Domain controllers store data and manage user and domain interactions, including user logon processes, authentication, and directory searches. If you plan to use this server to provide the Active Directory directory service to network users and computers, configure this server as a domain controller.
To configure a server as a domain controller, install Active Directory on the server. There are four options available in the Active Directory Installation Wizard. You can create an additional domain controller in an existing domain, a domain controller for a new child domain, a domain controller for a new domain tree, or a domain controller for a new forest. If you are not sure which role you need, read about each role by clicking the role option.
Notes
Create additional domain controllers when you want to improve the availability and reliability of network services. By adding additional domain controllers, you can provide fault tolerance, balance the load of existing domain controllers, provide additional infrastructure support to sites, and improve performance by making it easier for clients to connect to a domain controller when they log on to the network. For example, as seen in the following illustration, by adding a new domain controller (DC2) to the microsoft.com domain, it helps offset the load on other domain controllers.
An additional domain controller is used to load balance and provide fault tolerance.
This topic explains the basic steps that you must follow to create an additional domain controller in your organization.
This process involves using the Configure Your Server Wizard and the Active Directory Installation Wizard to install Active Directory on this server. When you have finished setting up your domain controller, you can complete additional configuration tasks.
This topic covers:
Before you configure your server as a domain controller, verify that:
The following table lists the information that you need to know before you add an additional domain controller.
| Before adding an additional domain controller role | Comments |
|---|---|
| Determine which sites require a domain controller. | If your network is divided into sites, it is good practice to put at least one domain controller in each site to enhance network performance. When users log on to the network, a domain controller must be contacted as part of the logon process. If clients have to connect to a domain controller located in a different site, the logon process can take a long time. |
| Determine whether to add an additional domain controller over the network or through backup media taken from an existing domain controller. | With the |
| Determine whether you want your new domain controller to host a global catalog. | A global catalog stores a full copy of all objects in the directory for its host domain and a partial copy of all objects for all other domains in the forest. To optimize network performance in a multiple-site environment, consider adding global catalogs for select sites. In a single-site environment, a single global catalog is usually sufficient to cover common Active Directory queries. However, in a multiple-site environment it is recommended that you use global catalogs in each site. For more information about when to add global catalogs in a multiple site environment, see Global catalogs and sites. |
| Domain controllers running Windows 2000 or Windows Server 2003 are available. | The domain must have at least one other domain controller running Windows 2000 or Windows Server 2003 to add an additional domain controller. Active Directory domain controllers cannot be configured as backup domain controllers (BDCs) for Windows NT domains. |
| Obtain the administrative credentials necessary to add a domain controller. | To add an additional domain controller to an existing domain, you must be a member of the Domain Admins group or the Enterprise Admins group in Active Directory, or you must have been delegated the appropriate authority. |
| Identify the DNS domain name of the Active Directory domain to which you want to add the additional domain controller. | You need to provide the DNS domain name when you use the Active Directory Installation Wizard. |
To configure an additional domain controller, start the Configure Your Server Wizard by doing either of the following:
On the Server Role page, click Domain Controller (Active Directory), and then click Next.
This section describes each of the steps in this process and outlines the required choices and decisions you will make as you configure your domain controller. The following sections cover these configuration steps:
Using the Active Directory Installation Wizard
Completing the Configure Your Server Wizard
Removing the domain controller role
On the Summary of Selections page of the Configure Your Server Wizard, you can view and confirm the options that you have selected. If you selected Domain Controller (Active Directory) on the previous page, the following appears:
To apply the selections shown on the Summary of Selections page, click Next.
After you click Next, the Active Directory Installation Wizard starts automatically. If this is the first time you have installed Active Directory on a server, click Active Directory Help for more information about Active Directory.
After you finish reading about Active Directory, click Next. You can return to this page from any place in the wizard until you click Finish on the last page. On the Operating System Compatibility page, read the information and then click Next. If this is the first time you have installed Active Directory on a server running Windows Server 2003, click Compatibility Help for more information.
This section describes the following steps in the Active Directory Installation Wizard:
Directory Services Restore Mode Administrator Password
On the Domain Controller Type page of the Active Directory Installation Wizard, click Additional domain controller for an existing domain.
As part of the process for creating an additional domain controller, the wizard deletes all local accounts, cryptographic keys, and encrypted data such as encrypted files and
After you finish, click Next.
