In this demonstration,
we're going to finish our configuration of Azure AD Domain Services. You'll
remember in the previous module I did a demo in which we deployed an Azure AD
Domain Services instance called aaddstimw.info.
And what we can do here is, what we'll have to do actually,
is finish setting up the environment here.
If we click View Health, everything's running and okay,
but you might have noticed, let me go back to Overview, that we've
got some configuration issues. I know exactly what those issues
are, and you'll learn in just a second.
So let's click this banner and run some diagnostics, and we can see the
problem is the DNS records. We need to update the virtual network on which
this Azure AD Domain Service instance is placed, so that its DNS server
settings point to the two virtual machines that are managed by this
service, our domain controllers.
Let's click Fix, and see what happens here.
Are these just instructions? I'd be interested to see if Azure is
actually making changes to that virtual network.
Let's just jump over there and take a look. Well,
if we head on over to that virtual network and take a
look at our DNS servers property,
we can see that that Fix button actually did make the change.
This is important, because what this configuration does, it
injects those DNS server addresses into any virtual machines
we deploy in this environment.
This means now we can go to a Windows Server virtual machine that's on or peered
to that managed domain's virtual network and we can join it to the managed
domain and begin to work is if we were locally, but of course we're all in
Azure. So we can do an RDP connection, which I've actually done from this
server, so let me bring that up. And we can,
once we're on that server, join the managed domain,
which is what I'm going to do next with good, old‑fashioned Control
Panel here. I'm going to search for join domain,
join a domain here, we'll go to Change, and the domain,
the managed domain I have is aaddstimw.info.
Okay, we type the name of the managed domain, click OK, we'll
be prompted for a domain administrator.
Now this is going to be a managed domain administrator.
If I come over to the portal here and go and look at our Groups in Azure
Active Directory, remember that we have the AAD DC Azure AD group that the
managed domain created for us here in our tenant.
And the way you delegate your domain administrators for your
managed domains is to populate them in this group.
So I have myself, my Tim account, as well as this Melissa account here.
Now, another thing to keep in mind is that if you try to join the domain,
let me try it right now as a matter of fact,
melissa@timw.info, let me pop in her password,
her Azure AD password. Right, yes, you see this error? It says The
referenced account is currently locked out and may not be logged on to.
This is to be expected, because remember that the final config step here
is to ensure that you've got your NTLM legacy password hashes
synchronized over to the managed domain.
And for cloud accounts, the way to do that is to change the account
password, and I've done that. I've signed in as Melissa, and I changed
her cloud password, and we're good to go. Now, for synchronized
accounts, you'll want to run a PowerShell script on your Azure AD
Connect server. I give you a link to the appropriate Microsoft doc in
the exercise files.
But the problem with that is for this Melissa cloud account,
I changed her password and now I have to wait 20 minutes for that replication,
for that password hash generation that's compatible with the managed domain, to
then replicate over to the managed domain, at which time I'll be able to join
the domain and then sign in as Melissa, let's say.
Also, I can manage the managed domain using my typical
administration tools. So I can use Server Manager, and I can
do an Add Roles and Features exercise,
which you've probably done many times, to install the
remote server administration tools.
I've already done that.
And, again, this is one of the value propositions of Azure AD Domain Services.
You get this hosted domain where you can use LDAP and Kerberos NTLM, hence
the need for the legacy hashes and group policy‑based configuration
management. And eventually, after that 20‑minute wait,
we get welcome to the aaddstimw.info domain, and let me restart
the server and sign in with the Melissa account.
We'll do that now.
Alright, I've restarted and signed in as Melissa. You can see in my
PowerShell session I've run whoami. So I'm signed into the managed
domain as the melissa identity, and she is an Azure Active Directory
account who also is one of the AAD DC administrators. The name of this
box is aadvm, and as you can see,
I've loaded the administration tools on the server,
so I'm connected to the aaddstim managed domain, and you can see a bunch of
OUs that you don't normally see in a local Active Directory.
We have AADDC Computers, and here is this box; we have AADDC Users, boy,
what a tongue twister that is, and here is where we have our Azure Active
Directory users including, remember, some of those directory synchronized
identities like Brett Gordon, remember that account? So the notion now is
traditionally we would let those accounts happen in our Azure Active Directory
tenant. We're going to do more work with Azure AD Domain Services in the next lesson when we get into Group Policy.