Active Directory Domain Service

AD DS Design

• Single Forest preferred

• Time is important (PDC)

• Implement multiple/backup Domain Controllers

• 2,150,000,000 objects per domain

• FQDN less than characters

FSMO (Flexible Single Master operation)

	Forest level	Make change into Schema in forest (such as implement Exchange, Lync)
Domain naming Master	Forest level	To Add/remove domain in forest
Pdc	Domain level	Time root in Forest (PC-DC-PDC) Group Policy Management Centrally Handle Password change specially (after change user password, the DC would sync to PDC immediately) Handle User account Lock specially
RID Pool Master	Domain level	Assign RIDs (500/time) to DC
Infrastucture Master	Domain level	Objects reference in different domains

# to check the FSMO servers

netdom query FSMO

# to Transfer/seize

netdom/?

Install Domain controllers in the first site

# Install AD DS on the first DC

Install-windowsfeature Ad-domain-services-includeallsubfeature-includemanagementtools

# # Windows PowerShell script for AD DS deployment#import-module addsdeploymentinstall-addsforest '-creatednsdelegation: $false '-databasepath ' C:\Windows\NTDS "'-domainmode" win2012r2 "'-domainname" vccware.com "'-domainnetbiosname ' Vccware "'-forestmode" Win2012r2 "'-installdns: $true '-logpath" C:\Windows\NTDS "'-norebootoncompletion: $false '- Sysvolpath "C:\Windows\SYSVOL" '-safemodeadministratorpassword (convertto-securestring "123.com"-asplaintext-force ) '-force: $true

# Install AD DS on the second DC

Install-windowsfeature Ad-domain-services-includeallsubfeature-includemanagementtools

# # Windows PowerShell script for AD DS deployment#import-module Addsdeploymentinstall-addsdomaincontroller '- Noglobalcatalog: $false '-creatednsdelegation: $false '-criticalreplicationonly: $false '-databasepath ' C:\Windows\ NTDS "'-domainname" vccware.com "'-installdns: $true '-logpath" C:\Windows\NTDS "'-norebootoncompletion: $false '- ReplicationSourceDC "BJAD01.vccware.com" '-sitename "Default-first-site-name" '-sysvolpath "C:\Windows\SYSVOL" '- Safemodeadministratorpassword (convertto-securestring "123.com"-asplaintext-force) '-force: $true

This article is from the "Alphabook" blog, make sure to keep this source http://alphabook.blog.51cto.com/232573/1883483

Active Directory Domain Service