Hello, Cloud Gurus, and welcome back.
In this lesson, we're going to take a look
at deploying domain controllers on Azure Virtual Machines.
Let's take a look at what we're going to cover.
First up, we'll cover off the specific considerations
you need to keep in mind
when you're deploying a domain controller
on an Azure Virtual Machine,
and then we'll jump into a demo
where we'll deploy and configure a domain controller
on an Azure Virtual Machine.
All right, let's get started.
Now more often than not, your company is going to have
one or more domain controllers deployed on-premises,
and you can deploy Azure AD Domain Services
but we also cover a fairly long list of limitations,
and if those limitations prevent you
from deploying Azure AD Domain Services,
you might look at deploying domain controllers in Azure
using an Azure Virtual Machine.
To do this,
you're first going to need an Azure Virtual Network
and a subnet that you will deploy your Azure-based
domain controller VM to,
and if you want to deploy a new trusted forest
or extend your existing forest,
you'll need some sort of network connectivity
between your on-premises network
and your Azure Virtual Network,
and we explored some of these options
in the previous sections, things like VPN and ExpressRoute.
And you know that you can use Active Directory sites
to control replication traffic between networks.
So you'll want to configure an Active Directory site
for your on-premises networks
and any additional sites for Azure-based networks
based on the address ranges for your networks.
And this will allow you to limit the amount of traffic
that is sent between your on-premises network and Azure
and will allow your Azure-based users and VMs
to locate an Azure domain controller.
Now by default, Azure VMs receive a dynamic IP address
and this is not going to suit your domain controllers,
as you'll likely need to direct clients to them
for things like DNS based on their IP address.
So you can configure
your domain controller's network interface IP configuration
to have a static IP address.
And there are also some special considerations
for domain controller disks.
You should place your Active Directory database
and SYSVOL folders on a separate disk
to the operating system and set the disk caching to none.
And then you can still have optimal performance
for the operating system disk
using the default read-write caching.
Another important consideration
is around the shutdown of domain controllers.
It's not recommended to stop domain controllers
from the Azure Portal.
Instead it is recommended that you do this
from within the guest operating system,
and you can also do this using run command from the portal.
The reason behind the shutdown requirement
is because when a domain controller VM
is deallocated on Azure,
that is, when it is shut down
from outside the operating system,
some things happen that might be undesirable.
The first is that it resets some IDs
that will cause additional replication traffic,
and the second issue
is that the domain controller will discard its RID pool,
which can lead to relative ID exhaustion.
The last is that SYSVOL is marked as non-authoritative,
which shouldn't cause any problems
so long as another domain controller is powered on.
And the last important consideration
is around network traffic.
In Azure, you pay for outbound traffic,
what's known as egress traffic, but inbound traffic is free.
So you might choose
to make your Azure-based domain controllers
read-only domain controllers
to reduce outbound replication traffic.
It's not a significant amount of money
in the scheme of things, but it is worth mentioning.
Now there's quite a bit to digest here.
Let's deploy a domain controller in Azure
using the Azure Portal
and take a look at some of these options.
All right, we have an existing network on-premises
and we have an Azure Virtual Network
and these networks are connected via a VPN,
and we already have a domain controller
deployed on-premises.
In this demo, we will deploy a new VM in Azure
that we will use as our domain controller
in our Azure Virtual Network,
and we will complete the configuration
of our new domain controller
using our administrative server on-premises,
including the configuration of Active Directory sites.
Let's take a look.
All right, here we are on the Azure Portal.
Let's go ahead and deploy our new virtual machine
that we're going to use as domain controller
in our Azure Virtual Network.
We'll go ahead and click Create a Resource,
and then we'll select Create under Virtual Machine.
We have an existing resource group for this virtual machine,
so we'll go ahead and select our identity resource group,
and then we need to provide a name for our virtual machine.
We're going to use the name CORP-AUE-DC01,
and we're going to deploy it to Australia East.
And we're going to select to deploy this virtual machine
to an availability zone.
