Networks: Access Management Windows 2000 Server Class Notes # 22 Building an Active Directory February 26, 2004

Transcription

1 Networks: Access Management Windows 2000 Server Class Notes # 22 Building an Active Directory February 26, 2004 Windows 2000 separates the process of installing Windows 2000 server from the process of creating a domain controller. Windows 2000 domain controller requires the following before installation: At least 136Mbytes of RAM memory. DNS Active directory stores its list of domain controllers and global catalog servers in DNS To set-up a domain called mydns.biz will require the new domain controller to do the following: 1. Ask its preferred DNS server to get the SOA record for mydns.biz 2. The domain controller will send dynamic updates to the DNS server pointed to by the SOA record. Type NSLOOKUP at the command line to verify which DNS server your computer will try to send updates to. For example, you might get the following: E:\nslookup Default Server: ultimatedomain.mydns.biz Address: > set type = soa > mydns.biz Server: ultimatedomain.mydns.biz Address: mydns.biz primary name server = ultimatedomain.mydns.biz responsible mail addr = admin.mydns.biz serial = 48 refresh = 900 (15 min) retry = 600 (10 min) expire = (1 day) default TTL = 3600 (1 hour) ultimatedomain.mydns.biz internet address = >exit NSLOOKUP informs you which server it gets answers from. When you type set type = soa you will retrieve the SOA record. Typing mydns.biz and NSLOOKUP retrieves and displays the info in the SOA record, which includes the primary name server ( ). Therefore, you are now in business. 1

2 To install a domain controller on Windows 2000 server you start by clicking start, run and then typing dcpromo in the run dialog box. That starts the active directory installation wizard as shown in figure one. Figure 1: Active Directory installation wizard You can use this wizard to convert servers into a domain controller and to also demote a domain controller to a server. The next question that DCPROMO asks is whether you want to create a whole new domain or put another DC in an existing domain. This is shown in figure two. In our case we will set-up a new DC, therefore select the first option and click next. This will lead to the screen shown in figure three. Since this will be the first domain in a new tree, select the first option and click next. The next question, shown in figure four, is whether we want to choose a new forest or an existing forest. That is, AD installation wizard must know where to put this new tree (i.e. a new tree in a new forest or a new tree in a existing forest). Again, this is a new forest, therefore select the first option and click next. The next question is to enter the new domain name as shown in figure five. In our case, we will enter mydns.biz. Note: you do not have to have a DC on the same machine as the DNS server. In our example we are setting up a DC on the same machine as the DNS server. 2

3 Figure 2: Domain Controller type option Figure 3: Create tree or child domain option 3

4 Figure 4: Create or Join Forest option Figure 5: New Domain Name option 4

5 Recall, if you are using older operating systems (i.e. Windows 9x, Windows NT workstation, DOS, etc.) then these systems will not recognize a domain named mydns.biz because they cannot have a hierarchy of any kind. Therefore, you will need to create a Windows 2000 domain with two names like their DNS name (i.e. mydns.biz). We will use the MYDNS as the other name without any periods as shown in figure six. Networks named under NT 3.X and 4.X were chosen to accommodate an old network programming interface called NetBIOS an old style domain name. Figure 6: NetBios Domain Name option Windows 2000 stores the AD database into two parts the database and a transaction log. It s a good idea to put the transaction log in another partition. This will allow the system to update the AD database and the log simultaneously if you have SCSI drives. The database and log location options are shown in figure seven. Click next when done will produce the next question as shown in figure eight. A lot of important user configuration and control information is stored in a directory named SYSVOL directory on the PDC system policy files, default profiles, and login scripts. This SYSVOL directory is automatically replicated to other domain controllers (i.e. BDC). Click next when you are done. 5

6 Figure 7: System Files placement option Figure 8: SYSVOL volume option 6

7 If you do not have the DNS server installed properly you will get the following, as shown in figure nine. Figure 9: DNS server warning The warning message can mean two things: 1. DCPROMO didn t get a response from any DNS server for mydns.biz. 2. DCPROMO got a response from the DNS server for mydns.biz but found that they didn t accept dynamic updates. Therefore, ensure that the DNS zones accept dynamic updates during the installation of the DNS server. You should cancel DCPROMO and fix DNS before going further. Otherwise, if you click OK, then the screen shown in figure ten appears. Figure 10: Permission to set up a DNS server If you click next to configure DNS, another warning screen will appear as shown in figure 11. 7

8 Figure 11:Permission option It is recommended to take the second option, since the first option will require Windows 2000 to loosen up its security structure. You will need the first option to allow NT 4 RAS servers to authenticate dial-in users. Select the second option and click next. The next screen to appear is shown in figure 12. Windows 2000 boot time option is to rebuild a damaged AD database to restore earlier versions that is internally consistent but has lost information. You don t want just anyone doing that. Fill in this information and click next. The next screen to appear is shown in figure 13. Before clicking next make sure you read the screen. After you click next, the AD set-up process starts. 8

9 Figure 12:Directory service repair password Figure 13: Confirning choices 9