On the Network Credentials page, type the user name, password, and domain of the user account you want to use.
| Option | Comments |
|---|---|
| User name | Type the name of a user account that has the necessary administrative credentials. The user account must be a member of the Domain Admins group for the target domain, or a member of the Enterprise Admins group, or must have been delegated the appropriate authority. |
| Password | Type the password for the user account. This should always be a strong password. For more information, see Strong passwords. |
| Domain | Type the full DNS name of the domain in which this user name and password are valid (for example, child.microsoft.com). This is also the domain where you want to add an additional domain controller. |
After you finish, click Next.
On the Additional Domain Controller page, type the full DNS name of the domain to which you want to add this domain controller. A full DNS name is also referred to as a fully qualified domain name (FQDN). Active Directory domains are named with DNS names and follow the same hierarchical structure of DNS.
After you finish, click Next.
On the Database and Log Folders page, type the locations in which you want to install the database and log folders, or click Browse to choose the locations. To avoid any problems with installing or removing Active Directory, it is important to confirm that you have sufficient disk space to host the directory database and log files. The Active Directory Installation Wizard requires 250 megabytes (MB) of disk space for the Active Directory database and 50 MB for the log files. It is recommended that you store these files on an NTFS partition.
After you finish, click Next.
On the Shared System Volume page, accept the default location in which you want to install the Sysvol folder, or click Browse to choose a location. The Sysvol folder must be stored on an NTFS volume since it contains files that are replicated between domain controllers in a domain or forest. These files include scripts, system policies for Windows NT 4.0 and earlier, the Netlogon and Sysvol shared folders, and Group Policy settings.
After you finish, click Next.
On the Directory Services Restore Mode Administrator Password page, type and confirm the password that you want to assign to the restore mode Administrator account for the server. You should use strong passwords for directory restore mode passwords. For more information, see Strong passwords.
Important
You use this password when the domain controller starts in Directory Services Restore Mode. If this is the first time you have installed Active Directory on a server, click Active Directory Help for more information about the restore mode password.
After you finish, click Next.
On the Summary page, review the information, and then click Next.
After you complete the installation, click Finish. To restart your computer and implement the changes, click Restart Now.
After your server restarts, the Configure Your Server Wizard displays the This Server is Now a Domain Controller page. To review all of the changes made to your server by the Configure Your Server Wizard or to ensure that a new role was installed successfully, click Configure Your Server log. The Configure Your Server Wizard log is located at systemroot\Debug\Configure Your Server.log. To close the Configure Your Server Wizard, click Finish.
If you need to reconfigure your server for a different role, you can remove existing server roles. By removing the domain controller role, you will uninstall Active Directory from this server. After Active Directory has been uninstalled, this server will no longer participate in replication of directory objects and domain-based user authentication requests.
To remove the domain controller role, restart the Configure Your Server Wizard by doing either of the following:
On the Server Role page, click Domain Controller (Active Directory), and then click Next. On the Role Removal Confirmation page, review the items listed under Summary, select the Remove the domain controller role check box, click Next, and then follow the steps in the Active Directory Installation Wizard.
After you complete the Active Directory Installation Wizard, the server is configured as a domain controller. You can use it to store data, manage objects, and provide information to users, computers, and applications. Up to this point, you have created an additional domain controller for an existing domain.
The following table lists some of the additional tasks that you might want to perform on your domain controller.
| Task | Purpose of task | Reference |
|---|---|---|
| Secure the new domain controller in a locked room. | To ensure that no one can physically access the domain controllers. | Domain controllers; Securing Active Directory |
| Use strong encryption techniques to secure account passwords. | To secure account password information on the new domain controller. | The system key utility |
Create a domain controller for a new forest when you want to upgrade a Windows NT domain to become the first domain in a new forest, segment your network for administrative autonomy, provide a security boundary to protect sensitive data, isolate the scope of directory replication, or use a noncontiguous DNS namespace that is different from an existing forest on your network. For example, as seen in the following illustration, the microsoft.com forest is the first Active Directory domain in an organization.
A forest can be used as the first Active Directory domain in your organization.
This topic explains the basic steps that you must follow to configure a domain controller for a new forest in your organization.
This process involves using the Configure Your Server Wizard and the Active Directory Installation Wizard to install Active Directory on this server. When you have finished setting up your domain controller, you can complete additional configuration tasks.
This topic covers:
Before you configure your server as a domain controller, verify whether or not:
The following table lists the information that you need to know before you add a domain controller for a new forest.
| Before adding a new domain controller role for a new forest | Comments |
|---|---|
| Verify that DNS is properly configured for your organization. | You need to confirm that DNS is properly configured on your network and that it supports dynamic updates and service (SRV) resource records. If you are setting up Active Directory for the first time in your organization, and you do not currently have a DNS infrastructure configured, the Active Directory Installation Wizard sets up and configures DNS on this server during the Active Directory installation process. Active Directory requires DNS to function and share the same hierarchical domain structure. For example, microsoft.com is a DNS domain and an Active Directory domain. |
| Obtain the administrative credentials necessary to create a forest. | To create a new forest, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. |
To configure a domain controller, start the Configure Your Server Wizard by doing either of the following:
On the Server Role page, click Domain Controller (Active Directory), and then click Next.
