Active Directory Domain Services

Active Directory® Domain Services (AD DS) stores information about users, computers, and other resources on a network. AD DS helps administrators manage this information securely. It also facilitates resource sharing and collaboration among users. AD DS is required for directory-enabled applications, such as Microsoft® Exchange Server, and for other Windows Server® technologies, such as Group Policy.

Note

AD DS requires a Domain Name System (DNS) server to be installed on the network. If you do not have a DNS server available for name resolution in the domain, you will be prompted to install the DNS server role on this server.

The following topics provide information about using the Active Directory Domain Services Installation Wizard and about implementing common configurations of AD DS:

  • Overview of the Active Directory Domain Services Installation Wizard

  • Installing Active Directory Domain Services

  • Performing a Staged Installation of a Read-Only Domain Controller

  • Removing Active Directory Domain Services

  • Unattended Installation Return Codes

  • Common Configurations for Active Directory Domain Services

Before you install AD DS, be sure that you have planned how AD DS will be deployed on your network, including DNS server support for AD DS. For more information about planning your AD DS deployment, see Planning and Architecture: AD DS (http://go.microsoft.com/fwlink/?LinkId=93715).


Overview of the Active Directory Domain Services Installation Wizard

You can use the Active Directory Domain Services Installation Wizard to install and configure Active Directory Domain Services (AD DS) on a server. When you install AD DS on a server, that server becomes a domain controller.

Note

When you click a link to open a Help topic for the wizard, the Help topic remains on top of the wizard page. You can resize and reposition the Help topic to continue working in the wizard.

The Active Directory Domain Services Installation Wizard provides a user interface (UI) for gathering information about your computing environment. It also checks prerequisites for installing AD DS, such as available disk space and the version of the operating system, to ensure that the server is capable of becoming a domain controller. If all the prerequisites are met, the wizard uses the information that it gathers to configure AD DS.

You can also use the wizard to remove AD DS from a domain controller. In this case, the wizard detects that AD DS is already installed on the server and it prompts you for information that is needed to uninstall AD DS.


Installing Active Directory Domain Services

There are three ways in which you can add the Active Directory domain controller server role to a server:

  • You can add the role interactively by using the Active Directory Domain Services Installation Wizard. The rest of this topic explains how to start the wizard, and it provides links to additional topics that explain the options that are available on each wizard page.

  • You can perform an unattended installation by running the dcpromo /unattend command with the appropriate parameters at the command line. For more information, see Installing an Additional Domain Controller by Using the Command Line (http://go.microsoft.com/fwlink/?LinkId=128100).

  • You can automate the installation by using an answer file. For more information, see Installing an Additional Domain Controller by Using an Answer File (http://go.microsoft.com/fwlink/?LinkId=128101).

You can add the Active Directory domain controller server role interactively by starting the Active Directory Domain Services Installation Wizard in the following ways:

  • You can use the Add Roles Wizard. You can access the Add Roles Wizard in the following ways:

    • Click Add Roles in Initial Configuration Tasks, the application that appears when you first install the operating system.

    • Click Add Roles in Server Manager, which is always available on the Administrative Tools menu and through an icon in the notification area.

    The Add Roles Wizard installs the files that are required to install and configure Active Directory Domain Services (AD DS) on a server, but the Add Roles Wizard does not start the actual AD DS installation. When you complete the Add Roles Wizard, click the link to start the Active Directory Domain Services Installation Wizard and install AD DS.

  • You can click Start, click Run, and then type dcpromo. As an alternative, you can type dcpromo at a command prompt, as in previous versions of the Windows Server operating system.

  • A member of the Domain Admins group can precreate a read-only domain controller (RODC) account by using the Active Directory Users and Computers snap-in. (Either right-click the Domain Controllers container or click the Domain Controllers container and click Action, and then click Pre-create Read-only Domain Controller account.) A delegated RODC administrator can perform the next stage of the RODC installation by running the Active Directory Domain Services Installation Wizard on a server to attach that server to the RODC account. For more information about using this method to install an RODC, see Performing a Staged Installation of a Read-Only Domain Controller.

The following topics provide more information about specific wizard pages that you might encounter when you install AD DS:

  • Using Advanced Mode Installation

  • Choosing a Computer Name for the Domain Controller

  • Configuring TCP/IP and DNS Client Settings

  • Choosing an Active Directory Domain Services Deployment Configuration

  • Providing Network Credentials to Install or Remove Active Directory Domain Services

  • Configuring Additional Domain Controller Options

  • Creating or Updating a DNS Delegation

  • Setting the Domain or Forest Functional Level

  • Placing Active Directory Domain Services Files

  • Installing from Media

  • Selecting an Installation Partner for Active Directory Domain Services

  • Providing a Directory Services Restore Mode Administrator Password

  • Using an Answer File

  • Manually Configuring a DNS Server for Active Directory Domain Services Integration


Using Advanced Mode Installation

Some wizard pages in the Active Directory Domain Services Installation Wizard appear only if you select the Use advanced mode installation check box on the Welcome to the Active Directory Domain Services Installation Wizard page of the wizard.

Advanced mode installation provides experienced users with more control over the installation process, without confusing newer users with configuration options that may not be familiar. For users who do not select the Use advanced mode installation check box, the wizard uses default options that apply to most configurations.

The Use advanced mode installation option on the Welcome page of the wizard is an alternative to running dcpromo at a command prompt with the /adv switch (dcpromo /adv).

The following table lists the additional wizard pages that appear for each deployment configuration when you select the Use advanced mode installation check box.

Deployment configuration | Advanced mode installation wizard pages
New forest | Domain NetBIOS name
New domain in an existing forest | On the Choose a Deployment Configuration page, the option to create a new domain tree appears only in advanced mode installation. Domain NetBIOS name Source Domain Controller
Additional domain controller in an existing domain | Install from Media Source Domain Controller Specify Password Replication Policy (for RODC installation only)
Create an account for a read-only domain controller (RODC) installation | Specify Password Replication Policy
Attach a server to an account for an RODC installation | Install from Media Source Domain Controller


Choosing a Computer Name for the Domain Controller

If the name of the server where you plan to install Active Directory Domain Services (AD DS) does not conform to Domain Name System (DNS) specifications, the Active Directory Domain Services Installation Wizard displays a warning. The warning states that you must rename the server or, if you retain the nonconforming name, that you must use a Microsoft DNS server so that clients can locate the server. However, the warning does not prevent you from installing AD DS successfully on this server to make it a domain controller. You can continue to install AD DS on this server and then correct its DNS configuration after the installation is complete.

For this domain controller to be discovered by other domain members and domain controllers, the DC Locator DNS records must be added to DNS. It is strongly recommended that your DNS infrastructure allow dynamic updates of DC Locator DNS records. However, your DNS administrator may add these records manually after the installation is complete and the domain controller is restarted. These records are listed in the following location:

%systemroot%\system32\config\netlogon.dns

You will receive the warning for a nonconforming DNS name if the name of the server contains one or more of the following invalid characters:

{ | } ~ [ \ ] ^ ' : ; < = > ? @ ! " # $ ^ ` ( ) + / , * or a space

Valid characters for a computer name include all uppercase letters (A through Z), lowercase letters (a through z), numbers (0 through 9), and hyphens (-).

To resolve this problem, exit the wizard, rename the computer, and then restart the wizard.

Renaming your computer

You can use the following procedure to rename your computer.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To rename your computer

  1. Click Start, right-click Computer, and then click Properties.

  2. Under Computer name, domain, and workgroup settings, click Change settings.

  3. On the Computer name tab, click Change.

  4. In Computer name, type the new name for the computer, and then click OK.

  5. When you are prompted, restart your computer.

Additional considerations

  • A computer joining a domain must use the name that was created for it by the network administrator, unless you have a user name and password with rights to create computer accounts.

  • If you supply a valid user name and password for a domain, the domain membership will be updated automatically with the new computer name.

  • Computer names that are 15 characters or less are recommended. If your computer has TCP/IP installed, the computer name can be up to 63 characters long. However, it should contain only the numbers 0 through 9, the letters A through Z and a through z, and hyphens. You may use other characters, but doing so may prevent other users from finding your computer on the network. If your network is using a Microsoft DNS server, you can use any characters except periods. If other networking protocols are installed without TCP/IP, the name is limited to 15 characters.

    Before you use additional characters, consider the following issues:

    • Some non-Microsoft resolver software supports only the characters that are listed in Request for Comments (RFC) 1123. If you have any non-Microsoft resolver software, that software is probably not able to look up computers with names that have nonstandard characters.

    • A DNS server that does not support UTF-8 encoding might accept a zone transfer of a zone containing UTF-8 names, but it cannot write back those names to a zone file or reload those names from a zone file. Therefore, you must not transfer a zone that contains UTF-8 characters to a DNS server that does not support them.

