View source for Windows2016:DomainController

{{DISPLAYTITLE:{{TitleIcon|microsoft=true}} Windows Server 2016 Core: Domain Controller}}<metadesc>How to setup a domain controller on Windows Server 2016 Core as a virtual machine.</metadesc>
<div id="tocalign">__TOC__</div>
{{UnderConstruction}}
{{Back|Windows}}
= {{Icon24|sitemap}} Introduction =
The Server Core option is a minimal installation option that is available when you are deploying the Standard or Datacenter edition of Windows Server. Server Core includes most but not all server roles. Server Core has a smaller disk footprint, and therefore a smaller attack surface due to a smaller code base.<ref>{{cite web|url=https://docs.microsoft.com/en-us/windows-server/administration/server-core/what-is-server-core|title=What is Server Core?|publisher=Microsoft Docs}}</ref> Most notably, no Windows Explorer shell is installed. All configuration and maintenance is done entirely through command-line interface windows, or by connecting to the machine remotely using Microsoft Management Console (MMC), remote server administration tools, and PowerShell.<ref>{{cite web|url=https://en.wikipedia.org/wiki/Server_Core|title=Server Core|publisher=Wikipedia}}</ref>

Testing was done as a virtual machine on my Dell PowerEdge R610 using Hyper-V Server, the following image was used:
{{Note|icon=false|1={{Icon|disc-blue}} en_windows_server_2016_x64_dvd_9718492.iso}}

= {{Icon24|sitemap}} Installation =
Insert the Windows Server 2016 boot media into the machine and reboot (or power on) the machine, booting from the inserted media. Follow the instructions on the screen to install, make sure you do not select {{mono|(Desktop Experience)}} as this is not Server Core.
Upon reboot you will be prompted to set an {{mono|Administrator}} password, doing so will log into the machine finalizing the installation.

Use the command prompt provided to launch Windows PowerShell.
{{console|prompt=false|1=C:\> powershell}}

== {{Icon|notebook}} Networking ==
Before we can begin with the domain controller the network needs configuring.

Rename the computer.
{{console|prompt=false|powershell=true|1=PS C:\> {{yellowBold|Rename-Computer}} {{white|-NewName}} DC-1}}
List the current network adapters.
{{console|prompt=false|powershell=true|1=PS C:\> {{yellowBold|Get-NetAdapter}} {{white|-Physical}}}}
Locate the NIC that you want to setup.

Set the IP information.
{{console|prompt=false|powershell=true|1=PS C:\> {{yellowBold|New-NetIPAddress}} {{white|-InterfaceAlias}} {{cyanBold|"Ethernet"}} {{white|-IPAddress}} 10.0.42.35 {{white|-AddressFamily}} IPv4 {{white|-PrefixLength}} 24 {{white|-DefaultGateway}} 10.0.42.1}}
Update the DNS servers.
{{console|prompt=false|powershell=true|1=PS C:\> {{yellowBold|Set-DnsClientServerAddress}} {{white|-InterfaceAlias}} {{cyanBold|"Ethernet"}} {{white|-ServerAddress}} 127.0.0.1}}
{{Note|1=Make sure the DNS server address is set to localhost or the domain controller will not function correctly. It needs to use it's own DNS.}}

== {{Icon|notebook}} Remote Management ==
In order to use RSAT and Windows Admin Center remotely a few changes need to be made.

Enable WinRM.
{{console|prompt=false|powershell=true|1=PS C:\> {{yellowBold|Enable-PSRemoting}} {{white|-Force}}}}
Enable remote authentication acceptance.
{{console|prompt=false|powershell=true|1=PS C:\> {{yellowBold|Enable-WSManCredSSP}} {{white|-Role}} server}}
Enable firewall rules for remote management.
{{console|prompt=false|powershell=true|1=PS C:\> {{yellowBold|Set-NetFirewallRule}} {{white|-DisplayGroup}} {{cyanBold|'Windows Management Instrumentation (WMI)'}} {{white|-Enabled}} true {{white|-PassThru}}}}<br/>
{{console|prompt=false|powershell=true|1=PS C:\> {{yellowBold|Set-NetFirewallRule}} {{white|-DisplayGroup}} {{cyanBold|'Remote Event Log Management'}} {{white|-Enabled}} true {{white|-PassThru}}}}

== {{Icon|notebook}} Housekeeping ==
Remove Windows Defender.
{{console|prompt=false|powershell=true|1=PS C:\> {{yellowBold|Uninstall-WindowsFeature}} {{white|-Name}} Windows-Defender-Features}}
Check to see that the timezone is set properly.
{{console|prompt=false|powershell=true|1=PS C:\> {{yellowBold|Get-TimeZone}}}}
If you need to change it, use the following:
{{console|prompt=false|powershell=true|1=PS C:\> {{yellowBold|Set-TimeZone}} {{white|-Id}} {{cyanBold|"Pacific Standard Time"}}}}
Finally reboot the machine to commit the machine name and IP changes.
{{console|prompt=false|powershell=true|1=PS C:\> {{yellowBold|Restart-Computer}}}}

== {{Icon|notebook}} PowerShell ==
Since PowerShell will be used for a lot of the remote management it is a good idea to update to the latest [//github.com/PowerShell/PowerShell/releases version].

