Hello, Cloud Gurus, and welcome back.
In this lesson, we're going to take a little bit of time
to understand both domains and domain controllers.
Let's take a look at what we're going to cover.
First up, we'll take a closer look at the purpose
of an Active Directory Domain Services domain.
And then we'll take a closer look at domain controllers.
And then we'll demo where we'll deploy a new child domain
in an existing forest.
And then we'll cover off the process
of performing a domain join.
And then finally, we'll do a demo
of performing a domain join.
So we've got a bit to cover in this lesson, let's jump in.
So what is an Active Directory Domain Services domain?
Well, the first is that it's a replication boundary.
Changes made to objects within the domain are replicated
within the domain.
And only some objects are replicated outside the domain
to other domains in the forest.
And these include things like what we've mentioned before:
the global catalog and the schema.
We'll dive a little bit deeper
into replication later on in this section.
And a domain is also an administrative unit.
A domain contains privileged users and groups
that are specific to that domain,
and they don't have privileges
to manage other domains in the forest.
These include things like the domain admins group,
which is able to administer all computers
in the domain by default, and it has full control
over all the objects in the Active Directory database.
And there's also the administrator account,
which is a member of the domain admins group.
And just a quick note on this:
The built-in administrator account in the root domain
is also a member of Enterprise Admins and Schema Admins.
So the administrator account in the root domain
has some additional privileges that administrator accounts
in child domains don't have.
And organizations
with decentralized administrative structures
or multiple locations
might consider implementing multiple domains
in the same forest
to accommodate their administrative needs.
And here's a tip for the exam;
you must be a member of the Enterprise Admins group
to add a new domain to an existing forest.
Alright, now let's take a closer look at domain controllers.
A domain controller provides authentication
and authorization; that is verifying who everyone is,
and what they can access.
And domain controllers store
and replicate the Active Directory database,
which contains users, groups,
and computers, and other objects within the domain.
And each domain controller stores a copy of the database
and can make changes to the database.
And here's another exam tip for you;
your account must be a member of the Domain Admins group
to deploy a new domain controller.
Alright, let's take a look
at a demo of deploying a new child domain.
We currently have our forest root domain,
and our internal research department requires
administrative control over their users and computers,
so we're going to deploy a new domain for them.
We already have our CORP domain controller deployed
in the Brisbane office, and our research team
is also located in the Brisbane office.
And there is a new subnet that will be used
for research computers.
So to add this child domain,
we're going to deploy a new domain controller and promote it
as the first domain controller in the child domain,
and we'll complete all of these steps
on the research domain domain controller; RES-BNE-DCO1.
Let's take a look.
Alright, here we are logged on RES-BNE-DCO1.
I'm going to first confirm the DNS settings are correct
for this server,
so I'm going to select the network settings
and then we'll right-click on the Ethernet adapter
and select Status, and then we'll select Details.
And I just need to confirm
that our existing root domain controller is configured
as the DNS server for this new domain controller.
And we can see that it is here,
10.1.1.5 is the IP address
of our existing domain controller,
so we'll go ahead and close this.
And the first step to promote this server
as a trial domain controller
is to install the Active Directory Domain Services role.
So let's go ahead and do that.
We'll close Network Connections
and we'll click Manage and then Add Roles and Features.
And we'll just run through the process
of installing the Active Directory Domain Services role,
which you're familiar with,
so we'll skip this and we'll come back when this is done.
Alright, with the installation
of the Active Directory Domain Services role complete,
we can go ahead and promote this server
to a domain controller,
so we'll go ahead and select the option here,
and we're going to select the option to add a new domain
to an existing forest, and the type of domain
that we're adding is a child domain.
We're going to provide the parent domain name,
which in our case is corp.barrierreefaudio.com,
and the new domain name that we're using is research,
so we'll provide that.
And because we're adding a new domain
in an existing active directory forest,
we need to provide credentials for an account
that is a member of the Enterprise Admins group.
So we'll go ahead and select Change,
and we'll enter in our Enterprise Admin credentials.
And then we can go ahead and select Next.
It's best practice to make all
of our domain controllers DNS servers,
so we're going to leave the options here as they are
and we'll just provide
our directory services restore mode password,
and then we'll select Next.
And then we're going to create a DNS delegation
to delegate the research.corp.barrierreefaudio.com DNS zone
to this domain controller.
So we'll go ahead and select Next,
and it's best practice
to use the default NetBIOS domain name,
so we'll go ahead and select Next.
We're going to use the default paths
for the Active Directory database, so we'll select Next.
And as we showed before,
Microsoft provides a PowerShell script
that you can use to automate the process
of installing a new child domain.
Let's select View Script and take a look at that.
And we can see here that the PowerShell cmdlet
for installing a new Active Directory Domain Services
is Install-ADDSDomain,
and it's got the configuration options
that we've provided here as parameters.
We'll go ahead and close this.
And then we can click Next.
It'll run a prerequisite check
and then we can click Install.
Alright, this'll just take a moment to complete.
And then we'll log back on
as the administrator account for this domain when it's done.