This section describes each of the steps in this process and outlines the required choices and decisions you will make as you configure your domain controller. The following sections cover these configuration steps:
Using the Active Directory Installation Wizard
Completing the Configure Your Server Wizard
Removing the domain controller role
On the Summary of Selections page of the Configure Your Server Wizard, you can view and confirm the options that you have selected. If you selected Domain Controller (Active Directory) on the previous page, the following appears:
To apply the selections shown on the Summary of Selections page, click Next.
After you click Next, the Active Directory Installation Wizard starts automatically. If this is the first time you have installed Active Directory on a server, click Active Directory Help for more information about Active Directory.
After you finish reading about Active Directory, click Next. You can return to this page from any place in the wizard until you click Finish on the last page. On the Operating System Compatibility page, read the information and then click Next. If this is the first time you have installed Active Directory on a server running Windows Server 2003, click Compatibility Help for more information.
This section describes the following steps in the Active Directory Installation Wizard:
Directory Services Restore Mode Administrator Password
On the Domain Controller Type page, click Domain controller for a new domain.
After you finish, click Next.
On the Create New Domain page, click Domain in a new forest.
After you finish, click Next.
On the New Domain Name page, type the full DNS name for the new domain. Provide a full DNS name for the new Active Directory forest that you are about to create (for example, headquarters.example.microsoft.com). A full DNS name is also referred to as a fully qualified domain name (FQDN). Active Directory domains are named with DNS names and follow the same hierarchical structure of DNS. When choosing DNS names to use for your Active Directory forest, start with the registered DNS domain suffix that your organization has reserved for use on the Internet, such as microsoft.com.
After you finish, click Next.
On the NetBIOS Domain Name page, verify the NetBIOS name. Although Active Directory domains are named according to DNS naming standards, you still need to define a NetBIOS name when you create Active Directory domains. NetBIOS names should match the first label of the DNS domain name whenever possible. When the Active Directory domain has a first label DNS name that is different from its NetBIOS name, the FQDN is constructed using the DNS domain name, not the NetBIOS name. For example, if the first label in the full DNS domain name is "child" (child.microsoft.com is the FQDN) and the NetBIOS domain name is "sales", the FQDN remains "child.microsoft.com".
After you finish, click Next.
On the Database and Log Folders page, type the location in which you want to install the database and log folders, or click Browse to choose a location. To avoid any problems with installing or removing Active Directory, it is important to confirm that you have sufficient disk space to host the directory database and log files. The Active Directory Installation Wizard requires 250 megabytes (MB) of disk space for the Active Directory database and 50 MB for the log files. It is recommended that you store these files on an NTFS partition.
After you finish, click Next.
On the Shared System Volume page, type the location in which you want to install the Sysvol folder, or click Browse to choose a location. The Sysvol folder must be stored on an NTFS volume since it contains files that are replicated between domain controllers in a domain or forest. These files include scripts, Windows NT 4.0 and earlier system policies, the NETLOGON and SYSVOL shares, and Group Policy settings.
After you finish, click Next.
On the DNS Registration Diagnostics page, verify that the DNS settings are correct.
If a diagnostic error appears under Diagnostic Results, click Help for more information about how to resolve the error.
After you finish, click Next.
On the Permissions page, click the level of application compatibility that you want with
On servers running Windows NT 4.0 and earlier, read access for user and group information is assigned to anonymous users so that existing applications, including Microsoft BackOffice, SQL Server, and some non-Microsoft applications, function correctly. In Windows 2000 and the
| Option | Comments |
|---|---|
| Permissions compatible with |
Click this option if you want the Anonymous Logon group and the Everyone security groups to be added to the |
| Permissions compatible only with Windows 2000 or Windows Server 2003 operating systems | Click this option to prevent members of the Anonymous Logon group from gaining read access to user and group information. |
After you select one of these options, you can manually switch between the backward compatible and high-security settings on Active Directory objects. To do this, open Active Directory Users and Computers, and then add the Anonymous Logon security group to the
After you finish, click Next.
On the Directory Services Restore Mode Administrator Password page, type and confirm the password that you want to assign to the restore mode Administrator account for the server. You should use strong passwords for directory restore mode passwords. For more information, see Strong passwords.