  • If you specify a computer name that is longer than 15 characters and you want longer names to be recognized by the Active Directory domain, the domain administrator must enable registration of DNS names that are 16 bytes or longer.

  • If your computer is a member of a workgroup, no networking is installed (or TCP/IP is not installed), the computer name cannot be more than 15 characters, and the characters must all be uppercase.


Configuring TCP/IP and DNS Client Settings

Active Directory Domain Services (AD DS) relies on properly configured TCP/IP and Domain Name System (DNS) client settings to function. You have to configure these settings on the IP version 4 (IPv4) and IP version 6 (IPv6) properties for all the physical network adapters for the server that will become the domain controller. The Active Directory Domain Services Installation Wizard detects whether any TCP/IP or DNS client settings are not properly configured. The wizard does not proceed with the installation until the settings are correct.

For TCP/IP, this means that each of the physical network adapters for the domain controller must be assigned a valid IP address. You should always use a static IP address for each network adapter so that clients can continue to locate the domain controller if the Dynamic Host Configuration Protocol (DHCP) server or the DHCP service is not available or if the domain controller is assigned a different IP address by the DHCP server in the future.

Configuring TCP/IP and DNS Client Settings

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To configure TCP/IP and DNS client settings

  1. On the Initial Configuration Tasks page that appears when you first start the server, under Provide Computer Information, click Configure networking.

    Or

    1. Click Start, click Control Panel, and then click View network status and tasks.

    2. Click Change adapter settings.

  2. Right-click Local Area Connection, and then click Properties.

  3. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.

  4. In the Local Area Connection Properties dialog box, click Internet Protocol Version 4 (TCP/IPv4) or Internet Protocol Version 6 (TCP/IPv6) as necessary, and then click Properties.

  5. Click Use the following IP address, and then type the static IP address for the server.

  6. Click Use the following DNS server addresses, and then type the IP address for the preferred DNS server and, if one is available, the alternate DNS server.

    If you plan to install the DNS server role on the server, specify the IP address of this server as the preferred DNS server.


Choosing an Active Directory Domain Services Deployment Configuration

When you install Active Directory Domain Services (AD DS), you choose one of the following possible deployment configurations:

  • Adding a new domain controller to a domain

  • Adding a new child domain to a forest, or, as an option, adding a new domain tree

    Note

    The option to install a new domain tree appears only if you select the Use advanced mode installation check box on the Welcome to the Active Directory Domain Services Installation Wizard page of the Active Directory Domain Services Installation Wizard.

  • Creating a new forest

The following sections describe each of these deployment configurations in detail.

Adding a new domain controller to a domain

If you already have one domain controller in a domain, you can add additional domain controllers to the domain to improve the availability and reliability of network services. Adding additional domain controllers can help provide fault tolerance, balance the load of existing domain controllers, and provide additional infrastructure support to sites.

More than one domain controller in a domain makes it possible for the domain to continue to function if a domain controller fails or must be disconnected. Multiple domain controllers can also improve performance by making it easier for clients to connect to a domain controller when they log on to the network.

Preparing an existing domain

Before you add a domain controller running Windows Server 2008 R2 to an existing Active Directory domain, you have to prepare the forest and the domain by running Adprep.exe. Be sure to run the version of Adprep that is included with your Windows Server 2008 R2 installation media. This version of Adprep adds schema objects and attributes that are required by domain controllers that run Windows Server 2008 R2, and it modifies permissions on new and existing objects.

Run the following adprep parameters as necessary for your environment:

  • Run adprep /forestprep once on the domain controller in the forest that holds the schema operations master role (the schema master) before you add a domain controller that runs Windows Server 2008 R2. To run this command, you must be a member of the Enterprise Admins group, the Schema Admins group, and the Domain Admins group of the domain that includes the schema master.

  • In addition, run adprep /domainprep /gpprep once on the domain controller that holds the infrastructure operations master role (the infrastructure master) in each domain in which you plan to add a domain controller that runs Windows Server 2008 R2. To run this command, you must be a member of the Domain Admins group.

  • If you plan to deploy a read-only domain controller (RODC) in any domain in the forest, you also must run adprep /rodcprep once in the forest. You can run this command on any computer in the forest. To run this command, you must be a member of the Enterprise Admins group. For more information, see Prepare a Forest for a Read-Only Domain Controller (http://go.microsoft.com/fwlink/?LinkId=93244).

Installing from media

When you install a new domain controller in an existing domain, you can choose to install from media (IFM), in which the domain database is copied from the media rather than over the network. This option is available in the Active Directory Domain Services Installation Wizard only if you select the Use advanced mode installation check box on the Welcome page. The recommended tool for creating the installation media is the ntdsutil ifm subcommand. For more information about using IFM, see Installing from Media.

Adding a new domain to a forest

By default, the new forest that you create will contain one domain, which is known as the forest root domain. This single domain can accommodate thousands of users even if only a small amount of network bandwidth is available for Active Directory replication. Therefore, a single domain is typically sufficient for most small organizations and medium-sized organizations. Adding more domains to the forest greatly increases the administration requirements for the forest.

Larger organizations, however, may decide to add child domains to the forest so that domain data is replicated only where it is needed. A child domain shares a contiguous namespace with its parent domain. For example, sales.contoso.com is a child domain of contoso.com. A child domain automatically has a two-way, transitive trust with its parent domain.

A new domain that does not share a contiguous namespace with its parent domain is known as a new domain tree. For more information about creating a new domain tree, see Creating a new domain tree later in this topic.

When you add domains to the forest, you are partitioning AD DS, which allows data to be replicated only where it is needed. In this way, a single Active Directory forest can scale globally to accommodate hundreds of thousands—or even millions—of users on a network that has limited bandwidth.

Requirements for creating a new domain

When you create a new child domain, you must be a member of the Domain Admins group in the parent domain or the Enterprise Admins group to proceed. When you create a new domain tree, you must be a member of the Enterprise Admins group.

The Active Directory Domain Services Installation Wizard allows Active Directory domain names up to 64 characters or up to 155 bytes. Although the limit of 64 characters is usually reached before the limit of 155 bytes, the opposite could be true if the name contains Unicode characters that consume three bytes. These limits do not apply to computer names.

During installation, a Domain Name System (DNS) zone delegation is created by Dcpromo.exe. If DNS zone delegation creation fails or you choose not to create it (which is not recommended), you must create a zone delegation manually. For more information about creating a zone delegation, see Creating or Updating a DNS Delegation.

Before you can add a domain to a forest, a DNS delegation must be created for the DNS zone that matches the name of the Active Directory domain that you are adding. The Active Directory Domain Services Installation Wizard verifies that the DNS delegation exists. If it does not exist, the wizard provides an option to create the DNS delegation automatically during the creation of the new domain.

Creating a new domain tree

You should create a new domain tree only when you need to create a domain whose DNS namespace is not related to the other domains in the forest. This means that the name of the tree root domain (and any child domain below it) does not have to contain the full name of the parent domain.

For example, treyresearch.net can be a domain tree in the contoso.com forest. New domain trees are most commonly created as part of a business acquisition or a merger of multiple organizations. A forest can contain one or more domain trees.

Before you create a new domain tree, consider creating another forest when you want a different DNS namespace. Multiple forests provide administrative autonomy, isolation of the schema and configuration directory partitions, separate security boundaries, and the flexibility to use an independent namespace design for each forest.

Creating a new forest

To create a new forest, you must be a member of the local Administrators group on the server where you are installing AD DS.

DNS and NetBIOS names

Before you create a new forest, be sure that you have completely planned your DNS infrastructure. To create a new forest, you must know the full DNS name for it. You can install the DNS Server service before you install AD DS or, preferably, you can choose to have the Active Directory Domain Services Installation Wizard install the DNS Server service for you.

If you have the wizard install the DNS Server service, the wizard uses the DNS name that you provide to automatically generate a NetBIOS name for the first domain in the forest. The wizard verifies that the DNS name and the NetBIOS name are unique on the network before it continues. You must select the Use advanced mode installation check box on the Welcome to the Active Directory Domain Services Installation Wizard page to specify a different NetBIOS name than the name that is generated automatically by the wizard.

Note

The Domain NetBIOS Name wizard page also appears if the automatically generated NetBIOS name conflicts with an existing name.

By default, the DNS Server service is installed on the first domain controller in a forest. If you already have a DNS infrastructure set up to support name resolution for the new forest, you can clear the DNS server check box on the Additional Options wizard page. However, if you do not have a supporting DNS infrastructure already in place, accept the default setting to have the wizard install the DNS Server service on the first domain controller in the forest.

