- Introduction
- Windows Clustering 101
- Forest Creation Process
- Installation
- Installation of Root Domain
- Quality Assurance
- Forest Preparation, DNS, and Exchange
- Installation of Bridgehead Servers and the Child Domain
- Installing DHCP and WINS Services
- Patching and Updating Domain Controllers
- Exchange Domain Preparation
- Creation of Initial Service and Administration Resources
- Clustering
- Time-Out
This chapter is from the book
This chapter is from the book
This chapter is from the book
Installation of Root Domain
This section covers the promotion of the root domain controllers. By promoting root domain controllers, we are, in fact, creating the forest in which all future high-availability systems will be installed (see Chapter 5 for the discussion of the dual domain [root-and-child] model). The prerequisite to this process is installation of the operating system (Windows Server 2003, Standard Edition) to the domain controller computers on a RAID-1 array. See Chapter 4 for instructions on the configuration of RAID-1 on this server. The servers should be configured for second and third RAID-5 arrays as required.
It is critical this process completes and proceeds as described herein. Deviation from the process or shortcuts may render the root domain useless and it will have to be rebuilt. The updating of the domain controller servers with the required software updates and security patches can take place after promotion, QA, and validation. (See Chapter 5 for the overall architecture this implementation supports.)
Process
Name the Root Domain DCs. Upon completion of the server installations, the root domain controllers will be given miscellaneous names, and they will be a member of the workgroup setup on the support server. Change the names of the root domain controllers to the names provided in your Active Directory Architecture (discussed in Chapter 5). For the corporate hub, the server names we use here are HQRDC01 and HQRDC02 (for later implementation).
It is important to remember to rename the servers to their DC names prior to running DC promo. The names cannot be changed after promotion of these servers to domain controllers, and they have to be destroyed if the names are incorrect. Do not change the workgroup when changing the names.
Configure TCP/IP on HQRDC01. Log on as Administrator to the server designated to become the root DC (HQRDC01). Open the TCP/IP properties of the network interface card (NIC), and enter the parameters listed in Table 6.4.
Table 6.4 TCP/IP Configuration on HQRDC01 Support Server
|
Resources (RDC01) |
Configuration |
|
IP |
10.10.20.21 |
|
Subnet Mask |
255.255.252.0 |
|
Default Gateway |
10.10.20.1 |
|
Preferred DNS |
10.10.20.21 |
|
Alternate |
<null> |
Configure TCP/IP on HQRDC02. Log on as Administrator to the server designated to become the root DC (RDC02). Open the TCP/IP properties of the NIC, and enter the parameters listed in Table 6.5.
Table 6.5 TCP/IP Configuration on UVRDC02 Support Server
|
Resources (HQRDC02) |
Configuration |
|
IP |
10.10.20.24 |
|
Subnet Mask |
255.255.252.0 |
|
Default Gateway |
10.10.20.1 |
|
Preferred DNS |
10.10.20.24 |
|
Alternate |
<null> |
To install DNS, do as follows:
Log on as Administrator to the server designated to become the root DC (HQRDC01) and install DNS on this server. This is achieved by opening Control Panel, Add or Remove Programs, and Add/Remove Windows Components. This launches the Windows Components Wizard.
Select Networking Services in the wizard and click the Details button. In the Networking Services dialog box, check the option to install Domain Name System (DNS).
Complete the procedures and, when prompted by the installation procedure for the Windows Server operating system CD, provide a CD or browse to the I386 folder under the STDINST share (the source for OS installation files) on the installation or support server.
Complete the process to install DNS on the server. Repeat the process for all hub root domain controllers.
Now you can create the Forest Root Zone on HQRDC01. To create the forest root zone, perform the following steps (note: this process is not repeated on HQRDC02 or any other root server destined to become a DC):
Start DNS and right-click on the HQRDC01 icon.
Select New Zone. The New Zone Wizard launches. Click Next.
Select the option to create a Primary zone and click Next.
Select Forward Lookup zone and click Next.
Enter the domain name (such as MCITY.CTY) as the name of the zone and click Next.
Keep the default DNS file name (it should be MCITY.CTY. dns) for the zone file name and click Next.
If prompted for Dynamic Update configuration, choose the option to allow Dynamic Updates. Click Next.
Complete the process by selecting Finish.
Create the Reverse Lookup Zone on HQRDC01. To create the reverse lookup zone for the forest, perform the following steps:
Open the DNS console and expand the HQRDC01 server icon.
Select Reverse Lookup Zones and click on New Zone. The New Zone Wizard launches.
Select options for a Primary non-integrated zone and click Next.
Enter the IP address range for the zone; this is the 10.10.20.X network.
Click Next and select the options to enable dynamic update.
Complete the process by selecting Finish.
