Install and Uninstall Active Directory Domain Services

This chapter is from the book

Active Directory Domain Services 2008 How-To

Learn More Buy

This chapter is from the book

This chapter is from the book 

Active Directory Domain Services 2008 How-To

Learn More Buy

IN THIS CHAPTER:

• Install a New Windows Server 2008 Forest
• Install a New Windows Server 2008 Child Domain
• Install a New Windows Server 2008 Domain Tree
• Install an Additional Windows Server 2008 Domain Controller
• Perform a Staged Installation of a Read-Only Domain Controller
• Install AD DS from Restored Backup Media
• Remove a Domain Controller from a Domain
• Forcing the Removal of a Windows Server 2008 Domain Controller
• Performing Metadata Cleanup
• Rename a Domain Controller

Active Directory Domain Services (AD DS) was introduced with the release of Windows 2000 Server and has been included in each subsequent release of the server operating system from Microsoft. The majority of companies have at least one AD DS forest deployed. However, some companies continue to deploy new AD DS forests for various reasons.

This chapter describes the steps required to install and uninstall Active Directory Domain Services.

Install a New Windows Server 2008 Forest

Solution: Installing a new Windows Server 2008 forest consists of promoting a Windows Server 2008 server to a domain controller. Thereafter, additional DCs and domains can be added to the new forest. The installation of a new Windows Server 2008 forest can be performed by using the Windows interface, the command line, and an answer file.

Install a New Forest by Using the Windows Interface

To install a new forest by using the Windows interface, perform the following steps using a local account that has membership in the following local group:

• Administrators

1. Log on to the server you want to promote to a domain controller.
2. Click Start and then click Server Manager.
3. In Roles Summary, click Add Roles.
4. On the Before You Begin page, click Next.

5. On the Select Server Roles page, shown in Figure 3.1, click the Active Directory Domain Services check box; then click Next.

   

   Figure 3.1 The Select Server Roles page.

6. On the Active Directory Domain Services page, click Next.
7. On the Confirm Installation Selections page, click Install.

8. On the Installation Results page, shown in Figure shown in Figure 3.2, verify that the installation succeeded and then click Close this wizard and launch the Active Directory Domain Services Installation Wizard (dcpromo.exe).

   

   Figure 3.2 The Installation Results page.

   TIP

   It is a best practice to assign a static IP address as opposed to a dynamic IP address on a domain controller. If you have not assigned a static IP address, now is the best time to do so. If you proceed with the steps that follow without assigning a static IP address, you will be presented with a warning during the AD DS installation process. You can accept the warning and proceed with the installation if desired.

9. On the Welcome to the Active Directory Domain Services Installation Wizard page, click Next.
10. On the Operating System Compatibility page, click Next.

11. On the Choose a Deployment Configuration page, shown in Figure 3.3, click Create a new domain in a new forest; then click Next.

    

    Figure 3.3 The Choose a Deployment Configuration page.

12. On the Name the Forest Root Domain page, shown in Figure 3.4, type the fully qualified domain name (FQDN) for the forest root domain and then click Next.

    

    Figure 3.4 The Name the Forest Root Domain page.

13. On the Set Forest Functional Level page, shown in Figure 3.5, select the forest functional level that meets your requirements and click Next.

    

    Figure 3.5 The Set Forest Functional Level page.

    NOTE

    Active Directory Domain Services functional levels control the available domain or forest advanced features. For example, a number of the new features introduced in Windows Server 2008 require a domain functional level of Windows Server 2008. Functional levels also control the operating systems that you can run on domain controllers. If your domain functional level is set to Windows Server 2008, you cannot have domain controllers that have Windows Server 2003 installed. Lastly, once you set or raise a functional level, you cannot change the functional level to a lower level.

    For more information on AD DS functional levels, go to http://technet.microsoft.com/en-us/library/cc754918.aspx.

14. If you set a forest functional level other than Windows Server 2008, the Set Domain Functional Level page displays, as shown in Figure 3.6. Select the domain functional level that meets your requirements and click Next.

    

    Figure 3.6 The Set Domain Functional Level page.

15. On the Additional Domain Controller Options page, shown in Figure 3.7, DNS Server is selected by default, which allows the DNS infrastructure to be created by the installation process. If you plan to use AD-Integrated DNS, click Next. If you plan to use an existing DNS infrastructure and do not want the domain controller to be a DNS server, clear the DNS Server check box and click Next.

    

    Figure 3.7 The Additional Domain Controller Options page.

16. If the wizard cannot create a delegation for the DNS server, it displays a message to indicate that you can create the delegation manually, as shown in Figure 3.8. To continue, click Yes.

    

    Figure 3.8 The manual DNS Delegation Message.

17. On the Location for Database, Log Files, and SYSVOL page, shown in Figure 3.9, type the volume and folder locations for the database file, the directory service log files, and the SYSVOL files; then click Next.

    

    Figure 3.9 The Location for Database, Log Files, and SYSVOL page.

18. On the Directory Services Restore Mode Administrator Password page, shown in Figure 3.10, type and confirm the restore mode password and then click Next.

    

    Figure 3.10 The Directory Services Restore Mode Administrator Password page.