Important
You use this password when the domain controller starts in Directory Services Restore Mode. If this is the first time you have installed Active Directory on a server, click Active Directory Help for more information about the restore mode password.
After you finish, click Next.
On the Summary page, review the information, and then click Next.
After you complete the installation, click Finish. To restart your computer and implement the changes, click Restart Now.
After your server restarts, the Configure Your Server Wizard displays the This Server is Now a Domain Controller page. To review all of the changes made to your server by the Configure Your Server Wizard or to ensure that a new role was installed successfully, click Configure Your Server log. The Configure Your Server Wizard log is located at systemroot\Debug\Configure Your Server.log. To close the Configure Your Server Wizard, click Finish.
If you need to reconfigure your server for a different role, you can remove existing server roles. By removing the domain controller role, you will uninstall Active Directory from this server. After Active Directory has been uninstalled, this server will no longer participate in replication of directory objects and domain-based user authentication requests.
To remove the domain controller role, restart the Configure Your Server Wizard by doing either of the following:
On the Server Role page, click Domain Controller (Active Directory), and then click Next. On the Role Removal Confirmation page, review the items listed under Summary, select the Remove the domain controller role check box, click Next, and then follow the steps in the Active Directory Installation Wizard.
After you complete the Active Directory Installation Wizard, the server is configured as a domain controller. You can use it to store data, manage objects, and provide information to users, computers and applications. Up to this point, you have created a domain controller for a new forest.
The following table lists some of the additional tasks that you might want to perform on your domain controller.
| Task | Purpose of task | Reference |
|---|---|---|
| Secure the new domain controller in a locked room. | To ensure that no one can physically access the domain controllers. | Domain controllers; Securing Active Directory |
| Use strong encryption techniques. | To secure account password information on the new domain controller. | The system key utility |
| Verify and authenticate the validity of each user. | To enhance forest-wide security by using public key cryptography. | Public key infrastructure |
| Require all domain users to use strong passwords. | To prevent unauthorized access to your organization. | Strong passwords |
| Enable audit policy. | To receive notification of actions that could pose a security risk. | Auditing policy |
| Enforce account lockouts on user accounts. | To decrease the possibility of an attacker compromising your domain through repeated logon attempts. | User and computer accounts |
| Enforce password history on user accounts. | To decrease the possibility of an attacker compromising your domain. | Enforce password history |
| Enforce minimum and maximum password ages on user accounts. | To decrease the possibility of an attacker compromising your domain. | Minimum password age; Maximum password age |
| Implement SID Filtering. | To prevent attacks from malicious users who might try to grant elevated user rights to another user account. | "Using Security Identifier (SID) Filtering to Prevent Elevation of Privilege Attacks" at the Microsoft Web site.(http://www.microsoft.com/) |
| Implement smart cards. | To provide tamper-resistant user authentication and |
Smart card overview |
| Restrict user, group, and computer access to shared resources and filter Group Policy settings. | To secure resources. | Security groups |
| Create forest trusts (as appropriate). | To manage the security relationship between two forests, and simplify security administration and authentication across forests. | Forest trusts |
| Assign user rights to new security groups. | To specifically define the administrative role of members in the domain. | User rights assigned to security groups in Active Directory |
Create a domain controller for a new child domain when you want to create a domain that shares a contiguous namespace with one or more existing domains. This means that the name of the new domain contains the full name of the parent domain. For example, as seen in the following illustration, child.microsoft.com is a child domain of microsoft.com. As a best practice, create new domains as children of the forest root domain.
A child domain is used to form a contiguous namespace with its parent.
This topic explains the basic steps that you must follow to configure a domain controller for a new child domain in your organization.
This process involves using the Configure Your Server Wizard and the Active Directory Installation Wizard to install Active Directory on this server. When you have finished setting up your domain controller, you can complete additional configuration tasks.
This topic covers:
Before you configure your server as a domain controller, verify whether or not:
The following table lists the information that you need to know before you add a domain controller.
