Good day, Cloud Gurus,
and welcome back for this lesson
where we're going to take a look
at managing Azure AD Domain Services.
Let's take a look at what we're going to cover.
First up, we'll take a look
at how you manage the Azure AD Domain Services instance,
and then we'll take a look at how you can manage
the Azure AD Domain Services managed domain,
which is the Active Directory Domain Services component
of the deployment,
and then finally, we'll take a look at a demo
and we'll manage Azure AD Domain Services,
both in the Azure portal and using the traditional
Active Directory Domain Services management tools.
Let's jump in.
All right. Let's first take a look
at managing Azure AD Domain Services.
There are 2 layers to managing Azure AD Domain Services.
There is the resources layer
and that allows you to configure some options
around the Active Directory Domain Services forest
that Microsoft is managing for you.
Let's take a look at that first.
To manage Azure AD Domain Services resources,
you need to be assigned for Domain Services Contributor
Azure role-based access control role.
And once you have that role assigned,
you can manage settings such as changing the SKU,
editing synchronization settings
like enabling scoped sync
from Azure AD to filter out users and groups,
and you can also modify the security settings
to harden your Azure AD Domain Services environment.
And the second layer of management is the managed domain,
and this is really the Active Directory
Domain Services component of Azure AD Domain Services.
Let's take a look at how you manage that layer.
To manage the managed domain,
you need to use an Azure AD Domain Services domain-joined VM
and you also need to have a synchronized account
that has gone through the password reset process
or has been synced from on-premises
and the password hashes have been sent to Azure AD.
You also need to be a member of the AAD DC
Administrators Azure AD group.
And once you've passed all of those hurdles,
you can log into the VM and install the management tools
and then from there,
you can modify the Active Directory
Domain Services structure,
and we'll explore more as to why you might want to do this
in the next section.
And you can also manage users and groups,
remembering that there is no write back to Azure AD
and you can also create Service Accounts
for your Azure AD Domain Services joined VMs to use
including those group-managed service accounts
that we know and love.
And as the managed domain controllers also run DNS,
you can manage DNS, including creating resource records
and configuring forwarders,
just like you would with any other DNS server.
And finally, you can manage group policy.
But that's something we'll explore
in a lot more detail in the next section.
All right. Let's take a look at a demo
of managing Azure AD Domain Services.
We already have our Azure AD Domain Services
managed domain deployed
and we had our management VM domain-joined
and ready to manage our active directory
domain services domain.
In this demo, we will first take a look
at how you can manage the settings
on the Azure AD DS instance in the Azure portal,
including the SKU, the sync settings
and the security settings.
And then we will add an administrator
to the AAD DC administrators group in Azure AD.
And then we will log on to the management server
using our administrative user,
install the remote server administration tools,
and take a look at how we can manage
Active Directory Domain Services and DNS.
Let's jump into the demo.
All right, here we are on the Azure portal.
Let's first take a look
at managing Azure AD Domain Services.
So we'll go ahead and navigate
to our instance of Azure AD Domain Services.
And there isn't a lot you can change
once you've deployed Azure AD Domain Services,
but there are some settings that you can change.
The first to be aware of is synchronization.
So we'll navigate to synchronization under Settings.
And from here, you can modify the synchronization scope
to limit the synchronization to specific users or groups.
And you can also change the SKU
if you decide that you need additional performance
for your managed domain.
And finally, the last settings to be aware of
are the security settings.
And you can come back in here
as you decommission older Active Directory Services
and harden your Azure AD Domain Services managed domain
by disabling less secure options.
All right.
Now let's go ahead and add a user
to the AAD DC Administrators group in Azure AD
so that they can manage the managed domain.
So we'll go ahead and navigate to Azure AD.
We'll just navigate home
and then we'll navigate into Azure Active Directory
and then we'll navigate into Groups
and then we'll select the AAD DC Administrators group
and then we'll select Members.
And we have one user in here
that we previously used to perform
an Azure AD Domain Services domain join.
Let's go ahead and add Adam Bevan as a member of this group,
which will also allow them to the manage the managed domain.
So, to do that, we'll click Add Members,
we'll search for Adam's username,
and we'll go ahead and click Select
to add Adam to the group.
And then we'll go ahead and click Refresh.
All right. And now, Adam is going to be able to log on
to any VMs that are joined to the managed domain
and manage the Active Directory
Domain Services managed domain.
All right, now let's go ahead and log on
to AZ-AUE-ADM01 as Adam
and then we'll go ahead and install the management tools
and I'll show you some of the management capabilities.
All right, now let's go ahead and log into our management VM
as our Adam Bevan test user.
So we'll go ahead and connect to our VM.
We'll enter in Adam's credentials.
We'll go ahead and skip past this certificate prompt.
All right, and now we'll logged on
to this virtual machine as Adam.
Let's go ahead and install
the remote server administration tools
for Active Directory and DNS.
So we'll go ahead and launch Server Manager.
And then we'll select Manage
and then Add Roles and Features.
We've been through this a few times before,
so we'll skip through this fairly quickly.
So we'll select Next.
We'll do a role-based installation and select Next.
Select Next to use the current server.
We're not going to install any roles, so we'll select Next.
But we are going to install some features
and we're going to install
the remote server administration tools.
So I'll scroll down about halfway
and then we'll expand the remote server administration tools
and then we'll select the Role Administration Tools
and then we'll select Active Directory Domain Services.
And we'll also select to install the DNS server tools.
We'll go ahead and click Next,
and then we can go ahead and click Install,
and this will just take a moment to install.
So we'll come back when this is done.
All right, the installation is now complete.
So we'll go ahead and close this.
And we'll go ahead and close Server Manager,
And then let's go ahead and launch the Active Directory
Users and Computers Administrative tool.
So we'll select Start and then Windows Administrative Tools
and then we'll select Active Directory Users and Computers
and we'll expand out our domain.
And we can see here, we get a default structure
set up with Active Directory Domain Services.
When computers are joined to the managed domain,
they're added to the AAD DC computers container.
And when users are synchronized from Azure Active Directory,
they're added to the AAD DC users container,
and we'll come back and take a look at this
in a bit more detail in future lessons.
Now let's go ahead and take a look at DNS.
So we'll close this
and we'll launch the DNS Management console
and we'll select to connect to the following computer,
and we'll just type in the IP address
of one of our managed domain controllers.
So for this we'll use 10.0.0.5.
We could type in the computer name
for the domain controller as well
if we knew what it was.
But for our purposes, the IP address will be fine.
So we'll go ahead and click OK,
and we'll expand our server by double clicking on it.
And we'll expand forward lookup zones.
And from here, we can see that
we have a forward lookup zone for our managed domain
and we also have the built-in active directory zone
and we can also configure conditional forwarders.
And if we wish, if we right click on the server
and then select Properties,
we can also configure server-level forwarders
and modify our root hints as required.
All right. That concludes this demo.
Let's wrap up with a bit of a summary
of what we've covered in this lesson.
All right. So what have we covered in this lesson?
You must have the Domain Services Contributor role
or a more privileged role assigned
to manage Azure AD Domain Services resources.
And your user account must be a member of the
AAD DC Administrators group
AAD DC Aadministrators group
to manage the Azure AD Domain Services managed domain.
And Azure AD Domain Services must be managed
from an Azure AD Domain Services joined management VM.
All right. That concludes this lesson.
Thanks for being with me.
And I hope you found this useful.
And I look forward to seeing you in the next lesson.