In this demonstration,
we're going to look at hardening a read‑only domain controller.
We'll also look at authentication policy silos.
Now you're looking at the desktop of a member server.
Let's take a look.
Let's go into Server Manager and Local Server.
It looks like, I know the text may be small depending upon
your screen size, I apologize about that.
The computer name is rodc1, and I am joined to the timw.info
Active Directory Domain Services domain.
Now you might be accustomed to Add Roles and Features.
We're also going to be working with Windows Admin Center a fair amount.
Knowing all of the various first‑party admin tools is really crucial to
your success as a hybrid cloud administrator.
I'm talking both the inbox Windows Server Management tools, and
also the main Microsoft‑provided Azure one.
Speaking of which, we have the Visual Studio Code Editor,
which I just strongly recommend that you standardize on.
So what we've got here, let me zoom in the font quite a bit,
I've got a script file called additional‑dc‑rodc‑timw.info,
and it's walking you through,
first of all, installing AD on a server. I'm going to actually run that
right now by right‑clicking and running that selection. And then the rest
of the script walks us through. First of all,
we're setting up some variables.
Now,
are you going to want to put a plaintext password in
source code control? Absolutely not.
There's plenty of other ways to go about it,
but this is a way for you to create a credential object by providing
a password initially in plaintext and converting it to a secure
string, as you can see on line 4. And then once you have Active
Directory installed on the server,
you then have the rest of the AD PowerShell commands at your disposal.
So, Install‑ADDSDomainController allows us to bring this machine up,
to promote this machine into the target domain.
I would want it to be a DNS server, but then this is critical right here,
ReadOnlyReplica:$true.
That's going to make sure that the Active Directory
database and the DNS zone are both read‑only.
Then we have our Active Directory initial site designation. Then I
have some sample code here for you to populate the
Denied‑RODC‑Password‑Replication‑Group. This first one here on line
15 is just a Get where you're looking to enumerate the current
membership using the PowerShell pipeline.
Then on 19, it looks like we're doing the same thing, basically.
We're looking at the membership of Allowed‑RODC‑Password‑Replication‑Group.
And then lastly, some prepopulate passwords if you want to bring
over passwords for certain users to the RODC.
That's going to be important if your RODC is in a disconnected environment.
So do you have to use PowerShell to configure and
harden an RODC? Absolutely not.
But I want to make sure to include PowerShell in the course.
I do give you the script file in the exercise files, by the way, because
as I'm sure I've told you many, many times, you will see
intermediate‑level PowerShell on your exam, and the way it will manifest
is something like you'll see a script like this and interspersed you'll
have these drop‑down list controls, these active elements.
This is why Microsoft calls this an active screen exam item.
And so, for instance, here this read‑only replica would be a
drop‑down, and it would have that clause as one option, but then
there would be several incorrect options.
So, you do have to understand PowerShell, which is why I'm
being sure to include it in the course.
Well, other than the fact I believe in it.
Let's do the promotion, though, graphically here.
So let me come back to Server Manager,
refresh the view, and you can see we now have AD DS as a management
node. And if we open our notification window,
we've got our traditional prompt to promote this
server to be a domain controller.
So, I'm actually showing you some ways out of the box
to harden an RODC as you deploy it, which in my opinion is the best way to do it.
So let me see, we're going to add a domain controller to an existing domain.
Here's the domain, and I will use my current credentials.
So that's fine.
Let's go to Next.
We want to make sure here to specify RODC.
That's absolutely critical, as well as a unique
Directory Services Restore Mode password.
Remember, I've mentioned all that already.
Let's click Next.
This is where we have the administrator role separation.
So let me select to browse our domain. And let me see, if memory
serves, I believe I have an administrator named Carl.
So let me bring Carl in, and carl,
let's assume, is going to work as a local administrator at that branch office.
And then we have our Allowed RODC Password Replication group.
Anybody in here,
let's say members of our accounting staff work out there, accounts that are
allowed to replicate password besides the default one, I'm bringing in
accounting separately, but we just as well could put those users in the
Password Replication Group itself for convenience.
And then notice that for Security, accounts that are in the Denied
Password Replication group include administrators,
server operators, and you may very well want to add your
other high value groups to this list.
Now, of course, you can change these RODC options after the fact.
It's just that best practices,
we're specifying this at deployment time so that the
RODC, when it's being deployed out,
comes on in a relatively secure way. Install from media, or IFM, is useful
if your RODC is going to be installed in a branch office,
particularly one with limited or no bandwidth to your read/write controllers.
So you can do an export of the Active Directory database on a
read/write DC, put it on removable media,
let's say, go out to the branch office, and then install from that path.
This is going to make that initial replication much easier because you won't
have to have a connection to a read/write domain controller,
it's just going to be any delta or update changes that the RODC
will need to receive from either any DC, or you could specify to
replicate from a particular DC.
Just giving you control over bandwidth and scope.
There's our directory service path and SYSVOL path.
No big surprise there. We've got an automation script, which is basically the
same thing that I showed you separately. Next, and then,
as you know, once the prerequisites pass,
which it looks like they have, we can install, and after reboot, the server will come back as a read‑only domain controller.