| Before adding a domain controller role | Comments |
|---|---|
| Identify the DNS domain name of the Active Directory domain to which you want to add the domain controller. | You need to provide the DNS domain name for the parent domain of this new child domain. |
| Verify that the network speed is adequate when installing Active Directory. | The server on which you want to install Active Directory and create a child domain should have access to the network over a high-speed connection. |
| Determine which sites require a domain controller. | If your network is divided into sites, it is good practice to put at least one domain controller in each site to enhance network performance. When users log on to the network, a domain controller must be contacted as part of the logon process. If clients have to connect to a domain controller located in a different site, the logon process can take a long time. |
| Determine whether you want your new domain controller to host a global catalog. | A global catalog stores a copy of all Active Directory objects in a forest on a domain controller. The global catalog stores a full copy of all objects in the directory for its host domain and a partial copy of all objects for all other domains in the forest. To optimize network performance in a multiple-site environment, consider adding global catalogs for select sites. In a single-site environment, a single global catalog is usually sufficient to cover common Active Directory queries. However, in a multiple-site environment it is recommended that you use global catalogs in each site. For more information on when to add global catalogs in a multiple site environment, see Global catalogs and sites. |
| Obtain the administrative credentials necessary to create a child domain. | To add a new child domain, you must be a member of the Domain Admins group (in the parent domain) or the Enterprise Admins group in Active Directory, or you must have been delegated the appropriate authority. |
To configure a domain controller, start the Configure Your Server Wizard by doing either of the following:
On the Server Role page, click Domain Controller (Active Directory), and then click Next.
This section describes each of the steps in this process and outlines the required choices and decisions you will make as you configure your domain controller. The following sections cover these configuration steps:
Using the Active Directory Installation Wizard
Completing the Configure Your Server Wizard
Removing the domain controller role
On the Summary of Selections page of the Configure Your Server Wizard, you can view and confirm the options that you have selected. If you selected Domain Controller (Active Directory) on the previous page, the following appears:
To apply the selections shown on the Summary of Selections page, click Next.
After you click Next, the Active Directory Installation Wizard starts automatically. If this is the first time you have installed Active Directory on a server, click Active Directory Help for more information about Active Directory.
After you finish reading about Active Directory, click Next. You can return to this page from any place in the wizard until you click Finish on the last page. On the Operating System Compatibility page, read the information and then click Next. If this is the first time you have installed Active Directory on a server running Windows Server 2003, click Compatibility Help for more information.
This section describes the following steps in the Active Directory Installation Wizard:
Directory Services Restore Mode Administrator Password
On the Domain Controller Type page, click Domain controller for a new domain.
After you finish, click Next.
On the Create New Domain page, click Child domain in an existing domain tree.
After you finish, click Next.
On the Network Credentials page, type the user name, password, and domain of the user account that you want to use.
| Option | Comments |
|---|---|
| User name | Type the name of a user account that has the necessary administrative credentials. The user account must be a member of the Domain Admins group (in the parent domain), or a member of the Enterprise Admins group, or must have been delegated the appropriate authority. |
| Password | Type the password for the user account. This should always be a strong password. For more information, see Strong passwords. |
| Domain | Type the full DNS name of the domain in which this user name and password are valid. |
After you finish, click Next.
On the Child Domain Installation page, verify the parent domain, and then the name for the new child domain. Active Directory domains are named with DNS names and follow the same hierarchical structure of DNS. When choosing DNS names to use for your child domain, consider names with either geographical or divisional scope within your organization (for example, newyork.microsoft.com or sales.microsoft.com).
Following the DNS standards, domain names are fully qualified domain names (FQDN), which consist of the name of the domain appended to the names of the parent domains and root domains using the dot (.) character format. For example, an Active Directory domain named "child" and a parent domain named "microsoft.com" have an FQDN (also referred to as a complete DNS name) of "child.microsoft.com".
After you finish, click Next.
On the NetBIOS Domain Name page, verify the NetBIOS name. Although Active Directory domains are named according to DNS naming standards, you still need to define a NetBIOS name when you create Active Directory domains. NetBIOS names should match the first label of the DNS domain name whenever possible. When the Active Directory domain has a first label DNS name that is different from its NetBIOS name, the FQDN is constructed using the DNS domain name, not the NetBIOS name. For example, if the first label in the full DNS domain name is "child" (child.microsoft.com is the FQDN) and the NetBIOS domain name is "sales", the FQDN remains "child.microsoft.com".
On the Database and Log Folders page, type the location in which you want to install the database and log folders, or click Browse to choose a location, and then click Next. To avoid any problems with installing or removing Active Directory, it is important to confirm that you have sufficient disk space to host the directory database and log files. The Active Directory Installation Wizard requires 250 megabytes (MB) of disk space for the Active Directory database and 50 MB for the log files. It is recommended that you store these files on an NTFS partition.
After you finish, click Next.
On the Shared System Volume page, type the location in which you want to install the Sysvol folder, or click Browse to choose a location. The Sysvol folder must be stored on an NTFS volume since it contains files that are replicated between domain controllers in a domain or forest. These files include scripts, Windows NT 4.0 and earlier system policies, the NETLOGON and SYSVOL shares, and Group Policy settings.