When you click Next to continue, the Active Directory Domain Services Installation Wizard examines your existing DNS infrastructure. If you cleared the DNS server check box, the wizard performs diagnostic tests to verify that the supporting DNS infrastructure is in place. If the diagnostic tests fail, you again have the option to install the DNS Server service by using the wizard.

Functional levels

For a new forest, the default forest functional level is Windows 2000 and the domain functional level is Windows 2000 native. These are the lowest possible functional levels, and they allow domain controllers to run Windows Server 2003, Windows® 2000 Server, Windows Server 2008, or Windows Server 2008 R2.

If you do not plan to add domain controllers that run these earlier versions of Windows Server, select higher functional levels to enable advanced features. If you select Windows Server 2008 R2 as the forest functional level, all domains that are subsequently added to the forest will be created at the Windows Server 2008 R2 domain functional level. Therefore, the Set Domain Functional Level page does not appear in the Active Directory Domain Services Installation Wizard. If you select a different forest functional level, you can set the domain functional level independently for each domain in the forest. For more information about functional levels, see Setting the Domain or Forest Functional Level.

Operations master roles

The first domain controller for this domain hosts all the operations master roles (also known as flexible single master operations or FSMO) for the forest.

Additional domain controllers in the domain are recommended to improve the availability and fault tolerance of AD DS. After you create additional domain controllers, you may want to transfer some of the operations master roles that are hosted on the first domain controller to these other domain controllers. If you plan to create a multidomain forest and any domain controller in your forest root domain will not be a global catalog server, then you should transfer at least the infrastructure master role in the forest root domain to another domain controller in the domain that is not a global catalog server.

For more information about managing operations master roles, see Ensure Successful Active Directory Operations by Managing Operations Master Roles.


Providing Network Credentials to Install or Remove Active Directory Domain Services

When you install Active Directory Domain Services (AD DS), you must provide credentials that correspond to a domain user account that has sufficient privileges for the deployment configuration that you choose for the domain controller, such as a new forest, a new domain, or an additional domain controller for an existing domain. The Active Directory Domain Services Installation Wizard also examines the credentials that you provide to determine the forest where the domain controller will be installed.

If the credentials for the user account with which you are currently logged on (or the alternate credentials that you provide) indicate the target forest for the domain controller that you are installing, the wizard automatically specifies that forest name on the Network Credentials page. By specifying the forest name on this page, the wizard can enumerate all the domains for that forest on the Select a Domain page later in the wizard.

The wizard cannot always detect the target forest based on the credentials that you provide. For example, if you provide credentials by using a smart card or by using a user principal name (UPN), the wizard might not be able to detect the target forest. In this case, you must specify the name of the target forest on the Network Credentials page. The name of the target forest is the name of the forest root domain for that forest.

In cases in which the wizard successfully detects the target forest name based on the credentials that you provide, you can overwrite the name that the wizard provides to specify the name of another target forest in which you have sufficient privileges to install AD DS.

On networks that run IP version 6 (IPv6) only, you must specify the fully qualified domain name (FQDN) for the user account credentials instead of the single-label domain name. For example, you must specify corp.contoso.com\user_name or user_name@corp.contoso.com, instead of contoso\user_name.

Network credential requirements

The network credentials that the Active Directory Domain Services Installation Wizard requires are different for different deployment configurations. For example, to install a new Active Directory forest, you only have to be a member of the local Administrators group on the server that will become the first domain controller in the forest. To add a new domain to an existing forest or remove a domain, however, you must be a member of the Enterprise Admins group or the Domain Admins group in the parent domain of the domain that you want to add or remove. The Active Directory Domain Services Installation Wizard verifies that the credentials you supply are sufficient to implement the deployment configuration that you specify in the wizard.

The following table lists the network credentials that are required for each deployment configuration.

Note

If you are preparing an existing Active Directory environment for a domain controller that runs Windows Server 2008 R2, you must run Adprep.exe, which is available on the Windows Server 2008 R2 installation media in the support\adprep folder. Running Adprep may require additional credentials that are not listed in the following table.

Deployment configuration | Required credentials
Add a new forest | Local Administrators group on the server where you are installing AD DS
Add an additional child domain | Enterprise Admins Depending on security settings, Domain Admins might also be allowed to add a domain. To create a Domain Name System (DNS) delegation, you also need Domain Admins credentials in the parent domain.
Add a new domain tree | Enterprise Admins Depending on security settings, Domain Admins might also be allowed to add a domain tree.
Add an additional domain controller to a domain | Enterprise Admins or Domain Admins
Add a read-only domain controller (RODC) in a normal installation | Enterprise Admins or Domain Admins Enterprise Admins credentials are required to run adprep /rodcprep.
Add an RODC in a staged installation | Enterprise Admins or Domain Admins to create the RODC account Domain Admins or delegated permissions to attach a server to the RODC account Enterprise Admins credentials are required to run adprep /rodcprep.
Remove an additional domain controller from a domain | Enterprise Admins or Domain Admins
Remove an RODC | Delegated RODC administrator, Enterprise Admins, or Domain Admins
Remove a domain | Enterprise Admins Depending on security settings, Domain Admins might also be allowed to remove a domain, but they might not be able to remove the DNS delegations that were created in the parent DNS domain.
Remove a forest | Enterprise Admins

See Also

  • Installing Active Directory Domain Services


Configuring Additional Domain Controller Options

You can choose additional installation options for a domain controller during Active Directory Domain Services (AD DS) installation. For example, you can install the DNS Server service or make the server a global catalog server or a read-only domain controller (RODC). The following sections explain these additional installation options in more detail. These sections also explain how the options interact with each other.

DNS server option

Installing the DNS Server service on a domain controller makes that domain controller a Domain Name System (DNS) server. The default setting for the DNS server option depends on the following factors:

  • The deployment configuration that you choose, for example, adding a new domain or adding an additional domain controller for an existing domain

  • Your current DNS environment

The following table lists the default settings for installing a DNS server for the various AD DS deployment configurations.

Deployment configuration | Default setting for DNS server installation
New forest | The DNS server is installed by default.
New domain | The DNS server is installed by default if the wizard detects a DNS infrastructure in the parent domain. The DNS server is not installed by default if the wizard does not detect a DNS infrastructure.
New domain tree | The DNS server is installed by default if the wizard detects a DNS infrastructure in the forest root domain. The DNS server is not installed by default if the wizard does not detect a DNS infrastructure.
Additional domain controller | The DNS server is installed by default if the wizard detects a DNS infrastructure in the domain. The DNS server option is not available if the wizard does not detect a DNS infrastructure in the domain.
Note

If the DNS server is already installed before you start the Active Directory Domain Services Installation Wizard but the Active Directory domain does not have a DNS infrastructure, the DNS server continues to resolve names for any file-based zones that it hosts but it will not host any Active Directory–integrated DNS zones for the domain in which it is a domain controller.

DNS client settings

When you install an additional domain controller in an existing domain, the Active Directory Domain Services Installation Wizard verifies that the DNS client settings are correctly configured on the server. If the DNS client settings are not correctly configured with the IP address of a preferred DNS server, the wizard returns an error and you must correct the problem before you can continue.

You can then choose to manually configure the DNS client settings correctly. If you are creating a new forest that does not have an existing DNS infrastructure, you can also choose to have the wizard automatically install the DNS Server service and configure the DNS client settings with the IP address of the local DNS server.

If you choose to have the wizard configure DNS client settings when it installs the DNS Server service (an option that is available only when you are creating a new forest), the DNS server check box on the Additional Domain Controller Options page is selected and it cannot be cleared. You must install the DNS Server service at this point or click Back through the wizard until you are again provided the option to manually configure the DNS client settings.

Global catalog option

Because the first domain controller in a forest must be a global catalog server, the Global catalog check box is selected and it cannot be cleared when you create a forest. The check box is also selected by default when you install an additional domain controller in an existing domain. However, you can clear this check box if you do not want the additional domain controller to be a global catalog server.

When you create a new child domain or domain tree, the Global catalog check box is not selected by default because the first domain controller in the new domain hosts all domain-wide operations master roles (also known as flexible single master operations or FSMO roles), including the infrastructure operations master role. In a multidomain forest, you may encounter problems if you host the infrastructure master role on a global catalog server, unless all of the domain controllers in the domain are global catalog servers.

Therefore, if you decide to install the global catalog on the first domain controller in a new child domain or domain tree, either transfer the infrastructure master role after you install additional domain controllers in the domain or ensure that all the additional domain controllers that you install in the domain are also global catalog servers.

As you install additional writable domain controllers, the Active Directory Domain Services Installation Wizard validates that the infrastructure master is hosted on a suitable domain controller and it provides you with options to remedy any problems that can arise with the installation options that you choose. For more information, see Validation checks for the options that you select.

