Windows2016:DomainController

UNDER CONSTRUCTION: The document is currently being modified!

 Back to Category:Windows

Introduction

The Server Core option is a minimal installation option that is available when you are deploying the Standard or Datacenter edition of Windows Server. Server Core includes most but not all server roles. Server Core has a smaller disk footprint, and therefore a smaller attack surface due to a smaller code base. Most notably, no Windows Explorer shell is installed. All configuration and maintenance is done entirely through command-line interface windows, or by connecting to the machine remotely using Microsoft Management Console (MMC), remote server administration tools, and PowerShell.

Testing was done as a virtual machine on my Dell PowerEdge R610 using Hyper-V Server, the following image was used:

en_windows_server_2016_x64_dvd_9718492.iso

Installation

Insert the Windows Server 2016 boot media into the machine and reboot (or power on) the machine, booting from the inserted media. Follow the instructions on the screen to install, make sure you do not select (Desktop Experience) as this is not Server Core. Upon reboot you will be prompted to set an Administrator password, doing so will log into the machine finalizing the installation.

Use the command prompt provided to launch Windows PowerShell.

C:\> powershell

Networking

Before we can begin with the domain controller the network needs configuring.

Rename the computer.

PS C:\> Rename-Computer -NewName DC-1

List the current network adapters.

PS C:\> Get-NetAdapter -Physical

Locate the NIC that you want to setup.

Set the IP information.

PS C:\> New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 10.0.42.35 -AddressFamily IPv4 -PrefixLength 24 -DefaultGateway 10.0.42.1

Update the DNS servers.

PS C:\> Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddress 127.0.0.1

Make sure the DNS server address is set to localhost or the domain controller will not function correctly. It needs to use it's own DNS.

Remote Management

In order to use RSAT and Windows Admin Center remotely a few changes need to be made.

Enable WinRM.

PS C:\> Enable-PSRemoting -Force

Enable remote authentication acceptance.

PS C:\> Enable-WSManCredSSP -Role server

Enable firewall rules for remote management.

PS C:\> Set-NetFirewallRule -DisplayGroup 'Windows Management Instrumentation (WMI)' -Enabled true -PassThru

PS C:\> Set-NetFirewallRule -DisplayGroup 'Remote Event Log Management' -Enabled true -PassThru

Housekeeping

Remove Windows Defender.

PS C:\> Uninstall-WindowsFeature -Name Windows-Defender-Features

Check to see that the timezone is set properly.

PS C:\> Get-TimeZone

If you need to change it, use the following:

PS C:\> Set-TimeZone -Id "Pacific Standard Time"

Finally reboot the machine to commit the machine name and IP changes.

PS C:\> Restart-Computer

PowerShell

Since PowerShell will be used for a lot of the remote management it is a good idea to update to the latest version.

To install, copy to the server via windows SMB.

PS C:\> msiexec /i PowerShell-6.1.0-preview.3-win-x64.msi

Domain Controller

Install the Domain Controller feature for Windows.

PS C:\> Install-WindowsFeature AD-Domain-Services -IncludeManagementTools

When finished, create the first domain controller in a new forest/domain.

PS C:\> Install-ADDSForest -DomainName "wa.kyaulabs.com" -DomainNetbiosName "KYAULABS"

The DomainName here should be the FQDN, while the DomainNetbiosName is the NetBIOS name for the root domain. If you do not specify a NetBIOS name, it will use the subdomain of your domain. (eg. In this instance it would be WA)

Provide a SafeModeAdministratorPassword and then confirm you want the server to be configured and restarted.

Configuring and installing the domain controller will take a few moments.

Validate Domain Controller

Once the machine has restarted and you are logged in again, verify the new domain controller. Re-launch PowerShell.

Make sure the AD/DNS services are running.

PS C:\> Get-Service adws,kdc,netlogon,dns

Verify the SYSVOL and NETLOGON shares.

PS C:\> Get-SmbShare

Review the logs, making sure logging has started properly.

PS C:\> Get-EventLog "Directory Service" | select entrytype, source, eventid, message

PS C:\> Get-EventLog "Active Directory Web Services" | select entrytype, source, eventid, message

Domain Administrator

To manage the domain, create a domain admin account.

PS C:\> New-ADUser -Name "kyau" -GivenName "KYAU" -Surname "Labs" -SamAccountName kyau -UserPrincipalName kyau@kyaulabs.com

Pull up the accounts distinguished name.

PS C:\> Get-ADUser kyau

The account is currently set to disabled.

Set a password for the account using the distinguished name.

PS C:\> Set-ADAccountPassword 'CN=kyau,CN=Users,DC=wa,DC=kyaulabs,DC=com' -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "passwordhere" -Force)

Enable the AD object.

PS C:\> Enable-ADAccount -Identity kyau

Finally add the user to the Domain Admins group.

PS C:\> Add-ADGroupMember 'Domain Admins' kyau

Conclusion

You should now be able to log out of the domain controller and setup a Windows 10 workstation to login to the domain with your domain admin account.

• Remote Server Administration Tools for Windows 10
• Server 2016 and Windows 10 Security Baselines

SCM

Open group policy management console and create a blank GPO called 2016 DC Security.

Right-click on the Blank GPO and select import settings.

Press Next twice, then browse to the location where you unzipped the security baselines.

Select the SCM Windows Server 2016 - Domain Controller Baseline and click Next.

Click on Next after scanning backup finishes.

Then choose Copying them identically from the source. and click on Next.

At this point clicking on Finish will import the baseline