After you finish, click Next.
On the DNS Registration Diagnostics page, verify that the DNS settings are correct.
If a diagnostic error appears under Diagnostic Results, click Help for more information about how to resolve the error.
After you finish, click Next.
On the Permissions page, click the level of application compatibility that you want with
On servers running Windows NT 4.0 and earlier, read access for user and group information is assigned to anonymous users so that existing applications, including Microsoft BackOffice, SQL Server, and some non-Microsoft applications, function correctly. In Windows 2000 and the
| Option | Comments |
|---|---|
| Permissions compatible with |
Click this option if you want the Anonymous Logon group and the Everyone security groups to be added to the |
| Permissions compatible only with Windows 2000 or Windows Server 2003 operating systems | Click this option to prevent members of the Anonymous Logon group from gaining read access to user and group information. |
After you select one of these options, you can manually switch between the backward compatible and high-security settings on Active Directory objects. To do this, open Active Directory Users and Computers, and then add the Anonymous Logon security group to the
After you finish, click Next.
On the Directory Services Restore Mode Administrator Password page, type and confirm the password that you want to assign to the restore mode Administrator account for the server. You should use strong passwords for directory restore mode passwords. For more information, see Strong passwords.
Important
You use this password when the domain controller starts in Directory Services Restore Mode. If this is the first time you have installed Active Directory on a server, click Active Directory Help for more information about the restore mode password.
After you finish, click Next.
On the Summary page, review the information, and then click Next.
After you complete the installation, click Finish. To restart your computer and implement the changes, click Restart Now.
After your server restarts, the Configure Your Server Wizard displays the This Server is Now a Domain Controller page. To review all of the changes made to your server by the Configure Your Server Wizard or to ensure that a new role was installed successfully, click Configure Your Server log. The Configure Your Server Wizard log is located at systemroot\Debug\Configure Your Server.log. To close the Configure Your Server Wizard, click Finish.
If you need to reconfigure your server for a different role, you can remove existing server roles. By removing the domain controller role, you will uninstall Active Directory from this server. After Active Directory has been uninstalled, this server will no longer participate in replication of directory objects and domain-based user authentication requests.
To remove the domain controller role, restart the Configure Your Server Wizard by doing either of the following:
On the Server Role page, click Domain Controller (Active Directory), and then click Next. On the Role Removal Confirmation page, review the items listed under Summary, select the Remove the domain controller role check box, click Next, and then follow the steps in the Active Directory Installation Wizard.
After you complete the Active Directory Installation Wizard, the server is configured as a domain controller. You can use it to store data, manage objects, and provide information to users, computers and applications. Up to this point, you have created a new domain or additional domain controller for an existing domain.
The following table lists some of the additional tasks that you might want to perform on your domain controller.
| Task | Purpose of task | Reference |
|---|---|---|
| Secure the new domain controller in a locked room. | To ensure that no one can physically access the domain controller. | Domain controllers; Securing Active Directory |
| Use strong encryption techniques. | To secure account password information on the new domain controller. | The system key utility |
| Require all domain users to use strong passwords. | To prevent unauthorized access to your organization. | Strong passwords |
| Enable audit policy. | To receive notification of actions that could pose a security risk. | Auditing policy |
| Enforce account lockouts on user accounts. | To decrease the possibility of an attacker compromising your domain through repeated logon attempts. | User and computer accounts |
| Enforce password history on user accounts. | To decrease the possibility of an attacker compromising your domain. | Enforce password history |
| Enforce minimum and maximum password ages on user accounts. | To decrease the possibility of an attacker compromising your domain. | Minimum password age; Maximum password age |
| Implement SID Filtering. | To prevent attacks from malicious users who might try to grant elevated user rights to another user account. | "Using Security Identifier (SID) Filtering to Prevent Elevation of Privilege Attacks" at the Microsoft Web site.(http://www.microsoft.com/) |
| Implement smart cards. | To provide tamper-resistant user authentication and |
Smart card overview |
| Restrict user, group, and computer access to shared resources and filter Group Policy settings. | To secure resources. | Security groups |
| Assign user rights to new security groups. | To specifically define the administrative role of members in the domain. | User rights assigned to security groups in Active Directory |
Create a domain controller for a new domain tree when you want to create a domain that has a DNS namespace that is not related to the other domains in the forest. This means that the name of the tree root domain (and all of its children) does not have to contain the full name of the parent domain. A forest can contain one or more domain trees. For example, as seen in the following illustration, msn.com is a new domain tree in the microsoft.com forest.
A domain tree is used to form a noncontiguous namespace within the forest.