RODC option

In a staged installation of an RODC, the Read-only domain controller check box is selected and it cannot be cleared when you create the RODC account. The Additional Domain Controller Options page does not appear when you attach the server to the RODC account.

If you are installing an additional domain controller in a domain but you are not performing a staged installation, the Read-only domain controller check box is cleared by default. You can select it unless conditions in your environment prevent RODC installation. If conditions in your environment do prevent RODC installation, the RODC check box is cleared and it cannot be selected. The following conditions prevent RODC installation:

  • You are installing the first domain controller in a new forest.

  • You are installing the first domain controller in a new domain.

  • The forest functional level is not Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2.

  • There are no writable domain controllers running Windows Server 2008 or Windows Server 2008 R2 in the domain in which you want to install the RODC.

How additional installation options interact

If you select the Read-only domain controller check box, the wizard automatically selects the DNS server check box unless this option cannot be selected, for example, when no current DNS infrastructure exists for that domain. If you clear the DNS server check box after the wizard selects it, the wizard warns you that clients in the branch office might not be able to locate the RODC if you do not also install the DNS server.

The Global catalog check box might also be selected by default, depending on the other installation options that you select. By default, if you select the Read-only domain controller check box, the wizard automatically selects the Global catalog check box. For more information about other installation options in which the Global catalog check box is selected by default, see Global catalog option earlier in this topic.

Additional information about the options that you select

The Active Directory Domain Services Installation Wizard updates the Additional information text box with information about your environment, based on the default selections and the options that you select on the Additional Domain Controller Options page. As you change your selections, the wizard dynamically updates the messages that appear in this text box.

For example, if you select the Global catalog check box, the wizard updates the Additional information text box to indicate how many other global catalog servers are deployed in the domain and site. This information can help you confirm that you are installing AD DS with the options that you planned.

The wizard also updates the Additional information text box to indicate if any existing conditions in your environment currently prevent any of the options from being available. For example, if no writable domain controller in your domain is running Windows Server 2008 or Windows Server 2008 R2, the wizard clears the Read-only domain controller check box, makes this option unavailable, and writes a message in the Additional information text box that states that there must be a writable domain controller running Windows Server 2008 or Windows Server 2008 R2 in the domain to install an RODC.

Validation checks for the options that you select

After you select your options on the Additional Domain Controller Options page and then click Next, the wizard performs the following validation checks before it continues:

  • Infrastructure master check

  • Adprep /rodcprep check

  • Validation of static IP address

Infrastructure master check

If you select the option to install an additional domain controller in a domain, the Active Directory Domain Services Installation Wizard selects the Global catalog check box by default. If you are installing a writable domain controller (the Read-only domain controller check box is cleared) and you also clear the Global catalog check box, the wizard checks whether the infrastructure master role is currently hosted on a global catalog server in the domain. If it is, the wizard prompts you to transfer the role to the domain controller that you are installing. You can either click Yes to transfer the infrastructure master role to this domain controller or click No to correct the configuration later.

Adprep /rodcprep check

If you are installing an RODC, the wizard verifies that the adprep /rodcprep command completed successfully and that the changes that result from the command are replicated throughout the forest. If the adprep /rodcprep command does not complete successfully or the changes are not yet replicated, you receive an error message that states that the command must be run before you can continue with the installation. If you receive this message, run adprep /rodcprep again on any computer in the forest or wait until the changes are replicated throughout the forest.

Validation of static IP address

If you select the DNS server check box, the Active Directory Domain Services Installation Wizard verifies that all of the physical network adapters for the server have a static address, including a static IP version 4 (IPv4) address and a static IP version 6 (IPv6) address if they are both available. Although you can complete the AD DS installation without using a static IP address, this is not recommended because clients can have trouble contacting the domain controller if its IP address changes. For more information about setting a static IP address, see Configuring TCP/IP and DNS Client Settings.


Creating or Updating a DNS Delegation

When you add another Active Directory domain to a forest, delegation records that point to the authoritative DNS servers for the new zone should be created in the parent Domain Name System (DNS) zone. Delegation records transfer name resolution authority and provide correct referral to other DNS servers and clients of the new servers that are being made authoritative for the new zone. If you are using Active Directory–integrated DNS, these DNS servers might also be the domain controllers for that domain.

You can create these DNS delegation records before you start the Active Directory Domain Services Installation Wizard, or you can have the wizard create them automatically. The wizard verifies that the appropriate records exist in the parent DNS zone after you click Next on the Additional Domain Controller Options page. If the wizard cannot verify that the records exist in the parent domain, the wizard provides you with the option to create the records automatically and continue with the new domain installation.

For example, to add a new child domain named na.contoso.com to the contoso.com forest, a delegation for the DNS subdomain (na.contoso.com) must be created in the parent DNS zone (contoso.com).

If an authoritative DNS server for the newly delegated na.contoso.com subdomain is named ns1.na.contoso.com, to make this server known to others outside of the new delegated zone two resource records must be present in the contoso.com zone to complete delegation to the new zone. These resource records include the following:

  • A name server (NS) resource record to effect the delegation. This resource record advertises that the server named ns1.na.example.microsoft.com is an authoritative server for the delegated subdomain.

  • A host (A or AAAA) resource record—also known as a glue record—must be present to resolve the name of the server that is specified in the name server (NS) resource record to its IP address. The process of resolving the host name in this resource record to the delegated DNS server in the name server (NS) resource record is sometimes referred to as "glue chasing."

To create a zone delegation, open DNS Manager, right-click the parent domain, and then click New Delegation. Follow the steps in the New Delegation Wizard to create the delegation.


Setting the Domain or Forest Functional Level

Functional levels determine the features of Active Directory Domain Services (AD DS) that are enabled in a domain or forest. They also restrict which Windows Server operating systems can run on domain controllers in the domain or forest. However, functional levels do not affect which operating systems can run on workstations and member servers that are joined to the domain or forest.

When you create a new domain or a new forest, set the domain and forest functional levels to the highest values that you know your environment can support. This way, you can take advantage of as many AD DS features as possible. For example, if you are sure that no domain controllers that run Windows Server 2008 (or any earlier operating system) will ever be added to the domain or forest, select the Windows Server 2008 R2 functional level. On the other hand, if it is possible that you will retain or add domain controllers that run Windows Server 2008 or earlier, select the Windows Server 2008 functional level during installation. You can raise the functional level after the installation, when you are sure that no such domain controllers will be added or are still in use.

When you install a new forest, you are prompted to set the forest functional level and then the domain functional level. You cannot set the domain functional level to a value that is lower than the forest functional level. For example, if you set the forest functional level to Windows Server 2008 R2, you can set the domain functional level only to Windows Server 2008 R2. The Windows 2000, Windows Server 2003, and Windows Server 2008 domain functional level values will not be available on the Set domain functional level wizard page. In addition, all domains that you subsequently add to that forest will have the Windows Server 2008 R2 domain functional level by default.

After you set the domain functional level to a certain value, you cannot roll back or lower the domain functional level, with one exception: when you raise the domain functional level to Windows Server 2008 R2 and if the forest functional level is Windows Windows Server 2008 or lower, you have the option of rolling the domain functional level back to Windows Server 2008. You can lower the domain functional level only from Windows Server 2008 R2 to Windows Server 2008. If the domain functional level is set to Windows Server 2008 R2, it cannot be rolled back, for example, to Windows Server 2003.

After you set the forest functional level to a certain value, you cannot roll back or lower the forest functional level, with one exception: when you raise the forest functional level to Windows Server 2008 R2 and if Active Directory Recycle Bin is not enabled, you have the option of rolling the forest functional level back to Windows Server 2008. You can lower the forest functional level only from Windows Server 2008 R2 to Windows Server 2008. If the forest functional level is set to Windows Server 2008 R2, it cannot be rolled back, for example, to Windows Server 2003.

The following sections explain the sets of features that are enabled at the different domain and forest functional levels.

Features that are enabled at domain functional levels

The following table lists the enabled features and supported domain controller operating systems for each domain functional level.

Domain functional level Enabled features Supported domain controller operating systems

Windows 2000 native

All default Active Directory features, plus the following features:

  • Universal groups for both distribution groups and security groups

  • Group nesting

  • Group conversion, which makes conversion possible between security groups and distribution groups

  • Security identifier (SID) history

Windows 2000

Windows Server 2003

Windows Server 2008

Windows Server 2008 R2

Windows Server 2003

All default Active Directory features, all features from the Windows 2000 native domain functional level, plus the following features:

  • The domain management tool, Netdom.exe, is available to prepare for domain controller rename.

