Search icon CANCEL
Subscription
0
Cart icon
Your Cart (0 item)
Close icon
You have no products in your basket yet
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Conferences
Free Learning
Arrow right icon
Arrow up icon
GO TO TOP
Active Directory Administration Cookbook, Second Edition

You're reading from   Active Directory Administration Cookbook, Second Edition Proven solutions to everyday identity and authentication challenges for both on-premises and the cloud

Arrow left icon
Product type Paperback
Published in Jul 2022
Publisher Packt
ISBN-13 9781803242507
Length 696 pages
Edition 2nd Edition
Languages
Tools
Arrow right icon
Author (1):
Arrow left icon
Sander Berkouwer Sander Berkouwer
Author Profile Icon Sander Berkouwer
Sander Berkouwer
Arrow right icon
View More author details
Toc

Table of Contents (18) Chapters Close

Preface 1. Chapter 1: Optimizing Forests, Domains, and Trusts 2. Chapter 2: Managing Domain Controllers FREE CHAPTER 3. Chapter 3: Managing Active Directory Roles and Features 4. Chapter 4: Managing Containers and Organizational Units 5. Chapter 5: Managing Active Directory Sites and Troubleshooting Replication 6. Chapter 6: Managing Active Directory Users 7. Chapter 7: Managing Active Directory Groups 8. Chapter 8: Managing Active Directory Computers 9. Chapter 9: Managing DNS 10. Chapter 10: Getting the Most Out of Group Policy 11. Chapter 11: Securing Active Directory 12. Chapter 12: Managing Certificates 13. Chapter 13: Managing Federation 14. Chapter 14: Handling Authentication in a Hybrid World (AD FS, PHS, PTA, and DSSO) 15. Chapter 15: Handling Synchronization in a Hybrid World (Azure AD Connect) 16. Chapter 16: Hardening Azure AD 17. Other Books You May Enjoy

Using Install From Media

For Active Directory environments with really low bandwidth or networking resiliency between locations with domain controllers, regardless of whether these are read-only domain controllers or fully writable domain controllers, promoting a Windows Server installation to a domain controller can take a long time or even fail.

In these types of scenarios, for adding an additional domain controller or read-only domain controller to an existing domain, Microsoft offers the Install From Media (IFM) option.

Getting ready

When creating IFM media, check for proper Active Directory replication before creating the IFM media on the domain controller. This ensures that the domain controller is up to date with all changes in Active Directory.

Create a folder on the source and destination domain controller to store the files needed for IFM.

How to do it...

IFM consists of two steps:

  • Creating the IFM package
  • Leveraging the IFM package

Creating the IFM package

To create the IFM package, perform the following actions on a domain controller in a well-connected networking location, running the same version of Windows Server on which you intend to use the IFM package to swiftly promote it to a domain controller in a low-bandwidth scenario:

Tip

IFM packages to create read-only domain controllers can be created on both read-only domain controllers and on fully writable domain controllers. IFM packages to create fully writable domain controllers can only be created on fully writable domain controllers.

  1. Sign in interactively to the domain controller that you want to use as the source server for IFM.
  2. Press Start.
  3. Search for Command Prompt, right-click its search result, and choose Run as administrator from the context menu. Alternatively, run cmd.exe, but instead of running it by pressing Enter, press Ctrl, Shift, and Enter.
  4. Run the following command to start the NTDS utility in interactive mode:
    ntdsutil.exe
  5. Type the following command in interactive mode to select the Active Directory database:
    activate instance ntds
  6. Type the following command in interactive mode to enter the IFM creation context:
    IFM
  7. Type the following command in interactive mode to create IFM, including the contents of the Active Directory SYSVOL for a read-only domain controller, and place it in the C:\IFM folder:
    create RODC C:\IFM 
  8. Type the following command in interactive mode to exit the IFM context:
    quit
  9. Type the following command in interactive mode to exit the NTDS utility itself:
    quit
  10. Close the Command Prompt window.

Leveraging the IFM package

To leverage the IFM package on the destination domain controller in the remote location, choose one of the following methods:

  • Using the Active Directory Domain Services Configuration Wizard after you've installed the Active Directory Domain Services role
  • Using dcpromo.exe
  • Using the Install-ADDSDomainController PowerShell cmdlet

Using the Active Directory Domain Services Configuration Wizard

Perform these steps to leverage the install using the Active Directory Domain Services Configuration Wizard:

  1. Promote the Windows Server installation as you would normally.
  2. On the Additional Options screen, click the Install from media option:
Figure 2.12 – The Additional Options screen of the Active Directory Domain 
Services Configuration Wizard

Figure 2.12 – The Additional Options screen of the Active Directory Domain Services Configuration Wizard

  1. On the Install from Media screen, specify the location on the drive of the Windows Server installation you intend to promote to a (read-only) domain controller using the Install from Media option.
  2. Optionally, specify the fully writable domain controller you want to replicate from. Specify a domain controller that is best reachable from the intended domain controller.
  3. Click Next > to proceed to the next screens as you normally would.

Using the Install-ADDSDomainController PowerShell cmdlet

The Install-ADDSDomainController PowerShell cmdlet only needs the -InstallationMediaPath additional parameter to leverage the IFM package when promoting a Windows Server installation to a domain controller.

When combining it with the sample PowerShell command for adding a domain controller to an existing domain, the following line of Windows PowerShell emerges:

Install-ADDSDomainController -DomainName lucernpub.com -InstallationMediaPath "C:\IFM"

Replace lucernpub.com with the DNS domain name of your Active Directory domain.

Using dcpromo.exe

As with the Install-ADDSDomainController PowerShell cmdlet, dcpromo.exe requires an optional parameter to leverage the IFM package.

Perform the following steps:

  1. Promote the Windows Server installation, as you would normally.
  2. When using an answer file, add the following line:
    ReplicationSourcePath= "C:\IFM"
  3. When using unattended mode, add the following argument:
    /ReplicationSourcePath:"C:\IFM"

How it works...

As a Windows Server installation becomes a domain controller, it replicates the contents of the Active Directory database and the Active Directory SYSVOL to its local hard drive(s). The entire package needed for this replication can also be assembled before promotion. Then, the IFM package can be delivered to the remote location, or even carried by the technician that will promote the (read-only) domain controller.

Important Note

The amount of network traffic needed when using the IFM option is heavily reduced but is certainly not zero. As the IFM package represents a point-in-time snapshot of the contents of the Active Directory database and the Active Directory SYSVOL, any changes between the time of the creation of the IFM package and using it will need to replicate before promotion of the domain controller is successfully completed.

You have been reading a chapter from
Active Directory Administration Cookbook, Second Edition - Second Edition
Published in: Jul 2022
Publisher: Packt
ISBN-13: 9781803242507
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at $19.99/month. Cancel anytime