Task 01: Configure Active Directory Domain Services

DOCUMENT CATEGORY: Runbook SCOPE: AD DS installation and configuration PURPOSE: Establish the management domain for Azure Local infrastructure MASTER REFERENCE: Microsoft Learn - AD DS

Status: Active

---

Overview

This task installs Active Directory Domain Services on the primary DC (dc01), promotes it to a domain controller creating a new forest, then promotes the secondary DC (dc02) as a replica. Afterwards, the OU structure, security groups, and service accounts are configured.

Task Classification

Execution Target: Windows Server (on-VM configuration) Tab Profile: 4 tabs — Server Manager · Direct Script (On Node) · Orchestrated Script (Mgmt Server) · Standalone Script

VM Restarts Required

Promoting a server to a domain controller requires a reboot. The VM will restart automatically.

Configuration Summary

Setting	Value	Source
Domain FQDN	azrl.mgmt	active_directory.domain.fqdn
NetBIOS	MGMT	active_directory.ad_netbios_name
Forest Level	Windows Server 2025	Default
Domain Level	Windows Server 2025	Default
DSRM Password	Key Vault	keyvault://<vault>/recovery-admin-password
Primary DC	dc01	azure_vms.dc01.name
Replica DC	dc02	azure_vms.dc02.name

OU Structure

DC=azrl,DC=mgmt
└── OU=MGMT
 ├── OU=Computers
 ├── OU=Servers
 │ └── OU=AzureLocal
 │ └── OU=Clusters
 │ └── OU=azl-demo-clus01
 └── OU=ServiceAccounts

Prerequisites

• Management VMs deployed — dc01 and dc02 running (via CI/CD Pipeline or Manual Task 11)
• DSRM password stored in Key Vault
• Domain name confirmed in Planning & Discovery
• Bastion access to VMs verified

Variables from variables.yml

Variable	Config Path	Example (IIC)
Domain FQDN	active_directory.domain.fqdn	azrl.mgmt
NetBIOS Name	active_directory.ad_netbios_name	MGMT
Primary DC	azure_vms.dc01.name	vm-azrldc-azl-eus-01
Replica DC	azure_vms.dc02.name	vm-azrldc-azl-eus-02
DSRM Password	keyvault://<vault>/recovery-admin-password	(Key Vault)

---

Single Subscription Model

Landing Zone Placement

Field	Value	Config Path
Target VMs	dc01, dc02	azure_vms.dc01, azure_vms.dc02
Domain FQDN	azrl.mgmt	active_directory.domain.fqdn
NetBIOS	MGMT	active_directory.ad_netbios_name

Execution Options

Server Manager

Server Manager

When to use: Single deployment, prefer GUI-based configuration

Procedure — Primary DC (dc01)

1. Connect to dc01 via Bastion (Task 05)

2. Install AD DS Role:

• Server Manager → Add Roles and Features → Next through wizard
• Select Active Directory Domain Services
• Install prerequisites → Install

3. Promote to Domain Controller:

• Click notification flag → Promote this server to a domain controller | Field | Value | Source | |-------|-------|--------| | Deployment type | Add a new forest | — | | Root domain name | azrl.mgmt | active_directory.domain.fqdn | | Forest functional level | Windows Server 2025 | — | | Domain functional level | Windows Server 2025 | — | | DNS server | Checked | — | | Global Catalog | Checked | — | | DSRM password | From Key Vault | keyvault://<vault>/recovery-admin-password |

4. NetBIOS Name: Verify MGMT is auto-populated from active_directory.ad_netbios_name

5. Complete wizard → Server restarts automatically

Procedure — Replica DC (dc02)

6. Connect to dc02 via Bastion

7. Set DNS: Point dc02 primary DNS to dc01's IP (azure_vms.dc01.private_ip)

8. Install AD DS Role: Same as Step 2

9. Promote as Replica: | Field | Value | |-------|-------| | Deployment type | Add a domain controller to an existing domain | | Domain | azrl.mgmt | | Credential | Domain Admin from dc01 | | DNS server | Checked | | Global Catalog | Checked | | DSRM password | From Key Vault |

10. Server restarts automatically

Procedure — OU and Groups

11. Create OU Structure on dc01:

• Active Directory Users and Computers → Create OUs per the OU Structure diagram above

12. Create Security Groups: Create each group from active_directory.security_groups.*

13. Update VNet DNS: Update the VNet DNS servers to point to both DCs' private IPs

Validation

• Both DCs responding to dcdiag /v
• DNS resolution working for domain FQDN
• OU structure matches config
• Security groups created
• VNet DNS updated

Direct Script (On Node)

Direct Script (On Node)

When to use: Run directly on the VM via Bastion RDP session — no variables.yml access

Code — Primary DC (dc01)