This topic explains the basic steps that you must follow to configure a domain controller for a new domain tree in your organization.
This process involves using the Configure Your Server Wizard and the Active Directory Installation Wizard to install Active Directory on this server. When you have finished setting up your domain controller, you can complete additional configuration tasks.
This topic covers:
Before you configure your server as a domain controller, verify whether or not:
The following table lists the information that you need to know before you add a domain controller.
| Before adding a domain controller role | Comments |
|---|---|
| Verify that the network speed is adequate when installing Active Directory. | The server on which you want to install Active Directory should have access to the network over a high-speed connection. |
| Determine whether you want your new domain controller to host a global catalog. | A global catalog stores a copy of all Active Directory objects in a forest on a domain controller. The global catalog stores a full copy of all objects in the directory for its host domain and a partial copy of all objects for all other domains in the forest. To optimize network performance in a multiple-site environment, consider adding global catalogs for select sites. In a single-site environment, a single global catalog is usually sufficient to cover common Active Directory queries. However, in a multiple-site environment it is recommended that you use global catalogs in each site. For more information about when to add global catalogs in a multiple site environment, see Global catalogs and sites. |
| Obtain the administrative credentials necessary to add a new domain tree. | To create a new domain tree, you must be a member of the Domain Admins group (in the forest root domain) or the Enterprise Admins group in Active Directory, or you must have been delegated the appropriate authority. |
To configure a domain controller, start the Configure Your Server Wizard by doing either of the following:
On the Server Role page, click Domain Controller (Active Directory), and then click Next.
This section describes each of the steps in this process and outlines the required choices and decisions you will make as you configure your domain controller. The following sections cover these configuration steps:
Using the Active Directory Installation Wizard
Completing the Configure Your Server Wizard
Removing the domain controller role
On the Summary of Selections page of the Configure Your Server Wizard, you can view and confirm the options that you have selected. If you selected Domain Controller (Active Directory) on the previous page, the following appears:
To apply the selections shown on the Summary of Selections page, click Next.
After you click Next, the Active Directory Installation Wizard starts automatically. If this is the first time you have installed Active Directory on a server, click Active Directory Help for more information about Active Directory.
After you finish reading about Active Directory, click Next. You can return to this page from any place in the wizard until you click Finish on the last page. On the Operating System Compatibility page, read the information and then click Next. If this is the first time you have installed Active Directory on a server running Windows Server 2003, click Compatibility Help for more information.
This section describes the following steps in the Active Directory Installation Wizard:
Directory Services Restore Mode Administrator Password
On the Domain Controller Type page, click Domain controller for a new domain.
After you finish, click Next.
On the Create New Domain page, click Domain tree in an existing forest.
After you finish, click Next.
On the Network Credentials page, type the user name, password, and user domain of the user account that you want to use.
| Option | Comments |
|---|---|
| User name | Type the name of a user account that has the necessary administrative credentials. The user account must be a member of the Domain Admins group (in the forest root domain), or a member of the Enterprise Admins group, or must have been delegated the appropriate authority. |
| Password | Type the password for the user account. This should always be a strong password. For more information, see Strong passwords. |
| Domain | Type the full DNS name of the domain in which this user name and password are valid. |
On the New Domain Name page, type the full DNS name for the new domain tree. Provide a full DNS name for the new domain tree that you want to create. Active Directory domains are named with DNS names and follow the same hierarchical structure of DNS.
Following the DNS standards, domain names are fully qualified domain names (FQDN), which consist of the name of the domain appended to the names of the parent domains and root domains using the dot (.) character format. It is not recommended that you use a single label DNS name for an Active Directory domain name. A single label DNS name is a name without a parent or root domain name.
After you finish, click Next.
On the NetBIOS Domain Name page, verify the NetBIOS name. Although Active Directory domains are named according to DNS naming standards, you still need to define a NetBIOS name when you create Active Directory domains. NetBIOS names should match the first label of the DNS domain name whenever possible. When the Active Directory domain has a first label DNS name that is different from its NetBIOS name, the FQDN is constructed using the DNS domain name, not the NetBIOS name. For example, if the first label in the full DNS domain name is "child" (child.microsoft.com is the FQDN) and the NetBIOS domain name is "sales", the FQDN remains "child.microsoft.com".
After you finish, click Next.
On the Database and Log Folders page, type the location in which you want to install the database and log folders, or click Browse to choose a location. To avoid any problems with installing or removing Active Directory, it is important to confirm that you have sufficient disk space to host the directory database and log files. The Active Directory Installation Wizard requires 250 megabytes (MB) of disk space for the Active Directory database and 50 MB for the log files. It is recommended that you store these files on an NTFS partition.