  • Logon time stamp update. The lastLogonTimestamp attribute will be updated with the last logon time of the user or computer. This attribute is replicated within the domain. Note that this attribute might not be updated if a read-only domain controller (RODC) authenticates the account.

  • The userPassword attribute can be set as the effective password on inetOrgPerson objects and user objects.

  • Users and Computers containers can be redirected. By default, two well-known containers are provided for housing computer and user/group accounts: cn=Computers,<domain root> and cn=Users,<domain root>. With this feature, you can define a new well-known location for these accounts.

  • Authorization Manager can store its authorization policies in AD DS.

  • Constrained delegation, which makes it possible for applications to take advantage of the secure delegation of user credentials by means of the Kerberos authentication protocol. You can configure delegation to be allowed only to specific destination services.

  • Support for selective authentication, which makes it possible to specify the users and groups from a trusted forest who are allowed to authenticate to resource servers in a trusting forest.

Windows Server 2003

Windows Server 2008

Windows Server 2008 R2

Windows Server 2008

All default Active Directory features, all features from the Windows 2000 native and the Windows Server 2003 domain functional levels, plus the following features:

  • Distributed File System (DFS) Replication support for SYSVOL, which provides more robust and detailed replication of SYSVOL contents. You may need to perform additional steps to use DFS Replication for SYSVOL. For more information, see File Services (http://go.microsoft.com/fwlink/?LinkId=93167).

  • Advanced Encryption Services (AES 128 and 256) support for the Kerberos protocol.

  • Last Interactive Logon Information, which displays the time of the last successful interactive logon for a user, from what workstation, and the number of failed logon attempts since the last logon.

  • Fine-grained password policies, which make it possible for password and account lockout policies to be specified for users and global security groups in a domain.

Windows Server 2008

Windows Server 2008 R2

Windows Server 2008 R2

All default Active Directory features, all features from the Windows 2000 native, Windows Server 2003, and Windows Server 2008 functional levels, plus the following feature:

  • Authentication Mechanism Assurance, which packages information about the type of logon method (smartcard or user name/password) that is used to authenticate domain users inside each user’s Kerberos token. When this feature is enabled in a network environment that has deployed a federated identity management infrastructure, such as Active Directory Federation Services (AD FS), the information in the token can then be extracted whenever a user attempts to access any claims-aware application that has been developed to determine authorization based on a user’s logon method.

Windows Server 2008 R2

Features that are enabled at forest functional levels

The following table lists the enabled features and supported domain controller operating systems for each forest functional level.

Forest functional level

Enabled features

Supported domain controller operating systems

Windows 2000

All default Active Directory features

Windows 2000

Windows Server 2003

Windows Server 2008

Windows Server 2008 R2

Windows Server 2003

All default Active Directory features, plus the following features:

  • Forest trust

  • Domain rename

  • Linked-value replication (changes in group membership to store and replicate values for individual members instead of replicating the entire membership as a single unit). This change results in lower network bandwidth and processor usage during replication, and it eliminates the possibility of lost updates when different members are added or removed concurrently at different domain controllers.

  • The ability to deploy an RODC

  • Improved Knowledge Consistency Checker (KCC) algorithms and scalability. The intersite topology generator (ISTG) uses improved algorithms that scale to support forests with a greater number of sites than can be supported at the Windows 2000 forest functional level.

  • The ability to create instances of the dynamic auxiliary class called dynamicObject in a domain directory partition

  • The ability to convert an inetOrgPerson object instance into a User object instance, and the reverse

  • The ability to create instances of the new group types, called application basic groups and Lightweight Directory Access Protocol (LDAP) query groups, to support role-based authorization

  • Deactivation and redefinition of attributes and classes in the schema

Windows Server 2003

Windows Server 2008

Windows Server 2008 R2

Windows Server 2008

All the features that are available at the Windows Server 2003 forest functional level, but no additional features. All domains that are subsequently added to the forest, however, will operate at the Windows Server 2008 domain functional level by default.

If you plan to include only domain controllers that run Windows Server 2008 or Windows Server 2008 R2 in the entire forest, you might choose this forest functional level for administrative convenience.

Windows Server 2008

Windows Server 2008 R2

Windows Server 2008 R2

All of the features that are available at the Windows Server 2003 forest functional level, plus the following feature:

  • Recycle Bin, which provides the ability to restore deleted objects in their entirety while AD DS is running.

All domains that are subsequently added to the forest will operate at the Windows Server 2008 R2 domain functional level by default.

If you plan to include only domain controllers that run Windows Server 2008 R2 in the entire forest, you might choose this forest functional level for administrative convenience. If you do, you will never have to raise the domain functional level for each domain that you create in the forest.

Windows Server 2008 R2


Placing Active Directory Domain Services Files

When you install Active Directory Domain Services (AD DS), you specify where the Active Directory database, log files, and the SYSVOL shared folder will be placed on the server. The database stores information about the users, computers, and other objects on the network. The log files record activities that are related to AD DS, such as information about an object being updated. SYSVOL stores Group Policy objects and scripts. By default, SYSVOL is part of the operating system files in the %windir% directory.

Consider the following factors when you decide where to place AD DS files:

  • Backup and recovery

  • Performance

Backup and recovery considerations for placing AD DS files

For a simple installation in which the server has only one hard disk, you can simply accept the default installation settings that are supplied by the Active Directory Domain Services Installation Wizard. However, you must create at least two volumes on that one hard disk. One volume is required for critical-volume data and another volume is required for backup.

When you use Windows Server Backup or the Wbadmin.exe command-line tool to back up a domain controller, you must back up at least the system state data so that you can use the backup to recover the server. The volume that you use to store the backups cannot be the same volume that hosts system state data. This requirement can affect where you decide to place AD DS files. The system components that make up system state data depend on the server roles that are installed on the computer. The system state data includes at least the following data, plus additional data, depending on the server roles that are installed:

  • Registry

  • COM+ Class Registration database

  • Boot files

  • Active Directory Certificate Services (AD CS) database

  • Volume that hosts the Active Directory database (Ntds.dit)

  • Volume that hosts the Active Directory database log files

  • SYSVOL directory

  • Cluster service information

  • Microsoft Internet Information Services (IIS) metadirectory

  • System files that are under Windows Resource Protection

For example, if you are installing AD DS on a server that has one hard disk, you might create the following logical volumes to accommodate backups:

  • Drive C, which hosts all the critical volume data

  • Drive D, which is used as a target for Windows Server Backup or Wbadmin.exe

For more information about backing up and recovering a domain controller, see the Step-by-Step Guide for Active Directory Domain Services Backup and Recovery (http://go.microsoft.com/fwlink/?LinkId=93077).

Performance considerations for placing AD DS files

For more complex installations, you may configure your hard disk storage to optimize the performance of AD DS. Because the database and log files utilize disk storage space in different ways, you can improve AD DS performance by devoting separate hard disk spindles for each.

For example, suppose that a server has four available hard disk drives that are labeled as follows:

  • Drive C, which includes the operating system files

  • Drive D, which is not used

  • Drive E, which is not used

  • Drive F, which is used for backup

On this server, you can improve AD DS performance the most by installing the database and log files on separate drives that are devoted to those resources, such as drives D and E. This can help improve the performance of searches against the database because one disk spindle can be devoted solely to that activity. If a large number of changes are ever made at one time, this configuration also reduces the chance of bottlenecks developing on the disk that hosts the log files. You can place SYSVOL on drive C with the operating system files.


Installing from Media

When you install an additional domain controller, you can install from media (IFM) instead of replicating all directory data over the network. The installation media can be stored on a local drive, removable media such as a DVD, or on a network shared folder.

Performing an IFM operation to create an additional domain controller greatly reduces the network bandwidth that is used when you install Active Directory Domain Services (AD DS). However, network connectivity is still necessary so that all new objects and recent changes to existing objects are replicated to the new domain controller.

If you select the option to copy domain information over the network, all AD DS data will be copied over your network connection. If you need to replicate information for a large domain, to postpone noncritical replication you can click Finish Replication Later on the progress page that appears after you finish the wizard. If you decide to postpone noncritical replication, the Active Directory Domain Services Installation Wizard will continue to complete Domain Name System (DNS) installation and configuration. The wizard will also install the Group Policy Management Console.

Creating AD DS installation media

The recommended method for creating AD DS installation media is to use the Ntdsutil.exe tool that is built into Windows Server 2008 R2 and available when the AD DS server role is installed. The ntdsutil tool includes an ifm subcommand that creates only the files that are necessary to install AD DS.

As an alternative to using Ntdsutil.exe, you can restore a system state backup and use it as installation media, but a system state backup of a domain controller typically includes more data than is required to perform an IFM operation.

