Windows 2003 Active Directory Setup:dcpromo

Windows 2003 Active Directory Setup:dcpromo

Now that we have setup Windows Server 2003 on our virtual machine, and we have patched it with SP2, Installed an Antivirus and setup DNS, is time now to setup active directory using dcpromo. Read about how to install and configure DNS on Windows Server 2003 from my previous post.

Setting up active directory using the run command dcpromo is a straightforward procedure. To begin, from your windows 2003 server desktop go to Start click on Run and type dcpromo and hit Enter.


The “Welcome to the Active Directory Installation Wizard” should come up:





Click on Next. On the following window, you will get a warning about comparability issues with other Operating Systems. Improve security settings in Windows Server 2003 affect older versions of windows:





After reading and thinking about consequences, click Next. On the next screen, you will get two options. The first option asks you if you want the server to become a domain controller for a new domain or if you want the server to be an additional domain controller for for an existing domain:



Select the first option and click Next. On the next window, you will get three options. the first option is to setup the domain in a new forest. Select this option if its the first domain controller on your organization, or if you want it to be totally independent from any forest.

Option two: Child domain in an existing domain tree. select this option if you want the domain to be a child domain from an existing domain. option three: Domain tree in an existing forest. if you don’t want any of the above, select this option.





In our case, choose the first option, and click Next. On the next screen, we need to type the full DNS name for the new domain:



Type the full DNS name like helpdeskgeek.com, and click on Next. On the next screen, we need to choose the NETBIOS name. This is the name earlier version of windows users will be using to identify the new domain.





Choose the name, and click Next. On the next screen, you need to select the location of where you want to store the database and log files. for best performance store them in separate disks



Choose the location where you want the active directory database and logs, and click Next.

Next, the Shared system volume window will come up. here, you need to choose the location on where you want to store the SYSVOL files. this folder contains the domain public files and are replicated to all the domain controllers in the domain.





Choose the folder location, and click Next. On the next window, the DNS registration diagnostic will show up. in here most likely you will get ” Diagnostic failed” and will give you three options. First option: it will allow you to perform the DNS diagnostic again,if you have corrected the problem.

Option two: it gives you the option to allow the active directory wizard to install and configure DNS for you, and use this DNS as the primary DNS for this server. third option, it allows you to bypass this window if you plan to correct the problem later on.





Even though we have already installed DNS on this server, we have not configure any of its services, so we will choose the option to Install and configure DNS server on this computer and set this computer to use this DNS server as its preferred DNS server. then click Next.

On the next window, you need to choose what type or permissions you want for users and group objects. Here you will get two options. the first options: select this option if you run server programs with pre-windows 2000. option two: select this option, if you only run windows servers 2000 and windows servers 2003 on your domain.





Select the second option, and click Next. On the next window, you need to enter the Directory services restore mode administrator password. This password is used when you start the computer in directory services restore mode. This account is different from the domain administrator account.





Type your chosen password, and click Next. Next, you will get the summary of all the options you have chosen during the active directory wizard. remember, the domain administrator account password is the same as the current local administrator password.



Click Next. the active directory installation should begin.



Some serious configuration processes going here. After a few minutes, active directory should be installed.





Click on Finish. and restart the computer. Active Directory should be now installed.

Windows 2003 Active Directory Setup:dcpromo

Install and Configure DNS on Windows Server 2003

Now that we have Windows Server 2003 patched with SP2 and with an Antivirus, is time to do the preparation to setup active directory for our domain controller in our testing network. you can read about our previous posts here “Free antivirus for windows server 2003“ and “Installing Windows Server 2003 on a VMware server.

Before we run the dcpromo wizard, it is recommended that we setup DNS first to avoid any issue with DNS while setting up active directory. so we will install DNS now.


From your Windows Server 2003 desktop click on Start>Control Panel>Add or Remove Programs:





The add and remove programs window should come up. Click on Add/Remove Windows Components:





The Windows Components Wizard should come up. Scroll down, and select “Network Services” and click on Details:





Check Domain Name System (DNS) from the first option:





Click on OK, and then click on Next in the wizard window. The installation of DNS should start.

if your Server is setup with dynamic IP address, you will get this warning at the middle of the installation:





Click on the OK button. The Local Area Connection Properties window will come up to setup the static IP address.select Internet Protocol (TCP/IP) and click on properties.





