Lesson 2 — Active Directory Domain Services (AD DS)

Every object in Active Directory has a unique Distinguished Name that describes its location in the directory hierarchy. LDAP tools and PowerShell use these names.

# LDAP DN components:
# DC  = Domain Component  (parts of the domain name)
# OU  = Organizational Unit container
# CN  = Common Name (users, groups, computers, containers)

# Examples:
DC=company,DC=com                              # The root of the domain
OU=IT,DC=company,DC=com                        # The IT OU at root level
OU=Admins,OU=IT,DC=company,DC=com              # Admins OU nested inside IT OU
CN=John Smith,OU=IT,DC=company,DC=com          # User John Smith in IT OU
CN=Domain Admins,CN=Users,DC=company,DC=com    # Domain Admins group (built-in)
CN=SRV-WEB01,OU=Servers,DC=company,DC=com      # Computer object in Servers OU

# The sAMAccountName (pre-Windows 2000) is the logon name used for domain logon:
# Domain\jsmith  (NETBIOS format)
# jsmith@company.com (UPN format — preferred)

Prerequisites

• Static IP address configured on the server
• Server must be in a WORKGROUP (not already joined to a domain) for new forest creation
• At least 512 MB RAM (4 GB+ recommended for production)
• At least 32 GB disk space

Step 1: Install the AD DS Role

# Via PowerShell (fastest method):
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

# Verify installation
Get-WindowsFeature -Name AD-Domain-Services

Step 2: Promote Server to Domain Controller (New Forest)

After installing the role, a notification appears in Server Manager. Click it and select "Promote this server to a domain controller" — or use PowerShell:

# Create a NEW forest (first DC in the environment)
Install-ADDSForest `
  -DomainName "lab.local" `
  -DomainNetbiosName "LAB" `
  -DomainMode "WinThreshold" `
  -ForestMode "WinThreshold" `
  -DatabasePath "C:\Windows\NTDS" `
  -LogPath "C:\Windows\NTDS" `
  -SysvolPath "C:\Windows\SYSVOL" `
  -InstallDns:$true `
  -SafeModeAdministratorPassword (ConvertTo-SecureString "P@ssw0rd123!" -AsPlainText -Force) `
  -Force

# The server will restart automatically after promotion

# Add a SECOND DC to an existing domain
Install-ADDSDomainController `
  -DomainName "lab.local" `
  -InstallDns:$true `
  -Credential (Get-Credential) `
  -SafeModeAdministratorPassword (ConvertTo-SecureString "P@ssw0rd123!" -AsPlainText -Force) `
  -Force

What Gets Created After Promotion

• NTDS.DIT — The AD database file at C:\Windows\NTDS\ntds.dit
• SYSVOL — Shared folder at C:\Windows\SYSVOL\sysvol\lab.local\ containing GPO templates and scripts, replicated between DCs via DFS-R
• DNS zones — Forward lookup zone for lab.local, plus _msdcs zone for AD service records (SRV records)
• Default OUs — Builtin, Computers, Domain Controllers, ForeignSecurityPrincipals, Users

ADUC (dsa.msc) is the primary GUI tool for managing users, groups, computers, and OUs. It is available on any machine with RSAT (Remote Server Administration Tools) installed.

# Install RSAT on Windows 10/11 (to manage AD remotely)
# Via Settings → Apps → Optional Features → RSAT: Active Directory...
# Or via PowerShell:
Add-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0

# Open ADUC
dsa.msc

# Enable "Advanced Features" to see all attributes and system containers:
# View menu → Advanced Features

GUI Method

1. Open ADUC (dsa.msc)
2. Navigate to the target OU (e.g., OU=IT)
3. Right-click → New → User
4. Enter: First name, Last name, Full name (auto-populated), User logon name (UPN prefix)
5. Click Next → Set password → configure password options
6. Click Finish

Important Password Options

User Account Properties Tabs

Group Scope

AGDLP Strategy (Microsoft Recommended)

Group Types

• Security Group — Used to assign permissions to resources and apply GPO security filtering. Can also be used as email distribution list.
• Distribution Group — Used only for email distribution lists (Exchange/Outlook). Cannot be used for security permissions.

# Create a Global Security Group
New-ADGroup -Name "GG-IT-Staff" -GroupScope Global -GroupCategory Security `
  -Path "OU=Groups,DC=lab,DC=local" -Description "IT Department staff"

# Add members to group
Add-ADGroupMember -Identity "GG-IT-Staff" -Members "jsmith","bjones","akim"

# View group members
Get-ADGroupMember -Identity "GG-IT-Staff" | Select-Object Name, SamAccountName, objectClass

# Add a group to another group (nesting)
Add-ADGroupMember -Identity "DL-FileServer-IT" -Members "GG-IT-Staff"

OUs are containers that organize objects within a domain. They serve two purposes: logical organization of objects, and the application of Group Policy Objects (GPOs).