We also recommend the ntdsutil ifm subcommand because you can use it to remove secrets, such as passwords, from the AD DS database so that you can install a read-only domain controller (RODC). When you remove these secrets, the RODC installation media is more secure if it must be transported to a branch office for an RODC installation.

You must use RODC installation media to install an RODC. You can create RODC installation media on either an RODC or a writeable domain controller. You must use writeable domain controller installation media to install a writeable domain controller. You can create writeable domain controller installation media only on a writeable domain controller. In the ntdsutil ifm subcommand, the writeable domain controller installation media is denoted as "full" media. For more information about using the ntdsutil ifm subcommand, see Installing AD DS from Media (http://go.microsoft.com/fwlink/?LinkId=93104).

If you use a backup of another domain controller as AD DS installation media, use the most recent backup available. Older backups require more network bandwidth for replication. The backup that you use cannot be older than the tombstone lifetime of the domain, which is set to a default value of 180 days (60 days in a forest that is created on a server running Windows Server 2003 or earlier).

When you choose the option to copy domain information from restored backup files, you first must create a system state backup of a domain controller from the domain in which this member server will become an additional domain controller. Then, you must restore the backup locally on the server on which you are installing AD DS.

If you want to use the application partitions that are available on the installation media, you can specify the /ApplicationPartitionsToReplicate parameter when you start dcpromo during an unattended installation. Specify * to include all available application partitions. For example, to use all available applications for the additional domain controller, you can type the following command at a command prompt, and then press ENTER:

dcpromo /unattend /ReplicaOrNewDomain:Replica /ApplicationPartitionsToReplicate:*

If you want the new domain controller to be a global catalog server, you can either use installation media that is created from a global catalog server or replicate the global catalog data to the new domain controller over the network.


Selecting an Installation Partner for Active Directory Domain Services

On the Source Domain Controller page of the Active Directory Domain Services Installation Wizard, you can select which domain controller will be used as a source for data that must be replicated during installation, or you can have the wizard select which domain controller will be used as the source for this data. This wizard page appears only if you select the Use advanced mode installation check box on the Welcome to the Active Directory Domain Services Installation Wizard page and you are adding an additional domain to a forest or adding an additional domain controller to an existing domain.

Even if you choose to install from media (IFM), some network communication must occur between the new domain controller and an existing domain controller, which is sometimes known as an installation partner or a "helper domain controller."

The Active Directory Domain Services Installation Wizard lists all the domain controllers that are eligible to be used as an installation partner. If you are creating an additional domain, any domain controller can be the installation partner. However, the following restrictions apply to the domain controllers that can be used as an installation partner in other situations:

  • A read-only domain controller (RODC) can never be an installation partner.

  • If you are installing an RODC, only a writable domain controller that runs Windows Server 2008 or Windows Server 2008 R2 can be an installation partner.

  • If you are installing an additional domain controller for an existing domain, only a domain controller for that domain can be an installation partner.

If you specify a domain controller to be used as an installation partner, specify a domain controller that has a low number of inbound and outbound connections and ensure that it is not a significant originator or forwarder of changes with File Replication Service (FRS) replication partners.

If you choose not to use IFM, a new NTDS Settings object and a new computer account is created or modified on the installation partner. The installation partner also has the first opportunity to replicate the contents of the SYSVOL shared folder to the new domain controller.


Providing a Directory Services Restore Mode Administrator Password

The Directory Services Restore Mode (DSRM) password is required for logon to a domain controller when Active Directory Domain Services (AD DS) is not running, either because AD DS is stopped or because the domain controller has been started in DSRM.

Note

The DSRM password is not the same as the password for the domain Administrator account.

If you are creating the first domain controller in the forest, the password policy that is in effect on the local server is enforced by the Active Directory Domain Services Installation Wizard.

For all other domain controller installations, the Active Directory Domain Services Installation Wizard enforces the password policy that is in effect on the domain controller that is used as the installation partner. This means that the DSRM password that you specify must meet the minimum password length, history, and complexity requirements for the domain that contains the installation partner. By default, a strong password that contains a combination of uppercase and lowercase letters, numbers, and symbols must be provided.

Be sure to safeguard the DSRM password. Divulging the DSRM password to unauthorized personnel after the installation presents a security risk. A malicious user can use the password to start the domain controller in DSRM and subsequently cause problems in the forest. For example, a malicious user might start the domain controller in DSRM and then force the removal of AD DS from the server.


Using an Answer File

On the Summary page of the Active Directory Domain Services Installation Wizard, you can click Export settings to save the settings that you specified in the wizard to an answer file. You can then use the answer file to automate subsequent installations of Active Directory Domain Services (AD DS).

The answer file is a plain text file with a [DCInstall] header. The answer file provides answers to the questions that are asked by the Active Directory Domain Services Installation Wizard. Using the answer file eliminates the need for an administrator to interact with the wizard. The Active Directory Domain Services Installation Wizard adds text to the answer file that explains how to use it, such as how to invoke it with the dcpromo command and which settings must be updated to use it.

During an unattended operation, a return code indicates whether or not the operation was successful. For information about return codes, see Unattended Installation Return Codes.

To use an answer file to install AD DS, type the following command at a command prompt, and then press ENTER:

dcpromo /answer[:filename]

Where filename is the name of your answer file.


Manually Configuring a DNS Server for Active Directory Domain Services Integration

If you are installing Domain Name System (DNS) on a domain controller and you cancel the Active Directory Domain Services Installation Wizard before the DNS server installation is completed, the DNS server role might be installed but not configured to support AD DS. Allowing the wizard to complete the DNS installation and configuration is strongly recommended. However, if you do cancel the wizard, complete the following steps as necessary to ensure that the DNS server is configured correctly for AD DS integration:

  • Configure DNS client settings. For more information, see Configuring TCP/IP and DNS Client Settings.

  • Create all necessary DNS delegation records. For more information, see Creating or Updating a DNS Delegation.

  • Configure forwarders. For more information, see Understanding Forwarders, Using Forwarders, and Configure a DNS Server to Use Forwarders.

  • Configure root hints if necessary. For more information, see Updating Root Hints and Update Root Hints on the DNS Server.

  • Convert any necessary file-backed zones to Active Directory–integrated zones. For more information, see Change the Zone Type.


Understanding Forwarders

A forwarder is a Domain Name System (DNS) server on a network that forwards DNS queries for external DNS names to DNS servers outside that network. You can also forward queries according to specific domain names using conditional forwarders.

You designate a DNS server on a network as a forwarder by configuring the other DNS servers in the network to forward the queries that they cannot resolve locally to that DNS server. By using a forwarder, you can manage name resolution for names outside your network, such as names on the Internet, and improve the efficiency of name resolution for the computers in your network. For more information about forwarders and conditional forwarders, see Using Forwarders.

The following figure illustrates how external name queries are directed with forwarders.

Example of a common forwarder configuration

When you designate a DNS server as a forwarder, you make that forwarder responsible for handling external traffic, which limits DNS server exposure to the Internet. A forwarder builds up a large cache of external DNS information because all the external DNS queries in the network are resolved through it. In a small amount of time, a forwarder resolves a large number of external DNS queries using this cached data. This decreases the Internet traffic over the network and the response time for DNS clients.

A DNS server that is configured to use a forwarder behaves differently than a DNS server that is not configured to use a forwarder. A DNS server that is configured to use a forwarder behaves as follows:

  1. When the DNS server receives a query, it attempts to resolve this query by using the zones that it hosts and by using its cache.

  2. If the query cannot be resolved using local data, the DNS server forwards the query to the DNS server that is designated as a forwarder.

  3. If forwarders are unavailable, the DNS server attempts to use its root hints to resolve the query..

When a DNS server forwards a query to a forwarder, it sends a recursive query to the forwarder. This is different than the iterative query that a DNS server sends to another DNS server during standard name resolution (name resolution that does not involve a forwarder).

Conditional forwarders

A conditional forwarder is a DNS server on a network that forwards DNS queries according to the DNS domain name in the query. For example, you can configure a DNS server to forward all the queries that it receives for names ending with corp.contoso.com to the IP address of a specific DNS server or to the IP addresses of multiple DNS servers.

Internet name resolution

DNS servers can use conditional forwarders to resolve queries between the DNS domain names of companies that share information. For example, two companies, Wingtip Toys and Tailspin Toys, want to improve how the DNS clients of Wingtip Toys resolve the names of the DNS clients of Tailspin Toys. The administrators from Tailspin Toys inform the administrators of Wingtip Toys about the set of DNS servers in the Tailspin Toys network where Wingtip Toys can send queries for the domain dolls.tailspintoys.com. The DNS servers in the Wingtip Toys network are configured to forward all queries for names ending with dolls.tailspintoys.com to the designated DNS servers in the network for Tailspin Toys. Consequently, the DNS servers in the Wingtip Toys network do not have to query their internal root servers—or the Internet root servers—to resolve queries for names ending with dolls.tailspintoys.com.