The TCP/IP Properties windows will come up. type the IP address, subnet mask, default gateway, and DNS. by typing IPconfig /all on the command prompt you can get this information the server is currently using. remember you need to exclude this IP address from the DHCP server on the router:





Click on the OK button. After this, the DNS installation should finish.

DHCP server in Windows 2003

The DHCP server assigns a client an IP address taken from a predefined scope for a given amount of time. If an IP address is required for longer than the lease has been set for, the client must request an extension before the lease expires. If the client has not requested an extension on the lease time, the IP address will be considered free and can be assigned to another client. If the user wishes to change IP address then they can do so by typing "ipconfig /release", followed by "ipconfig /renew" in the command prompt. This will remove the current IP address and request a new one. Reservations can be defined on the DHCP server to allow certain clients to have their own IP address (this will be discussed a little later on). Addresses can be reserved for a MAC address or a host name so these clients will have a fixed IP address that is configured automatically. Most Internet Service Providers use DHCP to assign new IP addresses to client computers when a customer connects to the internet - this simplifies things at user level.

The above diagram diplays a simple structure consisting of a DHCP server and a number of client computers on a network.

The DHCP Server itself contains an IP Address Database which holds all the IP addresses available for distribution. If the client (a member of the network with a Windows 2000 Professional/XP operating system, for example) has "obtain an IP address automatically" enabled in TCP/IP settings, then it is able to receive an IP address from the DHCP server.

Setting up a DHCP Server :

This will serve as a step-by-step guide on how to setup a DHCP server.
Installing the DHCP server is made quite easy in Windows 2003. By using the "Manage your server" wizard, you are able to enter the details you require and have the wizard set the basics for you. Open to "Manage your server" wizard, select the DHCP server option for the list of server roles and press Next.
You will be asked to enter the name and description of your scope.

Scope: A scope is a collection of IP addresses for computers on a subnet that use DHCP.

The next window will ask you to define the range of addresses that the scope will distribute across the network and the subnet mask for the IP address. Enter the appropriate details and click next.

You are shown a window in which you must add any exclusions to the range of IP addresses you specified in the previous window. If for example, the IP address 10.0.0.150 is that of the company router then you won't want the DHCP server to be able to distribute that address as well. In this example I have excluded a range of IP addresses, 10.0.0.100 to 10.0.0.110, and a single address, 10.0.0.150. In this case, eleven IP's will be reserved and not distributed amongst the network clients.

It is now time to set the lease duration for how long a client can use an IP address assigned to it from this scope. It is recommended to add longer leases for a fixed network (in the office for example) and shorter leases for remote connections or laptop computers. In this example I have set a lease duration of twelve hours since the network clients would be a fixed desktop computer in a local office and the usual working time is eight hours.

You are given a choice of whether or not you wish to configure the DHCP options for the scope now or later. If you choose Yes then the upcoming screenshots will be of use to you. Choosing No will allow you to configure these options at a later stage.

The router, or gateway, IP address may be entered in next. The client computers will then know which router to use.

In the following window, the DNS and domain name settings can be entered. The DNS server IP address will be distributed by the DHCP server and given to the client

If you have WINS setup then here is where to enter the IP Address of the WINS server. You can just input the server name into the appropriate box and press "Resolve" to allow it to find the IP address itself.

The last step is to activate the scope - just press next when you see the window below. The DHCP server will not work unless you do this.

The DHCP server has now been installed with the basic settings in place. The next stage is to configure it to the needs of your network structure.

Configuring a DHCP server
Hereunder is a simple explanation of how to configure a DHCP server.

The address pool displays a list of IP ranges assigned for distribution and IP address exclusions. You are able to add an exclusion by right clicking the address pool text on the left hand side of the mmc window and selecting "new exclusion range". This will bring up a window (as seen below) which will allow you to enter an address range to be added. Entering only the start IP will add a single IP address.

DHCP servers permit you to reserve an IP address for a client. This means that the specific network client will have the same IP for as long as you wanted it to. To do this you will have to know the physical address (MAC) of each network card. Enter the reservation name, desired IP address, MAC address and description - choose whether you want to support DHCP or BOOTP and press add. The new reservation will be added to the list. As an example, I have reserved an IP address (10.0.0.115) for a client computer called Andrew.




If you right click scope options and press "configure options" you will be taken to a window in which you can configure more servers and their parameters. These settings will be distributed by the DHCP server along with the IP address. Server options act as a default for all the scopes in the DHCP server. However, scope options take preference over server options.