# ============================================================================
# Script: Deploy-ADDSForest.ps1
# Execution: Run ON dc01 — standalone, no config file access
# Prerequisites: Windows Server with admin rights
# ============================================================================

#region CONFIGURATION
$DomainFqdn = "azrl.mgmt"
$NetBiosName = "MGMT"
$DsrmPassword = Read-Host -AsSecureString "Enter DSRM password"
#endregion CONFIGURATION

# Install AD DS Role
Install-WindowsFeature AD-Domain-Services -IncludeManagementTools -Restart:$false

# Promote to Domain Controller (new forest)
Import-Module ADDSDeployment
Install-ADDSForest `
 -DomainName $DomainFqdn `
 -DomainNetBiosName $NetBiosName `
 -ForestMode "WinThreshold" `
 -DomainMode "WinThreshold" `
 -InstallDns:$true `
 -SafeModeAdministratorPassword $DsrmPassword `
 -Force:$true

# Server will restart automatically

Code — Replica DC (dc02)

# ============================================================================
# Script: Deploy-ADDSReplica.ps1
# Execution: Run ON dc02 — standalone, no config file access
# ============================================================================

#region CONFIGURATION
$DomainFqdn = "azrl.mgmt"
$DomainAdmin = "MGMT\Administrator"
$DomainPassword = Read-Host -AsSecureString "Enter domain admin password"
$DsrmPassword = Read-Host -AsSecureString "Enter DSRM password"
#endregion CONFIGURATION

$Credential = New-Object PSCredential($DomainAdmin, $DomainPassword)

Install-WindowsFeature AD-Domain-Services -IncludeManagementTools -Restart:$false

Import-Module ADDSDeployment
Install-ADDSDomainController `
 -DomainName $DomainFqdn `
 -Credential $Credential `
 -InstallDns:$true `
 -SafeModeAdministratorPassword $DsrmPassword `
 -Force:$true

Orchestrated Script (Mgmt Server)

Orchestrated Script (Mgmt Server)

When to use: Run from management workstation via PSRemoting — reads variables.yml

Script

Primary: scripts/deploy/02-azure-foundation/phase-04-azure-management-infrastructure/task-12-configure-adds/powershell/New-DomainController.ps1

Code

# ============================================================================
# Script: New-DomainController.ps1
# Execution: Run from management workstation via PSRemoting
# Prerequisites: WinRM/PSRemoting access to dc01 and dc02
# ============================================================================

#Requires -Modules Az.KeyVault

param(
 [Parameter(Mandatory = $false)]
 [ValidateScript({Test-Path $_})]
 [string]$ConfigPath = "config/variables.yml"
)

$ErrorActionPreference = "Stop"
$scriptRoot = $PSScriptRoot

. "$scriptRoot/../../../../../common/utilities/helpers/config-loader.ps1"
. "$scriptRoot/../../../../../common/utilities/helpers/logging.ps1"
. "$scriptRoot/../../../../../common/utilities/helpers/keyvault-helper.ps1"

$config = Get-InfrastructureConfig -ConfigPath $ConfigPath

$DomainFqdn = $config.active_directory.domain.fqdn
$NetBios = $config.active_directory.ad_netbios_name
$DC01Ip = $config.azure_vms.dc01.private_ip
$DC02Ip = $config.azure_vms.dc02.private_ip
$KvName = $config.azure_infrastructure.key_vaults.management.name
$AdminUser = "azureadmin"

# Retrieve passwords from Key Vault
$AdminPwd = Get-KeyVaultSecret -SecretUri "keyvault://$KvName/azlocal-admin-password"
$DsrmPwd = Get-KeyVaultSecret -SecretUri "keyvault://$KvName/recovery-admin-password"

$SecAdminPwd = ConvertTo-SecureString $AdminPwd -AsPlainText -Force
$SecDsrmPwd = ConvertTo-SecureString $DsrmPwd -AsPlainText -Force
$localCred = New-Object PSCredential($AdminUser, $SecAdminPwd)

# ── Promote dc01 as new forest ──
Write-LogInfo "Promoting dc01 ($DC01Ip) as new forest: $DomainFqdn"
Invoke-Command -ComputerName $DC01Ip -Credential $localCred -ScriptBlock {
 param($DomainFqdn, $NetBios, $DsrmPwd)
 Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
 Import-Module ADDSDeployment
 Install-ADDSForest -DomainName $DomainFqdn -DomainNetBiosName $NetBios `
 -ForestMode "WinThreshold" -DomainMode "WinThreshold" `
 -InstallDns:$true -SafeModeAdministratorPassword $DsrmPwd -Force:$true
} -ArgumentList $DomainFqdn, $NetBios, $SecDsrmPwd

Write-LogInfo "Waiting for dc01 to restart and AD to initialize..."
Start-Sleep -Seconds 180

