Windows Server 2016 Core: Domain Controller
|UNDER CONSTRUCTION: The code monkeys are on the loose! Check back for updates!|
The Server Core option is a minimal installation option that is available when you are deploying the Standard or Datacenter edition of Windows Server. Server Core includes most but not all server roles. Server Core has a smaller disk footprint, and therefore a smaller attack surface due to a smaller code base. Most notably, no Windows Explorer shell is installed. All configuration and maintenance is done entirely through command-line interface windows, or by connecting to the machine remotely using Microsoft Management Console (MMC), remote server administration tools, and PowerShell.
Testing was done as a virtual machine on my Dell PowerEdge R610 using Hyper-V Server, the following image was used:
Insert the Windows Server 2016 boot media into the machine and reboot (or power on) the machine, booting from the inserted media. Follow the instructions on the screen to install, make sure you do not select (Desktop Experience) as this is not Server Core. Upon reboot you will be prompted to set an Administrator password, doing so will log into the machine finalizing the installation.
Use the command prompt provided to launch Windows PowerShell.
Before we can begin with the domain controller the network needs configuring.
Rename the computer.
|PS C:\> Rename-Computer -NewName DC-1|
List the current network adapters.
|PS C:\> Get-NetAdapter -Physical|
Locate the NIC that you want to setup.
Set the IP information.
|PS C:\> New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 10.0.42.35 -AddressFamily IPv4 -PrefixLength 24 -DefaultGateway 10.0.42.1|
Update the DNS servers.
|PS C:\> Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddress 127.0.0.1|
|Make sure the DNS server address is set to localhost or the domain controller will not function correctly. It needs to use it's own DNS.|
In order to use RSAT and Windows Admin Center remotely a few changes need to be made.
|PS C:\> Enable-PSRemoting -Force|
Enable remote authentication acceptance.
|PS C:\> Enable-WSManCredSSP -Role server|
Enable firewall rules for remote management.
|PS C:\> Set-NetFirewallRule -DisplayGroup 'Windows Management Instrumentation (WMI)' -Enabled true -PassThru|
|PS C:\> Set-NetFirewallRule -DisplayGroup 'Remote Event Log Management' -Enabled true -PassThru|
Remove Windows Defender.
|PS C:\> Uninstall-WindowsFeature -Name Windows-Defender-Features|
Check to see that the timezone is set properly.
|PS C:\> Get-TimeZone|
If you need to change it, use the following:
|PS C:\> Set-TimeZone -Id "Pacific Standard Time"|
Finally reboot the machine to commit the machine name and IP changes.
|PS C:\> Restart-Computer|
Since PowerShell will be used for a lot of the remote management it is a good idea to update to the latest version.
To install, copy to the server via windows SMB.
|PS C:\> msiexec /i PowerShell-6.1.0-preview.3-win-x64.msi|
Install the Domain Controller feature for Windows.
|PS C:\> Install-WindowsFeature AD-Domain-Services -IncludeManagementTools|
When finished, create the first domain controller in a new forest/domain.
|PS C:\> Install-ADDSForest -DomainName "wa.kyaulabs.com" -DomainNetbiosName "KYAULABS"|
|The DomainName here should be the FQDN, while the DomainNetbiosName is the NetBIOS name for the root domain.|
If you do not specify a NetBIOS name, it will use the subdomain of your domain. (eg. In this instance it would be WA)
Provide a SafeModeAdministratorPassword and then confirm you want the server to be configured and restarted.
Configuring and installing the domain controller will take a few moments.
Validate Domain Controller
Once the machine has restarted and you are logged in again, verify the new domain controller. Re-launch PowerShell.
Make sure the AD/DNS services are running.
|PS C:\> Get-Service adws,kdc,netlogon,dns|
Verify the SYSVOL and NETLOGON shares.
|PS C:\> Get-SmbShare|
Review the logs, making sure logging has started properly.
|PS C:\> Get-EventLog "Directory Service" | select entrytype, source, eventid, message|
|PS C:\> Get-EventLog "Active Directory Web Services" | select entrytype, source, eventid, message|
To manage the domain, create a domain admin account.
|PS C:\> New-ADUser -Name "kyau" -GivenName "KYAU" -Surname "Labs" -SamAccountName kyau -UserPrincipalName [email protected]|
Pull up the accounts distinguished name.
|PS C:\> Get-ADUser kyau|
|The account is currently set to disabled.|
Set a password for the account using the distinguished name.
|PS C:\> Set-ADAccountPassword 'CN=kyau,CN=Users,DC=wa,DC=kyaulabs,DC=com' -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "passwordhere" -Force)|
Enable the AD object.
|PS C:\> Enable-ADAccount -Identity kyau|
Finally add the user to the Domain Admins group.
|PS C:\> Add-ADGroupMember 'Domain Admins' kyau|
You should now be able to log out of the domain controller and setup a Windows 10 workstation to login to the domain with your domain admin account.
Open group policy management console and create a blank GPO called 2016 DC Security.
Right-click on the Blank GPO and select import settings.
Press Next twice, then browse to the location where you unzipped the security baselines.
Select the SCM Windows Server 2016 - Domain Controller Baseline and click Next.
Click on Next after scanning backup finishes.
Then choose Copying them identically from the source. and click on Next.
At this point clicking on Finish will import the baseline