Hello, Cloud Gurus,
and welcome back for this lesson
where we're going to take a moment to understand
Active Directory forests.
Let's take a look at what we're going to cover.
First up, we'll take a moment to understand what exactly
is an Active Directory Domain Services forest?
Then we'll take a look at deploying AD DS forests
and then finally, we'll do a demo
where we will deploy a new
Active Directory Domain Services forest.
Let's get started.
Let's take a closer look
at Active Directory Domain Services forests.
So, what exactly is a forest?
And why does it have such a seemingly odd name?
Active Directory Domain Services starts with a forest.
And as we mentioned in the previous section,
the forest contains one or more
Active Directory Domains.
And each of these domains
has one or more domain controllers.
And each domain also has a DNS name.
Now, you can have child domains too,
and each child domain is a subdomain of its parent.
Domains that share a common root DNS name
are collectively known as a domain tree,
where there is a root domain and child domains.
The first root domain in the forest
is referred to as the forest root domain.
Now, you can have more than one root domain.
Additional root domains have a different DNS name
and they're referred to as tree root domains.
And each of these contiguous domain names
is referred to as a domain tree,
and that's where the name forest comes from.
Let's take a look at some key facts
regarding AD DS forests.
An AD DS forest is a security boundary.
All domains in the forest trust all of the other domains
in the forest,
and this is what makes sharing resources
within a forest, easy.
Anything outside of the forest is untrusted.
And that's what these two-way arrows represent
in the diagram.
Each domain trusts the other domain,
either directly or indirectly.
There are also 2 privileged groups that exist
once in a forest in the forest root domain.
They are the enterprise admins group,
which is the most privileged group
in the Active Directory forest,
and then we also have the schema admins group,
which is responsible for maintaining the schema.
And more on the schema in just a moment.
An AD DS forest is also a replication boundary.
The forest shares a schema and a global catalog.
The schema is the definition of objects
and the properties that can be assigned to those objects.
The schema in an Active Directory forest
can only be added to. It can't be reduced,
and that's why the Schema Admins group
is so important to secure.
Any changes that you make to the schema, you're stuck with.
And the global catalog is a reference
to every object that exists in the forest.
It makes finding objects easier.
Think of it as an address book for the forest.
We'll cover the global catalog
in more detail later on in this section.
Now, ideally every organization will just have one forest
and one domain, but due to business events,
this is quite frequently not the case.
Before you deploy
an Active Directory Domain Services forest,
there are a few things you should be aware of.
The first is that you need to be a member
of the local Administrators group on the server
that will be the first domain controller in your forest.
And the built-in Administrator user will be added
to Enterprise Admins and Schema Admins group in the forest,
and you will also need to provide a DNS name
and a NetBIOS domain name.
The DNS name should be a subdomain
of your company's external domain name,
typically what their website uses.
And that's because if your company merges
with another company down the track,
you will both need to have unique
Active Directory domain names
if you want to share resources.
And the NetBIOS name has a maximum
of 15 alphanumeric characters.
The default value of using the subdomain
is recommended to optimize compatibility.
And the NetBIOS name is required for backwards compatibility
but it's largely unused these days,
apart from maybe simplifying the login process.
You'll also need to provide a directory services
restore-mode password,
and this is a highly privileged password
and must be kept secure.
It's used when recovering the Active Directory database
from a backup.
And as we mentioned previously,
Active Directory requires DNS.
Your first domain controller should also be a DNS server
if you don't already have DNS in your network.
But for ease of management, it's ideal to make
all of your domain controllers, DNS servers.
Let's take a look at a demo of deploying
a new Active Directory Domain Services forest.
I've gone ahead and decommissioned the DNS servers
from our previous lessons.
We still have our administrative server
on the internal secure network.
In this demo, we're going to deploy a new forest
by deploying the first domain controller in that forest.
The server will also be configured as a DNS server.
There are 2 main steps in this process.
We will install the Active Directory Domain Services
server role, and then we will promote the server
to a domain controller in a new forest.
Now, I would normally recommend deploying Windows
using the server core installation option
for your domain controllers, but for the purposes
of demonstrating the deployment of a new forest,
I will use the desktop experience in this demo.
Let's jump into the demo.
All right.
So, here we are on the server that we're going to use
as the first domain controller in our new forest.
We're going to start by using server manager
to add the Active Directory Domain Services role.
To do that, we're going to select Manage,
and then we'll select Add Roles and Features.
We'll click Next on the welcome message.
We're going to do a role-based installation.
We'll select the local server,
and then we're going to select
the Active Directory Domain Services role.
We'll add the required features
for Active Directory Domain Services
and then we'll click Next.
We're not going to add any additional features.
So, we'll click Next.
It'll provide us with a bit of a message
about Active Directory Domain Services
and Azure Active Directory.
We're going to cover Azure Active Directory later on
in this course.
So, I want to go ahead and click Next,
and then we can click Install.
Now, this process will just take a little while to complete
and we'll come back when it's done.
All right, with the installation
of the Active Directory Domain Services role complete,
we can now go ahead and promote the server
to a domain controller.
Now, Microsoft provides a nice little handy link here
to promote the server to a domain controller,
but you can also access this from the notification center
in server manager.
We'll go ahead and select this link to promote the server
to a domain controller.
And we're adding
a new Active Directory Domain Services forest.
And now we're going to provide the root domain name,
which for our purposes is corp.barrierreefaudio.com.
We'll go ahead and select Next.
And we're going to make this server a DNS server.
And because it's the first domain controller in the forest,
it's also going to be a global catalog.
We'll go ahead and provide the directory services
restore mode password
and then we can go ahead and select Next.
And we receive a warning here
because the Configuration Wizard can't locate
a Windows server running DNS for the parent domain
because the external domain is outside of our network.
We understand that.
So, we're going to go ahead and select Next.
Now, we need to provide a NetBIOS domain name
and the default of using the subdomain
of the parent domain is recommended.
So, we're going to go ahead and use that.
And we're going to accept the default locations
for the Active Directory database,
and then we get provided with the opportunity to review
the options that we've selected
during the Configuration Wizard.
But one other handy piece of information
that's provided here is,
Microsoft provides the PowerShell script
that you could use to automate this deployment.
So, we're going to select the View Script option here
and you can see here that it's importing a PowerShell module
and then it's using the install AD DS forest cmdlet
to install a new Active Directory Domain Services forest.
And you can see all of the installation options
that we've selected here.
I'll go ahead and close this and continue.
It'll run a prerequisites check,
and then we'll go ahead and select Install.
And when the installation is complete,
the Configuration Wizard will go ahead
and restart the server to complete the promotion process.
All right, that concludes this demo.
Let's go ahead and wrap up with a bit
of a summary of what we've covered in this lesson.
All right.
So, what have we covered?
An Active Directory forest is made up of one
or more domain trees.
And an Active Directory forest is a security boundary,
all domains in the forest trust each other.
And an Active Directory forest
is also a replication boundary.
The schema and the global catalog are shared
within the forest.
And the schema is the definition of the objects
and the properties that can be assigned
to those objects within the forest.
And finally, the global catalog is a reference
of every object in the forest
and it's used to locate objects within the forest.
All right.
That concludes this lesson.
Thanks for being with me and I hope you found it useful.
And I look forward to seeing you in the next lesson.