be able to promote this box as a Domain Controller.
When our server is installed, then we need to log on there on local administrator account and we can start its preparation.
Open Network Card configuration and set up static IP address for your server (in this case it’s 192.168.1.1 with 255.255.255.0 network mask)
This is very important part of network configuration before promoting server as a Domain Controller. In DNS preferred IP address type 127.0.0.1 (loopback interface) or the same IP address as server is configured 192.168.1.1 to point the server to DNS itself.
Accept configuration and start promoting server by typing in run box dcpromo
You should see Active Directory Domain Services Installation wizard. Select “Use advanced mode installation” checkbox and follow with its instructions.
This warning is not so important for us, because we have no older operating systems as Domain Controllers within network. It’s about security incompatibility between NT4 and 2008/2008R2, so let’s skip this screen.
At this point, we have to choose what we want to do with domain configuration. As this article is about forest root domain, we don’t have to consider another option, now. We are creating completely new domain in a new forest.
You will see a window with question about forest root domain name. It’s good to set up name related with your company. This is so called FQDN (Fully Qualified Domain Name or also known as DNS Domain Name). Create internal domain name to separate it from your external (if it would be necessary, i.e. for e-mail) with .local or .private suffix. These suffixes suggest that DNS domain is for local resources and this is also connected with your local DNS zone name.
now, specify NetBIOS domain name
Now, you need to choose Forest Functional Level
Setting up FFL will also configure Domain Functional Level in the same mode.
This is very important step in forest/domain configuration. This setting determines which operating systems can be promoted to Domain Controllers. As we are configuring the only single forest/domain environment it is not so difficult.
Domain Functional Level determines which operating systems can act as Domain Controllers within that particular domain. By default (in new forest/domain configuration) it suggests Windows Server 2003 which means that older OSes cannot be promoted as DCs. So, NT4 and Windows 2000 Server cannot be used in a network with AD:DS role. They still can be a domain member servers but not Domain Controllers.
When you change DFL to Windows Server 2008 then only Windows Server 2008 and 2008 R2 can be promoted to be DCs. And the last choice is Windows Server 2008 R2 – the only possible operating system for Domain Controllers is Windows Server 2008 R2.
Each domain can be set up on a different Domain Functional Levels. But they have to fulfill Forest Functional Level to be able to operate within a forest.
If you have more than one domain in a forest then you have to evaluate which one work in the lowest mode. The lowest Domain Functional Level in a forest determines the highest Forest Functional Level.
Forest Functional Level determines that all Domain Controllers in each domain cannot work on older operating system than it’s specified in FFL.
If your FFL is set up to Windows Server 2003 that means, all of Domain Controllers in a forest are based on at least Windows Server 2003.
It’s similar to other modes (2008/2008 R2)
Important! When you set up Domain/Forest Functional level it cannot be changed to lower mode, so be careful when you choose them. If you are not sure which functional level is adequate for you, choose the lower one. You can always raise it without any business continuity disruption later.
As we don’t want to use older OSes as DCs, we plan to use only Windows Server 2008 R2, we can change Forest Functional Level to Windows Server 2008 R2. Domain Functional Level will be set up on the same level automatically.
This is our first domain and first Domain Controller, so we need to also set up new internal DNS server to be able to use Active Directory. Whole Active Directory services rely on DNS services, so they have to be always available.
We are configuring our first DNS server, so it doesn’t exist right now, don’t worry and continue
Specify Active Directory database, logs location (you can leave defaults, those files are not so huge and if server act as AD,DNS only, that’s enough space)
Set up password for Directory Services Restoration Mode which will be used in case of non-authoritative/authoritative restore or other AD database maintenance. This password should be different than Domain Administrator password and should be also changed regularly.
On the summary screen, you can review chosen settings and start server promotion process
After all, server reboot it’s required. You can do it manually, or select “Reboot on completion” checkbox and wait until promotion will be done
Congratulations! Your Domain Controller for a forest root domain is ready! You can log on, on it, using password specified during promotion process (the same password as Directory Services Restoration Mode)
Log on, using domain administrator credentials into your new Domain Controller. We have to configure DNS server to send unresolved DNS queries to ISP DNS server(s) or any other public DNS server(s). This configuration is necessary to be able to access the Internet resources from our internal network.
Open DNS management console from Administrative Tools and select server name. In the right pane at the bottom of that window, double click on Forwarders
You should see a window, where you can put ISP or public DNS servers. Click on “Edit” button to add those servers IP address
Enter IP addresses of external DNS servers and wait for their validation. If everything is ok, you would see green shield next to IP addresses.
Close DNS management console.
After all, you should consider Domain Controller and DNS server redundancy in your network by placing additional server with these roles. Another very important part is performing System State backup of Domain Controllers regularly.
In case of lack hardware resources in your network, you can consider placing DHCP server on this Domain Controller. However, it’s not recommended to install additional roles on DCs because of security reasons.
Above, topics would be described in another articles.
Author: Krzysztof Pytko