Due to Microsofts ecosystem extending into many popular web applications, AD allowes users to integrate with a variety of services integral to an employees workflow. While Active Directory is still the most widely used Identity Access Management (IAM) tool, it is confined to run on-premises, meaning that cloud native solutions like Azure Active Directory (AAD) will slowly become the new standard (likely making this article irrelevant in a few years).
Domain Services Overview
ADDS Operations
Windows domains are just containers/folders that store and organize data objects. Just like the file browser on your OS you can apply policy, permissions, automation, and other operations to the data inside a ‘folder’. Types of data you might find in AD are: user profiles & configurations, inter-domain relationships, computer/server policies & configurations, authentication, file sync and backups, centralized deployment, and maintenance/administration. Ideally you have a DC local to any site that users are authenticating to, not only for faster logins but also to prevent every user from creating sessions to a single DC. When you have multiple DCs in the same domain, they will all establish a replication topology that allows a record change (ex. updating a password or email) on one DC to be replicated to all other DCs.
Lesson: never power off a DC or member workstation for an extended period of time or it will become permanently out of sync.
ADDS Functions
Supporting Users
- Onboarding
- Offboarding
- Password Resets
Provisioning Users
- Email Addresses
- Phone/Extensions
- Org/Dept Info
Securing Users
- Access Control
- Password Policies
- Security Groups
Manage Devices
- Configuration
- Inventory
- Compliance
Inter/Intra Domain
- Replication Flow
- Domain Trusts
- Site Assignment
Service/Utility
- Internal DNS
- RSAT Features
- Data Shares
ADDS Summary
Active Directory is an ecosystem of technology that provides centralized management of users, devices, policies, and other objects. Domain Controllers handle the deployment and versioning of any changes to the domain.
Domain Services Installation
Installation Pre-Reqs
- “Primary” LAN IP at least is set as a static address on the NIC
- The server shouldn’t be ANYTHING other than a domain controller (DNS is OK)
- Local admin access on the server to access the Server Manager and configure the domain
- The ‘Active Directory Domain Services’ role should be enabled
Refer to the Windows Server management guide if you have any questions on this.
Additional Pre-Reqs for existing Domain
- Upstream DNS should be pointed at an existing DC
- Server should be a member of the domain
- Domain admin access to promote a server to a DC
- Hostname should be unique across the domain (ideally never been used historically either)
Promoting a Domain Controller
![adds-promo](https://pinguengineering.com/wp-content/uploads/2024/06/adds-promo.png)
Domain Services Tools
Examples of ommited content:
ADUC Overview
ADUC Lab
Create an OU, Group, & User for IT Dept.
![adds-ou](https://pinguengineering.com/wp-content/uploads/2024/06/adds-ou.png)
GPO Overview
GPO Lab
Create a password policy and apply to the IT-Dept.
![adds-gpo](https://pinguengineering.com/wp-content/uploads/2024/06/adds-gpo.png)
ADDS Overview
ADDS Lab
Create a branch site and change replication time
![adds-site](https://pinguengineering.com/wp-content/uploads/2024/06/adds-site.png)
Active Directory Domain Services
Tools Summary
Users & Computers
Manage the configuration of users, including: password, group membership, org info (title, manager, dept.), email/phone.
Manage the configuration of machines, including: machine passwords, group membership, org info (location, assignment, DNS).
Group Policy
List of configurations that are enforced via AD. Targeted to different types of AD objects like users or machines and can be filtered to be even more granular. Can be used to apply a wide range of configurations to windows machines to automate and remediate any operational needs.
Sites & Services
Manage different groups of domain controllers, typically in different physical locations and or separate domains/subdomains. Replication time between domain controllers and auto membership to a site based on network address can also be configured here.
Domain Services Appendix
Demoting a DC you can still access
If you have access to the DC
![adds-demote](https://pinguengineering.com/wp-content/uploads/2024/06/adds-demote.png)
Cleanup metadata with ADSS
Confirm metadata cleanup with NTDSUTIL
NTDSUTIL should not have picked anything up, if you did have to remove metadata then something broke. Worth further investigation with Event Viewer, ADSI edit, and NTDSUTIL.