After you finish, click Next.
On the Shared System Volume page, type the location in which you want to install the Sysvol folder, or click Browse to choose a location. The Sysvol folder must be stored on an NTFS volume since it contains files that are replicated between domain controllers in a domain or forest. These files include scripts, Windows NT 4.0 and earlier system policies, the NETLOGON and SYSVOL shares, and Group Policy settings.
After you finish, click Next.
On the DNS Registration Diagnostics page, verify the DNS settings are correct.
If a diagnostic error appears under Diagnostic Results, click Help for more information about how to resolve the error.
After you finish, click Next.
On the Permissions page, click the level of application compatibility that you want with
On servers running Windows NT 4.0 and earlier, read access for user and group information is assigned to anonymous users so that existing applications, including Microsoft BackOffice, SQL Server, and some non-Microsoft applications, function correctly. In Windows 2000 and the
| Option | Comments |
|---|---|
| Permissions compatible with |
Click this option if you want the Anonymous Logon group and the Everyone security groups to be added to the |
| Permissions compatible only with Windows 2000 or Windows Server 2003 operating systems | Click this option to prevent members of the Anonymous Logon group from gaining read access to user and group information. |
After you select one of these options, you can manually switch between the backward compatible and high-security settings on Active Directory objects. To do this, open Active Directory Users and Computers, and then add the Anonymous Logon security group to the
On the Directory Services Restore Mode Administrator Password page, type and confirm the password that you want to assign to the restore mode Administrator account for the server. You should use strong passwords for directory restore mode passwords. For more information, see Strong passwords.
Important
You use this password when the domain controller starts in Directory Services Restore Mode. If this is the first time you have installed Active Directory on a server, click Active Directory Help for more information about the restore mode password.
After you finish, click Next.
On the Summary page, review the information, and then click Next.
After you complete the installation, click Finish. To restart your computer and implement the changes, click Restart Now.
After your server restarts, the Configure Your Server Wizard displays the This Server is Now a Domain Controller page. To review all of the changes made to your server by the Configure Your Server Wizard or to ensure that a new role was installed successfully, click Configure Your Server log. The Configure Your Server Wizard log is located at systemroot\Debug\Configure Your Server.log. To close the Configure Your Server Wizard, click Finish.
If you need to reconfigure your server for a different role, you can remove existing server roles. By removing the domain controller role, you will uninstall Active Directory from this server. After Active Directory has been uninstalled, this server will no longer participate in replication of directory objects and domain-based user authentication requests.
To remove the domain controller role, restart the Configure Your Server Wizard by doing either of the following:
On the Server Role page, click Domain Controller (Active Directory), and then click Next. On the Role Removal Confirmation page, review the items listed under Summary, select the Remove the domain controller role check box, click Next, and then follow the steps in the Active Directory Installation Wizard.
After you complete the Active Directory Installation Wizard, the server is configured as a domain controller. You can use it to store data, manage objects, and provide information to users, computers and applications. Up to this point, you have created a new domain or additional domain controller for an existing domain.
The following table lists some of the additional tasks that you might want to perform on your domain controller.
| Task | Purpose of task | Reference |
|---|---|---|
| Secure the new domain controller in a locked room. | To ensure that no one can physically access the domain controller. | Domain controllers; Securing Active Directory |
| Use strong encryption techniques. | To secure account password information on the new domain controller. | The system key utility |
| Require all domain users to use strong passwords. | To prevent unauthorized access to your organization. | Strong passwords |
| Enable audit policy. | To receive notification of actions that could pose a security risk. | Auditing policy |
| Enforce account lockouts on user accounts. | To decrease the possibility of an attacker compromising your domain through repeated logon attempts. | User and computer accounts |
| Enforce password history on user accounts. | To decrease the possibility of an attacker compromising your domain. | Enforce password history |
| Enforce minimum and maximum password ages on user accounts. | To decrease the possibility of an attacker compromising your domain. | Minimum password age; Maximum password age |
| Implement SID Filtering. | To prevent attacks from malicious users who might try to grant elevated user rights to another user account. | "Using Security Identifier (SID) Filtering to Prevent Elevation of Privilege Attacks" at the Microsoft Web site.(http://www.microsoft.com/) |
| Implement smart cards. | To provide tamper-resistant user authentication and |
Smart card overview |
| Restrict user, group, and computer access to shared resources and filter Group Policy settings. | To secure resources. | Security groups |
| Assign user rights to new security groups. | To specifically define the administrative role of members in the domain. | User rights assigned to security groups in Active Directory |
