In the first part of this series, I discussed the benefits of the available Server Roles in Server Core installations of Windows Server 2012. Today, let’s get hands-on by configuring a Windows Server 2012 Server Core installation as a Domain Controller.

Active Directory and Server Core

Since the first release of Server Core in Windows Server 2008, the Active Directory Domain Services Server Role has been available to configure Server Core installations as Domain Controllers.

However, with Windows Server 2008 R2, Microsoft introduced the Active Directory Web Service on the Domain Controller to serve as an endpoint for the Active Directory Administrative Center and the Active Directory PowerShell cmdlets. Microsoft introduced the Active Directory Web Services gateway for Windows Server 2003 and Windows Server 2008 to allow the Active Directory Administrative Center and the Active Directory PowerShell cmdlets to communicate with these hosts. This download, however, is not available for Server Core installations of Windows Server 2008. This explains the few remaining Windows Server 2008 Server Core­-based Domain Controllers; most previously deployed Server Core-based Domain Controllers have been upgraded to Windows Server 2008 R2.

In Windows Server 2012, Microsoft introduced significant new functionality in Active Directory Domain Services, including virtualization-safe Active Directory, Domain Controller Cloning, Dynamic Access Control (DAC), and Active Directory-Based Activation. All of this functionality is also available in Server Core installations of Windows Server 2012.

First steps

When you want a Windows Server to operate as an Active Directory Domain Controller, you need to perform a few steps:

  1. Provide the host with a meaningful NetBIOS name.
  2. Configure appropriate networking settings, including fixed IP addresses, name resolving settings, and suffix settings. (As a best practice, try to avoid creating a disjoint namespace.)
  3. Update the server with all appropriate Service Packs and Windows Updates.
  4. Activate the Windows Server installation.
  5. Implement Information Security measures (like anti-malware, UPS).

Configuring Server Core as a Domain Controller

  • Configuring a Windows Server 2012-based Server Core installation as a Domain Controller starts with one of the following:
  • Promoting a standalone server to a Domain Controller for a new domain
  • Promoting a member server to a replica or read-only replica Domain Controller (also known as an additional Domain Controller)
  • Cloning a Windows Server 2012-based Server Core Domain Controller to a new replica Domain Controller

Note: Because there are three ways to promote a server to a Domain Controller (described above) and three different toolsets, I’ll show you each of the ways with a different toolset.

Creating the first Domain Controller in a forest

With the essentials covered in the “first step” section (above), creating your first Domain Controller is as easy as running a single command:

dcpromo.exe /unattend /NewDomain:forest /ReplicaOrNewDomain:Domain /NewDomainDNSName:domain.tld /DomainLevel:4 /ForestLevel:4 /SafeModeAdminPassword:"P@ssw0rd"

Note: That’s right! There’s no need to install the Active Directory Domain Controller role, or anything like that, as you’d need to do on a Server with a GUI Domain Controller.

After promoting the server to a fresh Domain Controller for a fresh new Domain in a fresh Forest, the server will automatically restart:

dcpromo - unattended command promotion

dcpromo unattended command promotion

Of course, dcpromo.exe has way more tricks up its sleeve beyond the many defaults automatically selected in the example above. All its command line switches are explained on TechNet.

Creating a replica Domain Controller

An Active Directory best practice is to have at least two Domain Controllers hosting each of your Active Directory Domains. A Server Core installation lends itself to this task. The easiest way to achieve this is to use an unattended installation file on a domain-joined installation. The first thing you do is open Notepad.exe and type (or paste in) the following text:

[DCInstall]
createOrjoin= join
replicaDomainDNSName = domain.tld
ReplicaOrNewDomain = Replica
UserDomain = DOMAIN
Username = administrator
Password = "P@ssw0rd1"
InstallDNS = Yes
ConfirmGc = Yes
CreateDNSDelegation = No
SafeModeAdminPassword = "P@ssw0rd"

dcpromo - unattend answer file

dcpromo - unattend answer file

Save the file to a suitable location and then run the following command:

dcpromo.exe /unattend:C:\dcpromo.txt

Again, this is a sample unattended answer file. For more options, take a look at Microsoft Knowledgebase article 947034.

Cloning a Domain Controller

Windows Server 2012 introduces Domain Controller Cloning for virtualized Domain Controllers. This dramatically reduces the time to get the second Domain Controller from the best practice and might also assist you in your backup and recovery strategies.