# ── Promote dc02 as replica ──
$domainCred = New-Object PSCredential("$NetBios\Administrator", $SecAdminPwd)

Write-LogInfo "Promoting dc02 ($DC02Ip) as replica DC"
Invoke-Command -ComputerName $DC02Ip -Credential $localCred -ScriptBlock {
 param($DomainFqdn, $DomainCred, $DsrmPwd)
 Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
 Import-Module ADDSDeployment
 Install-ADDSDomainController -DomainName $DomainFqdn -Credential $DomainCred `
 -InstallDns:$true -SafeModeAdministratorPassword $DsrmPwd -Force:$true
} -ArgumentList $DomainFqdn, $domainCred, $SecDsrmPwd

Write-LogSuccess "Both DCs promoted for domain: $DomainFqdn"

Standalone Script

Standalone Script

When to use: Full end-to-end script — self-contained with PSRemoting. Edit variables and run.

Code

# ============================================================================
# Script: Configure-ADDS-Standalone.ps1
# Execution: Run from any machine with PSRemoting to the DCs
# ============================================================================

#region CONFIGURATION
$DC01Ip = "10.250.1.36"
$DC02Ip = "10.250.1.37"
$DomainFqdn = "azrl.mgmt"
$NetBios = "MGMT"
$AdminUser = "azureadmin"
$AdminPwd = Read-Host -AsSecureString "VM admin password"
$DsrmPwd = Read-Host -AsSecureString "DSRM password"
#endregion CONFIGURATION

$localCred = New-Object PSCredential($AdminUser, $AdminPwd)

# Promote dc01
Write-Host "Promoting dc01 as new forest: $DomainFqdn" -ForegroundColor Cyan
Invoke-Command -ComputerName $DC01Ip -Credential $localCred -ScriptBlock {
 param($dn,$nb,$dsrm)
 Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
 Import-Module ADDSDeployment
 Install-ADDSForest -DomainName $dn -DomainNetBiosName $nb -ForestMode "WinThreshold" -DomainMode "WinThreshold" -InstallDns:$true -SafeModeAdministratorPassword $dsrm -Force:$true
} -ArgumentList $DomainFqdn,$NetBios,$DsrmPwd

Write-Host "Waiting 3 min for dc01 restart..." -ForegroundColor Yellow
Start-Sleep -Seconds 180

# Promote dc02
$domainCred = New-Object PSCredential("$NetBios\Administrator", $AdminPwd)
Write-Host "Promoting dc02 as replica" -ForegroundColor Cyan
Invoke-Command -ComputerName $DC02Ip -Credential $localCred -ScriptBlock {
 param($dn,$dc,$dsrm)
 Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
 Import-Module ADDSDeployment
 Install-ADDSDomainController -DomainName $dn -Credential $dc -InstallDns:$true -SafeModeAdministratorPassword $dsrm -Force:$true
} -ArgumentList $DomainFqdn,$domainCred,$DsrmPwd

Write-Host "Both DCs promoted" -ForegroundColor Green

No External Dependencies

Self-contained. Edit #region CONFIGURATION and run from a machine with PSRemoting to DCs.

Validation

• Both DCs healthy: dcdiag /v passes all tests
• DNS resolution: Resolve-DnsName azrl.mgmt
• Replication: repadmin /replsummary shows 0 failures
• OU structure created per config
• Security groups present

---

CAF/WAF Landing Zone Model

AD DS configuration is identical regardless of landing zone model — it runs on the VMs in the Management subscription.

Landing Zone Placement

Field	Value	Config Path
Subscription	Management subscription	azure.subscriptions.management.id
Target VMs	dc01, dc02 in spoke VNet	azure_vms.dc01, azure_vms.dc02

Execution Options

The execution is the same as Single Subscription — the scripts run on the VMs regardless of which subscription they reside in. Use Bastion from the Connectivity subscription to access the VMs.

---

Troubleshooting

Issue	Root Cause	Remediation
Promotion fails — DNS error	VNet DNS not pointing to dc01	Set VNet DNS to dc01 IP before promoting dc02
Replication failure	Firewall between DCs	Ensure NSG allows all traffic between DC IPs
DSRM password rejected	Complexity requirements	Use 12+ characters with mixed case, numbers, symbols
dc02 cannot find domain	DNS not resolving dc01	Set dc02 primary DNS to dc01 private IP
OU creation fails	Insufficient permissions	Run as Domain Admin on dc01

---

Navigation

Previous	Up	Next
VM Configuration Overview	Phase 04: Management Infrastructure	Task 02: Configure Utility Server

---

Version Control

• Created: 2025-09-15 by Hybrid Cloud Solutions
• Last Updated: 2026-03-20 by Hybrid Cloud Solutions
• Version: 5.0.0
• Version: 4.0.0
• Tags: azure-local, active-directory, domain-controller, identity
• Keywords: AD DS, Active Directory, domain controller, DSRM, forest, DNS, OU structure
• Author: Hybrid Cloud Solutions