And the reason we're going to choose
to deploy this to an availability zone
is we can then go ahead
and deploy a second domain controller
in a separate availability zone.
And that will give us additional redundancy in Azure.
So we'll go ahead and deploy this virtual machine
to availability Zone 1,
and then we need to select the image that we want to use
for our virtual machine.
We want to use Windows Server 2022 Datacenter
Azure Edition Core Gen2.
And that's a decent name,
but that does mean we're going to get Azure edition,
which includes hotpatch and core,
which is beneficial for the size of the virtual machine
and it reduces the security footprint
and the required patching for the virtual machine.
So we'll go ahead and navigate and find that image.
We'll go See All Images,
and then we'll select Windows Server.
We're going to go ahead and use the default size of a
D2s_v3, because that size is similar to the size
of the virtual machines
that we're using as domain controllers on-premises,
and we just need to provide a username and password.
So we'll go ahead and provide that.
And we don't want to allow any inbound network ports
to our domain controller,
because we can control network security
using a Network Security Group
on the virtual network subnet.
So we're going to go ahead and select None
for public inbound ports.
And then we can go ahead and select Next.
We'll leave the default Premium SSD
for our operating system disk,
because that will provide a high level of availability
for our virtual machine,
and we need to attach a data disk
for the Active Directory database and SYSVOL.
So we'll go ahead and create and attach a new disk, and
we're going to go ahead and change the size of this disk
and we're going to set the size to 16 gigabytes,
because we don't require a size any larger than that
for our Active Directory database and SYSVOL.
We'll go ahead and select OK and then OK again.
Now it's very important
that we set the host caching option to none
for the Active Directory database data disk.
We can go ahead and select Next
to take a look at the networking options.
We have an existing virtual network deployed
for our domain controller,
so we'll go ahead and select that.
And we have an existing identity subnet
for our domain controller.
We definitely do not want a public IP address
on our domain controller, so we'll set that to none.
And we don't need a Network Security Group
attached to the network interface, so we'll select None
and then we can go ahead and select Management,
and we're going to enable boot diagnostics
with the managed storage account.
And we can Enable Hotpatch
and use Azure-orchestrated patch orchestration.
We can go ahead and select Next for advanced.
There's no additional options we need to set here
so we can go ahead and select Review and Create.
It'll validate and then we go ahead and click Create.
All right, this will just take a moment to deploy.
So we'll come back when this is done.
All right, the deployment of our new
domain controller virtual machine is now complete.
Let's go ahead and navigate to the virtual machine.
Now it's important that we set the network configuration
for this new domain controller to use a static IP address.
And we also need to set it to use any existing DNS server,
so we can domain join this virtual machine
to our existing Active Directory domain
and then promote it to a domain controller.
So to do that, we'll navigate to Networking, under Settings,
and then we'll navigate to our network interface.
And then we'll navigate to IP configurations
and we're going to edit our IP configuration
for this virtual machine.
And we're going to set the static IP address for this VM
to 10.0.0.11, and then we can go ahead and click Save.
This will just take a moment to save.
So we'll come back when this is done.
All right, with the static IP address
for this virtual machine now configured,
let's navigate back to the network interface
and configure the DNS server
to use an IP of an existing domain controller.
So we'll navigate back to the network interface.
And then we'll select DNS servers under Settings.
We'll change the DNS server to use a custom DNS server,
and we'll add the IP address
of an existing on-premises domain controller.
And in a production environment,
you probably would have
more than one domain controller on-premises.
So you'd normally add at least 2 DNS servers a year.
And then we can go ahead and click Save.
Now once this is saved, I'm going to go ahead
and log onto this virtual machine
and complete the initial configuration of the server,
including domain joining the server.
And then we will continue on our administrative server
and complete the installation
of Active Directory Domain Services
and promote this server to a domain controller.
All right, now that we've completed
the initial configuration
of our new Azure-based domain controller, we're
going to go ahead and configure an Active Directory site
for the Azure Virtual Network.
To do that, we'll launch Administrative Tools
and then we'll launch Active Directory Sites and Services.
We'll expand out the sites node.