Using Forwarders

To use forwarders to manage the Domain Name System (DNS) traffic between your network and the Internet, configure your network's firewall to allow only one DNS server to communicate with the Internet. When you configure the other DNS servers in your network to forward queries that they cannot resolve locally to that DNS server, it acts as your forwarder. For more information about forwarders, see Understanding Forwarders.

Forwarding sequence

The order of the IP addresses that are listed as forwarders on a DNS server determines the sequence in which the IP addresses are used. After the DNS server forwards the query to the forwarder with the first IP address, it waits a short period of time for an answer from that forwarder (according to the DNS server's forwarding time-out setting) before resuming the forwarding operation with the next IP address. It continues this process until it receives an affirmative answer from a forwarder.

For example, in the following illustration the DNS servers with the first and second forwarder IP addresses do not respond to the DNS server. The DNS server with the third forwarder IP address responds, and the query is forwarded to that DNS server.

Outsourced VPN remote access

Unlike conventional resolution, where a roundtrip time (RTT) is associated with each server, the IP addresses in the forwarders list are not ordered according to roundtrip time. You must reorder them manually to change the preference.

Conditional forwarders

Conditional forwarders are DNS servers that forward queries according to domain names. Rather than having a DNS server forward all queries it cannot resolve locally to a forwarder, you can configure DNS servers to forward queries to different forwarders according to the specific domain names that are contained in the queries. Forwarding according to domain names improves conventional forwarding by adding a name-based condition to the forwarding process.

The conditional forwarder setting for a DNS server consists of the following:

  • The domain names for which the DNS server will forward queries

  • One or more DNS server IP addresses for each domain name that is specified

When a DNS client or server performs a query operation against a DNS server, the DNS server checks to determine if the query can be resolved with its own zone data or the data stored in its cache. If the DNS server is configured to forward for the domain name that is designated in the query, the query is forwarded to the IP address of a forwarder that is associated with that domain name. For example, in the following illustration, each of the queries for the domain names is forwarded to a DNS server that is associated with the domain name.

Dial-up and VPN remote access

If the DNS server has no forwarder listed for the name that is designated in the query, it attempts to resolve the query using standard recursion. For more information, see Configure a DNS Server to Use Forwarders.

You can use conditional forwarders to improve name resolution between internal (private) DNS namespaces that are not part of the DNS namespace of the Internet. Such DNS namespaces may be a result of a company merger. When you configure the DNS servers in one internal namespace to forward all queries to the authoritative DNS servers in a second internal namespace, conditional forwarders enable name resolution between the two namespaces without performing recursion on the DNS namespace of the Internet. This enhancement to name resolution also avoids your DNS servers performing recursion to your internal root for different namespaces within your network.

Important

A DNS server cannot forward queries for the domain names in the zones that it hosts. For example, the authoritative DNS server for the zone widgets.tailspintoys.com cannot forward queries according to the domain name widgets.tailspintoys.com. The DNS server that is authoritative for widgets.tailspintoys.com can forward queries for DNS names that end with hr.widgets.tailspintoys.com, if hr.widgets.tailspintoys.com is delegated to another DNS server.

Conditional forwarder domain name length

When a DNS server that is configured with a conditional forwarder receives a query for a domain name, it compares that domain name with its list of domain name conditions and uses the longest domain name condition that corresponds to the domain name in the query. For example, in the next illustration, the DNS server performs the following conditional forwarding logic to determine how a query for a domain name will be forwarded:

  1. The DNS server receives a query for toys.widgets.tailspintoys.com.

  2. It compares that domain name with both tailspintoys.com and widgets.tailspintoys.com.

  3. The DNS server determines that widgets.tailspintoys.com is the domain name that more closely matches the domain name query.

  4. The DNS server forwards the query to the DNS server with the IP address 172.31.255.255, which is associated with widgets.tailspintoys.com.

Ethernet switch access


Configure a DNS Server to Use Forwarders

A forwarder is a Domain Name System (DNS) server on a network that is used to forward DNS queries for external DNS names to DNS servers outside that network. You can also configure your server to forward queries according to specific domain names using conditional forwarders.

A DNS server on a network is designated as a forwarder when the other DNS servers in the network are configured to forward the queries that they cannot resolve locally to that DNS server. By using a forwarder, you can manage name resolution for names outside your network, such as names on the Internet, which can improve the efficiency of name resolution for the computers in your network. For more information about forwarders and conditional forwarders, see Understanding Forwarders.

Membership in the Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Configuring a DNS server to use forwarders

  • Using the Windows interface

  • Using a command line
To configure a DNS server to use forwarders using the Windows interface

  1. Open DNS Manager.

  2. In the console tree, click the applicable DNS server.

    Where?

    • DNS/Applicable DNS server

  3. On the Action menu, click Properties.

  4. On the Forwarders tab, under DNS domain, click a domain name.

  5. Under Selected domain's forwarder IP address list, type the IP address of a forwarder, and then click Add.

Additional considerations

  • To open DNS Manager, click Start, point to Administrative Tools, and then click DNS.

  • To create a new domain name, click New, and then, under DNS domain, type the domain name.

  • When you specify a conditional forwarder, select a DNS domain name before you enter an IP address.

  • By default, the DNS server waits five seconds for a response from one forwarder IP address before it tries another forwarder IP address. In Number of seconds before forward queries time out, you can change the number of seconds that the DNS server waits. When the server has exhausted all forwarders, it attempts standard recursion.

  • If you want the DNS server to only use forwarders and not attempt any further recursion if the forwarders fail, select the Do not use recursion for this domain check box.

    You can disable recursion for the DNS server so that it will not perform recursion on any query. If you disable recursion on the DNS server, you will not be able to use forwarders on the same server.

  • Do not enter a forwarder's IP address more than once in a DNS server's forwarders list because it is a more reliable or geographically closer server. If you prefer one of the forwarders, put that forwarder first in the series of forwarder IP addresses.

  • You cannot use a domain name in a conditional forwarder if the DNS server hosts a primary zone, secondary zone, or stub zone for that domain name. For example, if a DNS server is authoritative for the domain name corp.contoso.com (that is, it hosts the primary zone for that domain name), you cannot configure that DNS server with a conditional forwarder for corp.contoso.com.

  • You can prevent common problems that are associated with forwarders by configuring your DNS servers to avoid overusing your forwarders.

To configure a DNS server to use forwarders using a command line

  1. Open a command prompt.

  2. Type the following command, and then press ENTER:

    dnscmd <ServerName> /ResetForwarders <MasterIPaddress ...> [/TimeOut <Time>] [/Slave]

Parameter | Description
dnscmd | Specifies the name of the command-line tool for managing DNS servers.
<ServerName> | Required. Specifies the DNS host name of the DNS server. You can also type the IP address of the DNS server. To specify the DNS server on the local computer, you can also type a period (.).
/ResetForwarders | Required. Configures a forwarder.
<MasterIPaddress...> | Required. Specifies a space-separated list of one or more IP addresses of the DNS servers where queries are forwarded. You may specify a list of space-separated IP addresses.
/TimeOut | Specifies the timeout setting. The timeout setting is the number of seconds before unsuccessful forward queries time out.
<Time> | Specifies the value for the /TimeOut parameter. The value is in seconds. The default timeout is five seconds.
/Slave | Determines whether or not the DNS server uses recursion when it queries for the domain name that is specified by ZoneName.

To view the complete syntax for this command, at a command prompt, type the following command, and then press ENTER:

dnscmd /ResetForwarders /help

Additional considerations

  • To open an elevated Command Prompt window, click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.

  • To set the conditional forwarder for a zone, use the following command:

    dnscmd <ServerName> /ZoneAdd <ZoneName> /Forwarder <MasterIPaddress ...> [/TimeOut <Time>] [/Slave]
    The /ZoneAdd command adds the zone specified by the ZoneName parameter. The parameter IPAddress is the IP address where the DNS server will forward unsolvable DNS queries. The /Slave parameter sets the DNS server as a subordinate server. The /NoSlave parameter (default setting) sets the DNS server as a nonsubordinate server, which means that it will perform recursion. The /Timeout and Time parameters are described in the previous table.