Create the Forest Root Domain Controller on HQRDC01. To create the forest root domain, perform the following steps:
Click Start, Run, and type DCPROMO on HQRDC01.
Choose the options for creating a root domain controller in a new forest.
Choose the root domain name as the full DNS name for the new domain (MCITY.CTY).
Accept the default NetBIOS name for the domain.
Choose the default path for the SYSVOL folder on the RAID-5 array. However, the drive letter should point to the RAID-5 array on (D, E, or F) and not C:\ (for example E:\Windows\...). Choose the path options provided for the NTDS Active Directory database and its log files, changing only the drive letters to point to the RAID 5.
Accept permissions compatible with Windows 2000 and Windows Server 2003.
Enter the Directory Services Restore Mode Administrator password (this should be a complex password, choose something like 4NTDS@mcity), ignoring the quotes. (Remember the server's local Administrator password becomes the password required to log on to the DC after promotion.)
Review the settings, and click Finish to begin the process. Restart the server when prompted.
Enable Active Directory Integration of the Forest Root Zone and the Reverse Lookup Zone. To enable AD integration for the root zone, do as follows:
Open the DNS console and expand the root server HQRDC01 icon.
Expand the Forward Lookup Zones folder and select the MCITY.CTY zone. Right-click this zone and select Properties.
The Properties dialog box for MCITY opens. On the General tab, select the Change button on the Type option. The Change Zone Type dialog box launches.
Select the option to change the zone to Active Directory Integrated and click OK.
Perform the same procedure on the Reverse Lookup Zone folder. Verify HQRDC01 Name Registration. To verify name registration, perform the following actions:
Open the DNS console and expand the root server HQRDC01 icon.
Expand the Forward Lookup Zones folder and select the MCITY.CTY zone.
Verify whether _msdcs, _sites, _tcp, and _udp sub-domains are registered under MCITY.CTY.
If these sub-domains are not registered, then start a command prompt and type NET STOP NETLOGON. Wait for the service to stop and then type NET START NETLOGON.
Repeat steps 1 through 3 to verify the registration.
Verify the Reverse Lookup Zone has replicated.
Verify DNS name resolution on HQRDC02. Before HQRDC02 can be promoted as a root DC, DNS first must be verified. This can be achieved as follows:
-
Log on to HQRDC02 as the Administrator.
-
Open the command prompt and type NSLOOKUP MCITY. CTY and press Enter. You should see the following result:
C:\>nslookup MCITY.CTY
Server: HQRDC01.MCITY.CTY
Address: 10.10.20.21
Name: MCITY.CTY
Address: 10.10.20.21
If you do not see this, check to see whether the IP settings on HQRDC02 are correct. It should have HQRDC01 (10.10.20.21) as its preferred DNS server. Do not proceed with DCPROMO of HQRDC02 until DNS is working properly.
Perform DCPROMO on the server HQRDC02. To create the second domain controller, perform the following steps:
Click Start, Run, and type DCPROMO on HQRDC02.
Choose the options for creating an additional domain controller for an existing domain and click Next.
You are prompted for access to the root domain. Choose the Administrator account because this account has Enterprise Administrator credentials. See the previous steps for account and password information.
Choose the default path for the SYSVOL folder on the RAID-5 array. However, the drive letter should point to the RAID-5 array on (D, E, or F) and not C:\. Choose the path options provided for the NTDS Active Directory database and its log files, changing only the drive letters to point to the RAID 5 volume as previously mentioned (see Chapter 4).
Enter the Directory Services Restore Mode Administrator password for this server (this should be a complex password; choose 4NTDS@MCITY). DCs can and should have the same Directory Services Restore Mode Administrator password to simplify administration.
Review the settings and then click Finish to begin the process. Restart the server when prompted. Verify HQRDC02 Name Registration. To verify name registration, perform the following actions:
Open the DNS console and expand the root server HQRDC02 icon.
Expand the Forward Lookup Zones folder and select the MCITY.CTY zone.
Verify whether _msdcs, _sites, _tcp, and _udp sub-domains are registered under MCITY.CTY.
If the sub-domains are not registered, then start a command prompt and type NET STOP NETLOGON. Wait for the service to stop and then type NET START NETLOGON.
Repeat steps 1 through 3 to verify the registration.
Verify the Reverse Lookup Zone has replicated. Update the Preferred DNS Parameters on HQRDC01. Log on to HQRDC01 and open the TCP/IP properties for the NIC. Change the preferred DNS server from 10.10.20.21 to 10.10.20.24.
Create Automated System Recovery (ASR) media for the domain controllers. The creation of the root domain and promotion of the first domain controllers is now complete. System recovery using ASR media now must be performed on the domain controllers. After the ASR disks have been created, you can start the QA discussed in the next section.