You need to cover a couple of prerequisites before you can start thinking about cloning, but when you have, cloning a Server Core Domain Controller can be performed in these six steps:

  1. Grant the source Domain Controller the ability to clone by adding the computer account of the virtualized source Domain Controller to the Cloneable Domain Controllers group with the following PowerShell command:
    Add-ADGroupMember "Cloneable Domain Controllers" "cn=dc01,ou=Domain Controllers,dc=domain,dc=tld"
  2. Check for DC Cloning blockers with Get-ADDCCloningExcludedApplicationList and examine the outcome. Resolve any issues that might arise by uninstalling the application, disabling the Windows Feature, or simply ignoring the blocker with the following PowerShell command:
    Get-ADDCCloningExcludedApplicationList -GenerateXml -Path C:\Windows\NTDS -Force
  3. Write the DCCloneConfig file using the following PowerShell command:
    New-ADDCCloneConfigFile -CloneComputerName "dc02" -Static -IPv4Address "192.168.0.2" -IPv4SubnetMask "255.255.255.0" -IPv4DefaultGateway "192.168.0.254" -IPv4DNSResolver "192.168.0.1"
    Note: Alternatively, you can use the New-ADDCCloneConfigFile command without parameters to create auto-named DHCP-enabled Domain Controllers.
  4. Shut down the source Domain Controller.
  5. Base a new virtual Domain Controller on the virtual hard disk of the source Domain Controller.
  6. Start the source Domain Controller and start the cloned Domain Controller.

More information can be found in the Introduction to Active Directory Domain Services (AD DS) Virtualization.

Managing Active Directory on Server Core

Once your Server Core installations are fully functioning Domain Controllers, there are multiple ways to manage the contents of Active Directory and the Domain Controllers themselves.

Managing Server Core Domain Controllers

Just like on Server with a GUI installations, you can use tools such as ntdsutil.exe, dcdiag.exe, dslint.exe, ldp.exe, setspn.exe, nltest.exe, csvde.exe, ldifde.exe and repadmin.exe on Server Core Domain Controllers.

Also, in Windows Server 2012, a collection of new Active Directory PowerShell cmdlets is available to you to create read-only Domain Controllers (Add-ADDSReadOnlyDomainControllerAccount), demote Domain Controllers (Uninstall-ADDSDomainController), and troubleshoot Active Directory replication (with the 23 Get-ADRerplication*¸New-ADReplication, Remove-ADReplication*, and Set-ADReplication* cmdlets, Get-ADTrust and Sync-ADObject).

Needless to say, you can run these commands remotely through WinRS, Remote Desktop, and/or PowerShell Remoting. Also, all the fine Joeware command line utilities work on Server Core installations.

Managing Active Directory contents

On the command line, tools like dsadd.exe, dsquery.exe, dsget.exe, dsmod.exe, dsrm.exe, and dsmove.exe are available as they’ve been for the last decade. With PowerShell, you can use any of the 28 account management cmdlets, 7 group management cmdlets, 10 password settings cmdlets, 7 Managed Service Account (MSA) cmdlets, and 26 Dynamic Access-related cmdlets.

For managing the contents of Active Directory Domain Services, you can go wild on the console of your Server Core Domain Controllers, or you can manage remotely from the comfort of your office chair. Active Directory Administrative Center (dsac.exe), Active Directory Users and Computers (dsa.msc), Active Directory Sites and Services (dssite.msc), Active Directory Domains and Trusts (domain.msc), and ADSI Edit (adsiedit.msc) can all be used from Windows Server 2012 installations and Windows 8 installations with the Remote Server Administration Tools (RSAT) installed:

Server Core Remote Active Directory Management

Server Core Remote Active Directory Management

Concluding

Remotely, a Server Core Domain Controller feels exactly the same as a Server with a GUI-based Domain Controller. Of course, in the back of your mind, you’d always know your Server Core Domain Controller is a lot faster, safer, and more reliable than your neighbor’s.

2 Comments
  1. Ishika Kapoor 6 years ago

    A quick question, hope you can help with the answer. What’s the total user load that 1 Domain Controller can handle?

  2. CorpC 6 years ago

    Thanks for this much appreciated, god bless you however I have question and I know that answer just need confirmation really. If full GUI server 2012 R2 VM as a domain controller and all is well however I want to convert it into a server core will I lose all the AD functionality due to it now being in a core environment?

    I know that fact you’ve covered how to in the post suggest it won’t as core OS is supported in an AD infra just need a clarification before I proceed as I can’t afford to lose it all.

    thanks for your time

    CorpC

Leave a reply

Your email address will not be published. Required fields are marked *

*

© 4sysops 2006 - 2023

CONTACT US

Please ask IT administration questions in the forums. Any other messages are welcome.

Sending

Log in with your credentials

or    

Forgot your details?

Create Account