To install, copy to the server via windows SMB.
{{console|prompt=false|powershell=true|1=PS C:\> msiexec /i PowerShell-6.1.0-preview.3-win-x64.msi}}

= {{Icon24|sitemap}} Domain Controller =
Install the Domain Controller feature for Windows.
{{console|prompt=false|powershell=true|1=PS C:\> {{yellowBold|Install-WindowsFeature}} AD-Domain-Services {{white|-IncludeManagementTools}}}}
When finished, create the first domain controller in a new forest/domain.
{{console|prompt=false|powershell=true|1=PS C:\> {{yellowBold|Install-ADDSForest}} {{white|-DomainName}} {{cyanBold|"wa.kyaulabs.com"}} {{white|-DomainNetbiosName}} {{cyanBold|"KYAULABS"}}}}
{{Note|1=The {{mono|DomainName}} here should be the FQDN, while the {{mono|DomainNetbiosName}} is the NetBIOS name for the root domain.<br/>If you do not specify a NetBIOS name, it will use the subdomain of your domain. (eg. In this instance it would be {{mono|WA}})}}
Provide a SafeModeAdministratorPassword and then confirm you want the server to be configured and restarted.

Configuring and installing the domain controller will take a few moments.

== {{Icon|notebook}} Validate Domain Controller ==

Once the machine has restarted and you are logged in again, verify the new domain controller. Re-launch PowerShell.

Make sure the AD/DNS services are running.
{{console|prompt=false|powershell=true|1=PS C:\> {{yellowBold|Get-Service}} adws,kdc,netlogon,dns}}
Verify the {{mono|SYSVOL}} and {{mono|NETLOGON}} shares.
{{console|prompt=false|powershell=true|1=PS C:\> {{yellowBold|Get-SmbShare}}}}
Review the logs, making sure logging has started properly.
{{console|prompt=false|powershell=true|1=PS C:\> {{yellowBold|Get-EventLog}} {{cyanBold|"Directory Service"}} {{!}} {{yellowBold|select}} entrytype, source, eventid, message}}<br/>
{{console|prompt=false|powershell=true|1=PS C:\> {{yellowBold|Get-EventLog}} {{cyanBold|"Active Directory Web Services"}} {{!}} {{yellowBold|select}} entrytype, source, eventid, message}}

== {{Icon|notebook}} Domain Administrator ==
To manage the domain, create a domain admin account.
{{console|prompt=false|powershell=true|1=PS C:\> {{yellowBold|New-ADUser}} {{white|-Name}} {{cyanBold|"kyau"}} {{white|-GivenName}} {{cyanBold|"KYAU"}} {{white|-Surname}} {{cyanBold|"Labs"}} {{white|-SamAccountName}} kyau {{white|-UserPrincipalName}} kyau@kyaulabs.com}}
Pull up the accounts distinguished name.
{{console|prompt=false|powershell=true|1=PS C:\> {{yellowBold|Get-ADUser}} kyau}}
{{Note|1=The account is currently set to disabled.}}
Set a password for the account using the distinguished name.
{{console|prompt=false|powershell=true|1=PS C:\> {{yellowBold|Set-ADAccountPassword}} {{cyanBold|'CN{{=}}kyau,CN{{=}}Users,DC{{=}}wa,DC{{=}}kyaulabs,DC{{=}}com'}} {{white|-Reset}} {{white|-NewPassword}} ({{yellowBold|ConvertTo-SecureString}} {{white|-AsPlainText}} {{cyanBold|"passwordhere"}} {{white|-Force}})}}
Enable the AD object.
{{console|prompt=false|powershell=true|1=PS C:\> {{yellowBold|Enable-ADAccount}} {{white|-Identity}} kyau}}
Finally add the user to the {{mono|Domain Admins}} group.
{{console|prompt=false|powershell=true|1=PS C:\> {{yellowBold|Add-ADGroupMember}} {{cyanBold|'Domain Admins'}} kyau}}

= {{Icon24|sitemap}} Conclusion =
You should now be able to log out of the domain controller and setup a Windows 10 workstation to login to the domain with your domain admin account.
* [//www.microsoft.com/en-us/download/details.aspx?id=45520 Remote Server Administration Tools for Windows 10]
* [//blogs.technet.microsoft.com/secguide/2016/10/17/security-baseline-for-windows-10-v1607-anniversary-edition-and-windows-server-2016/ Server 2016 and Windows 10 Security Baselines]
== {{Icon|notebook}} SCM ==
Open group policy management console and create a blank GPO called {{mono|2016 DC Security}}.

Right-click on the Blank GPO and select import settings.

Press {{mono|Next}} twice, then browse to the location where you unzipped the security baselines.

Select the {{mono|SCM Windows Server 2016 - Domain Controller Baseline}} and click {{mono|Next}}.

Click on {{mono|Next}} after scanning backup finishes.

Then choose {{mono|Copying them identically from the source.}} and click on {{mono|Next}}.

At this point clicking on {{mono|Finish}} will import the baseline

= {{Icon24|book-brown}} References =
<references/>


[[Category:Windows]]