Example OU Structure

# Create OU structure via PowerShell
New-ADOrganizationalUnit -Name "_Lab" -Path "DC=lab,DC=local"
New-ADOrganizationalUnit -Name "Users" -Path "OU=_Lab,DC=lab,DC=local"
New-ADOrganizationalUnit -Name "IT" -Path "OU=Users,OU=_Lab,DC=lab,DC=local"
New-ADOrganizationalUnit -Name "HR" -Path "OU=Users,OU=_Lab,DC=lab,DC=local"
New-ADOrganizationalUnit -Name "Groups" -Path "OU=_Lab,DC=lab,DC=local"
New-ADOrganizationalUnit -Name "Computers" -Path "OU=_Lab,DC=lab,DC=local"
New-ADOrganizationalUnit -Name "Servers" -Path "OU=_Lab,DC=lab,DC=local"

# List all OUs in the domain
Get-ADOrganizationalUnit -Filter * | Select-Object Name, DistinguishedName | Sort-Object DistinguishedName

# Redirect default computer container to a custom OU
redircmp "OU=Workstations,OU=Computers,OU=_Lab,DC=lab,DC=local"

# Now new domain-joined computers land in that OU automatically

Delegation lets you grant specific administrative permissions over an OU without giving full Domain Admin rights. This follows the principle of least privilege.

Common Delegation Scenarios

• Help Desk staff can reset passwords in the Users OU — but not in the Servers OU
• Department admins can create/modify users in their own OU
• A script account can only update specific attributes

# GUI: Right-click OU in ADUC → Delegate Control → Delegation of Control Wizard
# Select users/groups → select tasks (e.g., "Reset user passwords and force password change")

# PowerShell: Grant permission to reset passwords in an OU
$ou = "OU=IT,OU=_Lab,DC=lab,DC=local"
$helpdesk = [System.Security.Principal.SecurityIdentifier](Get-ADGroup "GG-HelpDesk").SID

# Use dsacls command for fine-grained delegation:
# Reset Password permission on user objects
dsacls $ou /G "$($helpdesk):CA;Reset Password;user" /I:S

# Unlock Account permission
dsacls $ou /G "$($helpdesk):CA;Change Password;user" /I:S

# GUI Method:
# 1. Right-click This PC → Properties → Change settings
# 2. Computer Name tab → Change
# 3. Select "Domain" → type domain name (lab.local)
# 4. Enter domain admin credentials
# 5. Restart

# PowerShell Method (faster, scriptable):
Add-Computer -DomainName "lab.local" -Credential (Get-Credential) -Restart -Force

# Join to domain AND move to specific OU in one step:
Add-Computer -DomainName "lab.local" `
  -OUPath "OU=Workstations,OU=Computers,OU=_Lab,DC=lab,DC=local" `
  -Credential (Get-Credential) `
  -Restart -Force

# Verify domain membership
(Get-WmiObject Win32_ComputerSystem).Domain

AD Sites and Services (dssite.msc) manages replication between DCs across physical locations (WAN links).

• Site — A collection of IP subnets representing a physical location with fast (LAN) connectivity
• Site Link — Defines the connection between sites, including cost (bandwidth indicator) and replication interval
• KCC (Knowledge Consistency Checker) — Automatically generates the replication topology within and between sites
• Replication interval — Default within a site: every 15 seconds. Between sites: configurable (default 180 minutes)

# Force immediate replication between DCs
repadmin /syncall /AdeP

# Check replication status across all DCs
repadmin /replsummary

# Show replication partners for this DC
repadmin /showrepl

# View replication queue (pending items)
repadmin /showreps

Certain AD operations must happen on exactly one DC at a time. These are called FSMO (flexible single master operations) roles.

# View which DC holds each FSMO role
netdom query fsmo

# PowerShell way
Get-ADDomain | Select-Object PDCEmulator, RIDMaster, InfrastructureMaster
Get-ADForest | Select-Object SchemaMaster, DomainNamingMaster

# Transfer a FSMO role (graceful transfer — old DC still online)
Move-ADDirectoryServerOperationMasterRole -Identity "SRV-DC02" -OperationMasterRole PDCEmulator

# Seize a FSMO role (use only if old DC is dead and cannot be recovered)
# ntdsutil → roles → connections → connect to server SRV-DC02 → quit → seize pdc

# Complete AD health check sequence
dcdiag /test:all /v > C:\Logs\dcdiag.txt
repadmin /replsummary > C:\Logs\repl.txt
netdom query fsmo

# Check for failed logons in Security log
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 20 |
  ForEach-Object {
    $xml = [xml]$_.ToXml()
    [PSCustomObject]@{
      Time = $_.TimeCreated
      Account = $xml.Event.EventData.Data[5].'#text'
      WorkstationName = $xml.Event.EventData.Data[13].'#text'
      FailureReason = $xml.Event.EventData.Data[8].'#text'
    }
  } | Format-Table -AutoSize