And then we'll right click Sites and select New Site.
And we're going to call this site AzureAustraliaEast.
We can go ahead and select the default IP site link.
Then we can go ahead and click OK.
It's just reminding us
that we're going to need to add our subnets
and our domain controllers to this site.
We're going to do that so we'll go ahead and click OK.
Now let's go ahead and create a subnet for the new site.
So we'll right click the Subnets node, select New Subnet
and we'll enter in the IP address range
for the Azure Virtual Network, which is 10.0.0.0/16.
And we'll select the AzureAustraliaEast site
and then we can go ahead and click OK.
All right, Active Directory Sites and Services
are now configured, so we can go and close that console.
And go ahead and close Administrative Tools.
Now let's go ahead and launch Server Manager.
And we'll go ahead and add our new virtual machine
into Server Manager.
So we'll select Manage and then we'll select Add Servers.
We'll select Add Servers from Active Directory
and then we'll click Find Now,
and there's our new Azure Virtual Machine.
We'll go ahead and add that into Server Manager.
Go ahead and click OK.
And it'll just take a moment to pull that server.
So we'll come back when that's done.
All right, and now that our new domain controller
has been added into Server Manager,
let's go ahead and verify the disk configuration
for our new server.
So we'll navigate into and storage services,
and then we'll navigate into disks.
And we can see here, we've got our 16 gigabyte data disk
that we attached to our virtual machine,
but it doesn't have a partition.
So we're going to need to configure this disk.
We're going to cover disk configuration
in an upcoming lesson,
so I'm going to go ahead and configure this disk
and then we'll come back when it's done.
All right, our disk is now configured
so we'll go ahead and select Close.
And then we can go ahead
and install the Active Directory Domain Services role
on our new server.
So we'll navigate back to the dashboard,
we'll select Manage,
and then we'll select Add Roles and Features.
And you are already familiar with the process
of installing the Active Directory Domain Services role.
So I'll go ahead and skip this
and we'll come back when this is done.
All right, the installation of the Active Directory
Domain Services role has been completed.
Let's go ahead and promote this server
to a domain controller.
So we'll select the handy link that they've got here
and we're into add a domain controller
to an existing domain.
And we're going to join it
to our existing corp.barrierreefaudio.com domain.
And we'll provide the credentials for a domain admin user.
We'll go ahead and click OK.
Then we'll select Next.
All right, and you can see here,
based on the IP information of our new controller
that it's automatically selected
the AzureAustraliaEast site.
So we can just go ahead
and provide a Directory Services Restore Mode password.
And we could optionally create this
as a read-only domain controller if we wanted to,
but we're just going to go ahead and select Next.
We don't need to update the DNS delegation
because one doesn't exist,
so we're just going to go ahead and select Next.
And we'll just select to replicate
from any available domain controller.
We only have one other domain controller, so that's fine.
Now here, we need to change the database location
for our SYSVOL and our Active Directory database.
The data disk that we added
to our Azure Virtual Machine is E drive,
so we're going to go ahead and change this from C to E.
And then we can go ahead and select Next.
And then once we've reviewed our configuration,
we can go ahead and select Next.
It'll run a prerequisite check
and then we can go ahead and click Install.
All right, that concludes the demo
of configuring a new domain controller
running on an Azure Virtual Machine.
Let's go ahead and wrap up with a bit of a summary
of what we've covered in this lesson.
All right, so what have we covered in this lesson?
It's important that you use a static IP address
for your domain controllers in Azure
and you do not assign a public IP address.
And you need to ensure
that the host-based disk caching option
for the Active Directory database and SYSVOL is set to none.
And it's also important
that you do not shut down domain controllers
from the Azure Portal.
Instead, you should shut them down
using the VM guest operating system.
And you should always configure your Active Directory sites
to match your network topology,
And this includes your Azure Virtual Networks.
And you should consider using read-only domain controllers
to reduce outbound replication
from your Azure Virtual Networks.
All right, that concludes this lesson.
Thanks for being with me and I hope you found it useful.
And I look forward to seeing you in the next lesson.