Domain Restructuring Windows Server 2008

Transcription

1 Domain Restructuring Windows Server 2008 Introduction: This document will describe design decision to add Additional Domain Controller in the existing Active Directory Forest. The infrastructure is assumed to have the fully operational infrastructure which is hosted on Microsoft Hybrid cloud infrastructure. Requirement: Flex-Corp is a mining giant and hosts their infrastructure in Western Australia. There are 3 major sites connected with high speed LAN. The infrastructure is hosted on Microsoft Hybrid Cloud infrastructure. Flex-Corp is currently expanding their infrastructure and would like to add additional Domain Controller to their existing Active Directory Forest. This ADC will be single source for LDAP queries originating from the applications. Flex-Corp is engaging AVA, a Microsoft Premier Consulting firm to perform the domain restructuring. AVA will conduct initial assessment of the infrastructure and provide the detail design plan. Solution Diagram:

2 ISP ISP ISP ISP GW 3845 GW 3845 GW 3845 GW 3845 L L L L Main Link DC ADC Server Farm BackUp Link DC ADC Server Farm Sydney Melbourne AVA will provide the professional services to install and configure the Additional Domain Controller in the Sydney and Melbourne sites respectively. Solution Overview: AVA approach to the solution involves Enterprise methodology for installing and configuring additional Domain Controller in the existing Active directory forest. AVA uses Microsoft premier standards and proven methods to perform the task. AVA uses Flex-Corp Service desk utilities to leverage on the change requests and the follows the procedure defined by Flex-Corp. Pre-requisites: AVA assumes that following are provisioned respectively a) Rack and stack the physical server in the datacenter is done by Flexi-Corp Professionals b) Installation and Configuration of the Windows Server 2008 R2 Operating System is performed by AVA consultants

3 c) Network devices and ports are configured by Flexi-Corp engineers and ensure the firewall ports are opened for Domain Controller communications across the sites. d) Remote Monitoring for the servers are provisioned and desired firewall ports are enabled for AVA consultants to access the servers on different farms e) Ensure the patching of the servers are compliant with the Flexi-Corp standards f) Ensure the auditing of the servers is performed prior installing of the Domain Controller. g) Ensure all the relevant applications (eg: Anti-virus ) are installed and configured on the server which is going to get promoted as ADC Assumptions: - This document will not provide detail step-step visual information about the installation of the ADC - This document will provide best practices to install the ADC Installation Steps Following are the installation steps for staging Additional Domain Controller on the Flexi-Corp Data Center 1) Check the Domain Controller Server Virtual Machine RAM which should be 4GB or more, VLAN trunk validation, volumes configured and Service Pack levels for the Operating system. 2) Check the basic networking connectivity on the Server and ensure the server is opened for the following Ports Protocol and Port UDP 389 TCP 636 TCP 3268 TCP 3269 AD and AD DS Usage Type of traffic LDAP LDAP SSL LDAP GC LDAP GC SSL

4 UDP 88 UDP 53 UDP 445 Forest Level Name Resolution, Replication, User and Computer Authentication, Group Policy, Kerberos DNS TCP 25 Replication SMTP TCP 135 Replication RPC, EPM TCP Dynamic Replication, User and Computer Authentication, Group Policy, SMB,CIFS,SMB2, DFSN, LSARPC, NbtSS, NetLogonR, SamR, SrvSvc RPC, DCOM, EPM, DRSUAPI, NetLogonR, SamR, FRS TCP 5722 File Replication RPC, DFSR (SYSVOL) UDP 123 Windows Time, Windows Time UDP 464 UDP Dynamic UDP 138 Replication, User and Computer Authentication, Group Policy DFS, Group Policy TCP 9389 AD DS Web Services SOAP DHCP Kerberos change/set password DCOM, RPC, EPM DFSN, NetLogon, NetBIOS Datagram Service UDP 67 and UDP 2535 UDP 137 TCP 139 Note DHCP is not a core AD DS service but it is often present in many AD DS deployments. Replication DHCP, MADCAP NetLogon, NetBIOS Name Resolution DFSN, NetBIOS Session Service, NetLogon 3) Ensure the ADC is configured with Static IP address. Validate the subnet mask and Default gateway configured on the server Strictly no multi home networks 4) Ensure the account provisioned to promote the server has required permissions to install the Domain Controller The user should be part of Domain Admin groups 5) Get the Active Directory name space and determine the Child domain contiguous name configuration 6) Verify that the disk partition is formatted with NTFS

5 7) The Server which you are promoting should point to Forest Root Domain Controller which is the Primary DC for DNS server 8) Verify the DNS records using NSLookup before promoting the server 9) Use PortQry to get the Port status ( Opened / blocked ) and raise the request to open the ports if blocked. 10) Launch dcpromo from the command prompt ( DCPROMO/adv will be used when creating Domain controller using backup ). 11) Configure the DNS settings and complete the installation. Ensure Dynamic updates are enabled on the DNS zone. 12) If the ADC is installed in different subnet as compared to FRD or parent domain controller, the logical route should be enabled in Active Directory using Active directory sites and services by Creating Subnet, site object and map the Server object accordingly 13) Post server configuration, necessary application queries can be directed to the new Active Directory Domain Controller. 14) Server hardening should be performed by ensuring the necessary groups to be created and privileges are configured to allow certain groups to have access privileges on the ADC. Do Not : a) Install SQL server on Domain Controller b) Install Sharepoint server on Domain Controller c) Install PKI root CA on the Domain Controller d) Install Hyper-v on the domain controller e) Install Exchange server on domain controller. This document will not address the PKI implementation requirements, which will be covered in next design article.

6