In my opinion, the DHCP server in Windows 2003 is excellent! It has been improved from the Windows 2000 version and is classified as essential for large networks. Imagine having to configure each and every client manually - it would take up a lot of time and require far more troubleshooting if a problem was to arise. Before touching any settings related to DHCP, it is best to make a plan of your network and think about the range of IPs to use for the computers.

Configuring the WSUS Client by Group Policy

The quickest and easiest way to configure systems to auto-update using Windows Server Update Services (WSUS) is to use group policy within Active Directory. This document assumes familiarity with using "Active Directory Users and Computers" to manage group policy.

The client PCs need to be running Windows 2000 SP4, Windows XP SP2, Windows Server 2003 (SP1 or above) or Windows Vista. (Technically this product works with the previous SPs, but we have decided not to approve the full service pack updates for installation as support staff may not wish SP updates to be approved automatically. Some PCs will fail with these updates, e.g. if free hard disk space is too small. In any case you should not be connecting systems with earlier SPs than those listed above to the network. MS does not provide update support for these SPs.)

First, select the Organisational Unit (OU) to which you wish to apply the policy. Then choose an existing Group Policy Object (GPO) to which you wish to add the Auto Update configuration, or alternatively create a new GPO. Open the GPO.



Under Computer Configuration, right-click on Administrative Templates and choose Add/Remove Templates....




You will see a dialog box that looks something like this:




We need to add a new template containing the WSUS settings, so click Add....



We need to add wuau.adm. This may or may not already be present in the \windows\inf folder. If it is present, please check its size. If it is less than 49kB, it's an old version. The newer version of wuau.adm, can be downloaded from here (Windows Policy Template, 50KB) and saved to \windows\inf.

You should now see the wuau.adm template included in the list. Here it's listed with the smaller size (49kB, as opposed to 50kB). Again, if wuau.adm shows up as smaller, you have the wrong version.




Next, expand the tree to get to Computer Configuration/Administrative Templates/Windows Components/Windows Update. Under Windows Update, you should see fifteen policy setting, as shown below. If you only see only two or four, you have loaded an old version of wuau.adm.




Next, expand the tree to get to Computer Configuration/Administrative Templates/Windows Components/Windows Update. Under Windows Update, you should see fifteen policy setting, as shown below. If you only see only two or four, you have loaded an old version of wuau.adm.




This document explains the minimum configuration required to use WSUS; for more information on the other settings, read the description provided by Windows.

We'll start at the top. Double-click on Configure Automatic Updates.

In Configure Automatic Updates Properties, choose Enabled. Choose "4. Auto download and schedule the install"; select an installation day (either "every day", or choose the day of the week on which you'd like updates to take place); select an installation time (the default is 3am; we recommend that you schedule updates for a time when no one is likely to be using the computer, even if you'd expect the computer to be switched off at that time). Click on OK to close the dialog box.




Open the setting Specify intranet Microsoft update service location. In the properties dialog, choose Enabled. Then, set both the intranet update service and the intranet statistics server to http://is-wsus.bris.ac.uk/ as shown below. Click on OK to close the dialog box.




This version of WSUS can be set to update Microsoft Office packages (Office XP(2002), 2003, 2007) in addition to Windows itself. This is optional and will not happen unless you select it as follows. If you wish to use WSUS to keep Microsoft Office packages (Office XP(2002), 2003, 2007) updated, you can configure the WSUS client to install Office updates as follows (provided that Office was installed from an unpatched original copy): Open the setting Enable client-side targeting. In the properties dialog, choose Enabled. Then, set the target group name OfficeUpdates as shown below. Click on OK to close the dialog box.




Open the setting Reschedule Automatic Updates scheduled installations. In the properties dialog, choose Enabled. Leave the Wait after system startup setting at five minutes. We suggest that if you do decrease this amount, you set it to no less than two minutes. Click on OK to close the dialog box.




Open the setting No auto-restart for scheduled Automatic Updates installations. In the properties dialog, choose Enabled. This will prevent the computer from restarting automatically after performing updates (and will avoid work being lost).

Open the setting Allow Automatic Updates immediate installation. In the properties dialog, choose Enabled. This will allow the computer to silently install updates that do not interrupt services or require a reboot.



The settings above should allow your computers to automatically stay up to date with security patches and minimise the risk of work being lost.