19. On the Summary page, shown in Figure 3.11, click Next after you review your selections.

    

    Figure 3.11 The Summary page.

    TIP

    You can click the Export button to export the selections you made to an answer file, which can be used later for an unattended installation.

    The Active Directory Domain Services installation process starts, as shown in Figure 3.12.

    

    Figure 3.12 The Active Directory Domain Services Installation page.

20. After the installation is complete, the Completing the Active Directory Domain Services Installation Wizard page appears, as shown in Figure 3.13. Ensure the installation was successful and click Finish.

    

    Figure 3.13 The Completing the Active Directory Domain Services Installation Wizard page.

21. When prompted to restart, click Restart Now.
22. To validate the installation process, click Start, click Run, type C:\Windows\Debug, and click OK.
23. Open the DCPROMO.log file and analyze the results in the file.

Install a New Forest by Using the Command Line

Active Directory Domain Services can also be installed by using the command line. This is particularly useful when installing AD DS on a server that has a Server Core installation of Windows Server 2008.

The installation options when using the command line are the same as those used when installing AD DS using an unattended installation. When installing AD DS by using the command line, you type the installation options and parameters into the command line as opposed to an answer file, which is used for an unattended installation.

Table 3.1 lists the installation parameters used in the steps that follow and the corresponding action of each parameter.

Table 3.1. Installing a New Forest by Using the Command Line Installation Parameters

To install a new forest by using the command line, perform the following steps using a local account that has membership in the following local group:

• Administrators

1. Log on to the server you want to promote to a domain controller.
2. Click Start and then click Command Prompt.

3. Type the following into the command prompt window, as shown in Figure 3.14, and then press Enter:

   dcpromo /unattend /InstallDns:yes /dnsOnNetwork:no
   /replicaOrNewDomain:domain /newDomain:forest
   /newDomainDnsName:WS08Domain02.local
   /DomainNetbiosName:WS08Domain02 /databasePath:"c:\Windows\ntds"
   /logPath:"c:\Windows\ntds" /sysvolpath:"c:\Windows\sysvol"
   /safeModeAdminPassword:Today01! /forestLevel:2 /domainLevel:2
   /rebootOnCompletion:yes

   

   Figure 3.14 Installing a new forest using the command line.

   The dcpromo process begins by determining whether the AD DS binaries are installed. If the binaries are not installed, dcpromo installs them, as shown in Figure 3.15.

   

   Figure 3.15 Installing AD DS services binaries.

4. After the AD DS binaries have been installed, a summary of the installation options is presented in the command prompt window, as shown in Figure 3.16. Then the AD DS installation process begins.

   

   Figure 3.16 Installing AD DS.

5. The status of the AD DS installing is updated in the command prompt window, as shown in Figure 3.17.

   

   Figure 3.17 The installation’s progress.

6. When the installation process is complete, the server reboots automatically if the /rebootOnCompletion option was used in the command line. If the /rebootOnCompletion option was not used in the command line, you are prompted to restart the server.
7. To validate the installation process, click Start, click Run, type C:\Windows\Debug, and click OK.
8. Open the DCPROMO.log file and analyze the results in the file.

Install a New Forest by Using an Answer File

Active Directory Domain Services can also be installed using an answer file. This is useful when installing AD DS on a server that has a Server Core installation of Windows Server 2008.

Table 3.2 lists the installation parameters used in the steps that follow and the corresponding action of each parameter.

Table 3.2. Installing a New Forest by Using Answer File Installation Parameters

In order to install a new forest by using an answer file, perform the following steps using a local account that has membership in the following local group:

• Administrators

1. Log on to the server you want to promote to a domain controller.
2. Click Start, click Run, type notepad, and click OK.
3. On the first line, type [DCINSTALL], and then press ENTER.

4. Type the following entries, one entry on each line, as shown in Figure 3.18:

   InstallDNS=yes
   NewDomain=forest
   NewDomainDNSName=WS08Domain03.local
   DomainNetBiosName=WS08Domain03
   ReplicaOrNewDomain=domain
   ForestLevel=3
   DomainLevel=3
   DatabasePath="c:\Windows\ntds"
   LogPath="c:\Windows\ntds"
   RebootOnCompletion=yes
   SYSVOLPath="c:\Windows\sysvol"
   SafeModeAdminPassword=Today01!

   

   Figure 3.18 The answer file.

5. Save the answer file as C:\DCAnswer.txt.
6. Click Start and then click Command Prompt.

7. Type the following into the command prompt window, as shown in Figure 3.19, and then press Enter:

   dcpromo /unattend:"C:\DCAnswer.txt"

   

   Figure 3.19 Installing a new forest by using an answer file.

   The dcpromo process begins by determining whether the AD DS binaries are installed. If the binaries are not installed, dcpromo installs them.

8. After the AD DS binaries have been installed, a summary of the installation options is presented in the command prompt window; then the AD DS installation process begins. The status of the AD DS installing is updated in the command prompt window.
9. When the installation process is complete, the server reboots automatically if the /rebootOnCompletion option was used in the answer file. If the /rebootOnCompletion was not used in the answer file, you are prompted to restart the server.
10. To validate the installation process, click Start, click Run, type C:\Windows\Debug, and click OK.
11. Open the DCPROMO.log file and analyze the results in the file.