In this demonstration, I'm going to show you how to use install for medium,
or IFM, to promote a domain controller.
Specifically,
it's going to be a domain controller running read‑only domain controller,
RODC.
I am, as you see here, I'm on one of my server systems.
I'm on cdc1.child.timw.info,
and I'm signed in as a domain administrator in that child domain.
The RODC is going to be called CRODC1.
I've already got it set up and joined to the domain,
it's ready to be promoted,
but the idea is that I want to create an offline
install for media set on this machine.
How do we do that?
I am on a read/write domain controller.
While I bring up ntdsutil,
which is a command line tool that gives us a deeper
access into Active Directory,
and I'm going to do activate instance ntds and I'm going to go into ifm
and then run help where you can see the syntax here.
The install for media subsection,
we're going to do a Create Sysvol RODC and we're going to put it
in folder at the root of drive C called IFM.
Now, you know something,
I don't think I have that folder created so let me
quickly race to the root of drive C.
No I, oh I do, there it is right there.
Okay.
So that looks pretty good, Create Sysvol RODC.
So this is going to put both the Active Directory database,
as well as the Sysvol folder in that CIFM directory,
and there it is, IFM media created successfully.
It's important to note that you can do IFM for read/write,
as well as RODC installations,
but I'm making specifically a read‑only IFM set because,
of course, I'm targeting it on a read‑only domain controller.
What you see on my screen in the background is Server Manager where I've
used the Add server function to bring in my CRODC1 machine, and then from
here on CDC1, I right‑clicked and I'm doing an add role operation to
install Active Directory on this machine.
It's going to be during the promotion process that the install for media
becomes really relevant. Specifically, now I've used File Explorer to
connect on the left to my local C drive and I'm going to now copy the
IFM folder over across the network.
I've made a UNC path connection to \\crodc1\C$ the
administrative share on the C drive.
Now you'd use robocopy or some more robust method if this were a
working active Active Directory system, but mine is brand new so
it's effectively empty, very small.
And if you go in there,
you can see I've got Active Directory, there is the ntds.dit file, about 25 MB,
and then we have our SYSVOL directory that's got our Group Policies and log on
scripts in there, which again, it's all empty.
Now here is the money for IFM.
Now remember, I'm connected to CRODC1. We'll promote
this server as a domain controller.
We're adding a domain controller to an existing domain and that domain is our
child domain, child.timw.info. We'll provide the administrative credentials,
and once I authenticate as a domain administrator,
we specify number one, this is going to be a read‑only domain controller.
We specify our directory restore mode password, Next. Now when
you've got a RODC, you've got to determine which accounts in the
domain will have their credentials cached into the RODC and
notice that administrators,
server operators, and backup operators never have their credentials
cached. And what you'll do is populate the built‑in allowed RODC
password replication group, that's your default group, to contain user
accounts who would be in that branch office and whose credentials
would be allowed to be cached.
You could also create a delegated administrator account as well.
Let me click Next.
This is the install from media piece.
We choose Install from media and type the path, hit
Verify. Once that's verified,
you choose are you going to complete the replication from any domain
controller in the domain, or specifically, cdc1.child.timw.info. Click
Next. Here, we're verifying our folders, Next.
All prerequisite checks passed successfully, Install. So as we've seen
so far, once the machine is upgraded, it will automatically restart,
in which case, crodc1.child.timw.info will be a read‑only domain
controller that was installed through install from media offline installation. Done and done.