Alright, with the promotion
of this domain controller complete,
I just want to show you how this domain looks
in the Active Directory Domains and Trusts
administrative tool.
So we'll click Start, Administrative Tools,
and then Active Directory Domains and Trusts.
And we'll just expand out the parent domain,
and then we can see our child domain listed
under the root domain.
Alright, that concludes this demo.
Now let's go have a look at performing a domain join.
Alright, now as we discussed in the previous lessons,
computers perform a domain join to be managed
and secured by the domain controllers,
and there are two broad methods
for performing a domain join,
and the steps are a little bit different for each of these.
The first method is online,
where the computer has network connectivity
to a domain controller.
And the second is offline
where there is no network connectivity
to a domain controller required.
To perform an online domain join,
you require network connectivity
and DNS configured to locate the domain controller.
Typically the domain controllers will be your DNS servers
and these settings will be automatically configured for you
in your corporate network using a technology like DHCP,
which we'll cover later in this course.
And any Active Directory user can join a computer
to the domain up to 10 times.
And Domain Admins and Administrators
do not have the join limit.
You can also perform an offline domain join,
and you can perform an offline domain join
without contacting a domain controller,
and it's useful in disconnected environments.
For example, you might have a device
that is not on the corporate network,
or you might have a situation where the speed
at which you deploy the Windows Operating System
is important.
For example, if you're scaling virtual machines
to rapidly meet demand.
Offline domain join early in the Window setup process
does not require the additional reboot
that's normally required when you perform a domain join.
The high-level steps to perform an offline domain join
include using the command line tool called Djoin
and provisioning a computer account
and then saving the metadata for that computer account
to a text file, and then using the text file
on the target computer to complete the offline domain join.
And this is an important tip for your exam;
the command-line tool Djoin is used
to perform an offline domain join.
Alright, let's take a look
at a demo of performing a domain join.
We have our domain controller deployed.
In this demo, I'll show you some of the methods
that you can use to perform a domain join,
and then we'll join CORP-BNE-ADM01
to the domain using an offline domain join.
Let's take a look at the demo.
Alright, so here we are logged on CORP-BNE-ADM01,
and I'm going to show you each of the ways
that you can perform a domain join.
The first way is to use Server Manager.
So you can select the Work Group option here,
and then you can select Change
to change to a different work group or join a domain.
And then we could provide the name of the domain
and then we could click OK to join the domain.
We're not going to perform a domain join using this,
so we're going to hit Cancel and Cancel again.
Another way to perform a domain join is using PowerShell.
So we'll launch PowerShell.
And you can use the Add-Computer PowerShell cmdlet
to perform a domain join.
And I'm just going to use the WhatIf parameter here
so you can see what this cmdlet would do.
Now I need to provide credentials of a domain user
to perform the domain join, so we'll go ahead and do that.
And you can see here that WhatIf indicates
that the add computer commandlet would perform a domain join
on the domain corp.barrierreefaudio.com
on the target CORP-BNE-ADM01.
Alright, instead of performing a domain join
using PowerShell, let's go ahead
and demonstrate how you can perform an offline domain join.
So we'll go ahead and jump over to our domain controller.
Alright, so here we are on our domain controller.
Let's use the Djoin utility to provision a computer account
for CORP-BNE-ADM01.
We'll launch PowerShell,
and we're just going to switch over
to the legacy command prompt,
because Djoin has some compatibility issues with PowerShell,
and we'll go ahead and run the Djoin provision command.
We'll provide the name of the domain
and we'll provide the name of the computer
that we're joining to the domain,
and then we'll save the offline domain join metadata
in a file.
Alright, now that we've provisioned that computer account
and saved the metadata to a file,
so let's copy across that metadata file
to ADM01 and complete the offline domain join.
Alright, so here we are back on ADM01.
We'll go ahead and paste that metadata file.
And this metadata file contains sensitive information,
so we're going to delete this file when we're done.
Now let's go ahead and complete the domain join
using command prompt.
Jump over to PowerShell, switch to command prompt.
We're going to run the djoin command again
with the request offline domain join parameter.
We're going to load our metadata file,
provide the local paths to Windows,
and specify that we're offline domain joining
the local operating system.
We'll go ahead and press Enter to run this command.
And the provisioning has been successfully completed,
so we can go ahead and restart this computer
to complete the offline domain join.
Alright, that concludes this demo.
Let's wrap up with a bit of a summary
of what we've covered in this lesson and some key takeaways.
Alright, let's take a look at what we've covered.
Our domain is a replication boundary
and an administrative unit within a forest,
and you must be a member
of the Enterprise Admins group to add a new domain
to an existing forest.
It's also important to know
that domain controllers provide authentication
and authorization within a domain.
And it is the responsibility
of the domain controllers to update, store,
and to replicate the active directory database.
And finally,
a domain join can be performed offline or online,
and offline is useful where connectivity is an issue
or speed is important.
Alright, that concludes this lesson.
Thanks for being with me and I hope you found it useful.
And I look forward to seeing you in the next lesson.