  • To view a zone that is added only as a conditional forwarder, use the following command:

    dnscmd <ServerName> /ZoneInfo <ZoneName>
  • To reset the forwarder IP addresses for a conditional forwarder domain name, use the following command:

    dnscmd <ServerName> /ZoneResetMasters <ZoneName> [/Local] [<ServerIPs>]
    The /Local parameter sets the local master list for Active Directory–integrated forwarders. The ServerIPs parameter is the list of one or more IP addresses of master servers for the zone. Master servers may include DNS servers that host primary or secondary copies of the zone, but they should not include DNS server IP addresses in such a way that two DNS servers that host copies of a zone use each other as master servers. Such a configuration makes the forwarding path cyclical.

  • You cannot use a domain name in a conditional forwarder if the DNS server hosts a primary zone, secondary zone, or stub zone for that domain name. For example, if a DNS server is authoritative for the domain name corp.contoso.com (that is, it hosts the primary zone for that domain name), you cannot configure that DNS server with a conditional forwarder for corp.contoso.com.

  • You can prevent common problems that are associated with forwarders by configuring your DNS servers to avoid overusing your forwarders.

Additional references

  • Using Forwarders


Updating Root Hints

You can use root hints to prepare servers that are authoritative for nonroot zones so that they can discover authoritative servers that manage domains at a higher level or in other subtrees of the DNS domain namespace. These root hints are essential for servers that are authoritative at lower levels of the namespace when locating and finding other servers under these conditions.

For example, suppose that a DNS server (Server A) has a zone called sub.corp.contoso.com. In the process of answering a query for a higher-level domain, such as the corp.contoso.com domain, Server A needs some assistance to locate an authoritative server (such as Server B) for this domain.

For Server A to find Server B—or any other servers that are authoritative for the contoso.com domain, Server A must be able to query the root servers for the DNS namespace. The root servers can then refer Server A to the authoritative servers for the com domain. The servers for the com domain can, in turn, offer referral to Server B or other servers that are authoritative for the contoso.com domain. The root hints that Server A uses must have helpful hints to the root servers for this process to locate Server B (or another authoritative server) as intended.

To configure and use root hints correctly, first answer the following questions about your DNS server:

  • Are you using DNS on the Internet or on a private network?

  • Is the DNS server used as a root server?

By default, the DNS Server service implements root hints by using a file, Cache.dns, that is stored in the %systemroot%\System32\Dns folder on the server computer. This file normally contains the name server (NS) and host (A) resource records for the Internet root servers. If, however, you are using the DNS Server service on a private network, you can edit or replace this file with similar records that point to your own internal root DNS servers.

Root hints are also treated differently when a DNS server is configured to be used by other DNS servers in an internal namespace as a forwarder for any DNS queries of names that are managed externally (on the Internet, for example). Even though the DNS server that is used as a forwarder can be located internally on the same network as servers that are using it as a forwarder, it needs hints for the Internet root servers to work properly and resolve external names.

If a DNS server is configured to access other DNS servers, such as through a list of DNS servers that is configured in its client TCP/IP properties for an installed network connection, the DNS Server service is capable of gathering its own root hints during new server configuration. You can use the Configure a DNS Server Wizard to accomplish this.


Update Root Hints on the DNS Server

You can use root hints to prepare servers that are authoritative for nonroot zones so that they can discover authoritative servers that manage domains at a higher level or in other subtrees of the DNS domain namespace. These root hints are essential for servers that are authoritative at lower levels of the namespace when they locate and find other servers under these conditions.

Membership in the Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

To update root hints on the DNS server

  1. Open DNS Manager.

  2. In the console tree, click the applicable DNS server.

    Where?

    • DNS/applicable DNS server

  3. On the Action menu, click Properties.

  4. Click the Root Hints tab.

  5. Modify server root hints as follows:

    • To add a root server to the list, click Add, and then specify the name and IP address of the server to be added to the list.

    • To modify a root server in the list, click Edit, and then specify the name and IP address of the server to be modified in the list.

    • To remove a root server from the list, select it in the list, and then click Remove.

    • To copy root hints from a DNS server, click Copy from server, and then specify the IP address of the DNS server from which you want to copy a list of root servers to use in resolving queries. These root hints will not overwrite any existing root hints.

Additional considerations

  • To open DNS Manager, click Start, point to Administrative Tools, and then click DNS.

Additional references

  • Updating Root Hints


Change the Zone Type

You can use this procedure to change make a zone a primary, secondary, or stub zone. You can also use it to integrate a zone with Active Directory Domain Services (AD DS). For more information, see Understanding zone types.

Membership in the Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.

Changing the zone type

  • Using the Windows interface

  • Using a command line
To change the zone type using the Windows interface

  1. Open DNS Manager.

  2. In the console tree, right-click the applicable zone, and then select Properties.

  3. On the General tab, note the current zone type, and then click Change.

  4. In Change Zone Type, select a zone type other than the current zone type, and then click OK.

Additional considerations

  • To open DNS Manager, click Start, point to Administrative Tools, and then click DNS.

  • You can select either Primary zone, Secondary zone or Stub zone. When you select the secondary or stub zone types, you must specify the IP address of another Domain Name System (DNS) server to be used as the source for obtaining updated information for the zone.

  • If the DNS server computer is operating as a domain controller, the option to store the zone in AD DS is available. This option is not otherwise available. When this zone type is selected for use, zone data is stored and replicated as part of the AD DS database.

    Note

    You cannot change the zone type (primary, secondary, or stub) and the method for storing the zone at the same time. You must perform the two operations separately.

  • Changing a zone from a secondary to primary type can affect other zone activities, including management of dynamic updates and zone transfers and the use of DNS notify lists to notify other servers about changes in the zone.

  • Changing a zone from stub to primary or the reverse is not recommended. This contradicts the purpose of stub zones.

  • Changing the DNS zone type or storage can be time consuming for large zones.

To change the zone type using a command line

  1. Open a command prompt.

  2. Type the following command, and then press ENTER:

    dnscmd <ServerName> /ZoneResetType <ZoneName Property> [<MasterIPaddress...>] [/file <FileName>] {/OverWrite_Mem|/OverWrite_Ds|/DirectoryPartition <FQDN>}

Parameter Description

dnscmd

Specifies the name of the command-line tool for managing DNS servers.

<ServerName>

Required. Specifies the DNS host name of the DNS server. You can also type the IP address of the DNS server. To specify the DNS server on the local computer, you can also type a period (.)

<ZoneName>

Required. Specifies the fully qualified domain name (FQDN) of zone.

<Property>

Required. One of the following zone types:

  • /Primary

    Standard primary zone. The /file FileName option is required.

  • /DsPrimary

    AD DS-integrated primary zone. If the zone is not already a primary zone, you must convert it to a primary zone (using /Primary) before you use this parameter to integrate the zone with AD DS.

  • /Secondary

    Secondary zone. You must specify at least one MasterIPaddress.

  • /Stub

    Stub zone. You must specify at least one MasterIPaddress. If the zone is an AD DS-integrated primary zone, you must use /DsStub to convert it to an AD DS-integrated stub zone before you use this parameter.

  • /DsStub

    AD DS -integrated stub zone. You must specify at least one MasterIPaddress. If the zone is not already a stub zone, you must convert it to a stub zone (using /Stub) before you use this parameter to integrate the zone with AD DS.

/file <FileName>

Required for /Primary. Specifies the name of a file for the new zone. This parameter is not valid for the /DsPrimary zone type.

<MasterIPaddress...>

Required for /Secondary, /Stub and /DsStub. Specifies one or more IP addresses for the master servers of the secondary zone or stub zone, from which zone data is copied.

/OverWrite_Mem | /OverWrite_Ds | /DirectoryPartition <FQDN>

/OverWrite_Mem overwrites existing DNS data using the data in AD DS. /OverWrite_Ds overwrites Active Directory data with data in DNS. /DirectoryPartition stores the new zone in the application directory partition that is specified by FQDN, such as DomainDnsZones.corp.widgets.tailspintoys.com.

To view the complete syntax for this command, at a command prompt, type the following command, and then press ENTER:

dnscmd /ZoneResetType /help

Additional considerations

  • To open an elevated Command Prompt window, click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.

  • You can select either primary zones, secondary zones, or stub zones. When you select the secondary or stub zone type, specify the IP address of another DNS server to be used as the source for obtaining updated information for the zone.

  • If the DNS server computer is operating as a domain controller, you can use the /DsPrimary or /DsStub parameters. These options are not otherwise available. When either zone type is selected for use, zone data is stored and replicated as part of the AD DS database.

    Note

    Before you use these options, you must first convert the zone to the appropriate type, if necessary. That is, the zone must already be a primary zone before you can use /DsPrimary to integrate the zone with AD DS. Similarly, the zone must already be a stub zone before you can use /DsStub to integrate the zone with AD DS.

  • Changing a zone from a secondary zone to a primary zone can affect other zone activities, including management of dynamic updates and zone transfers, and the use of DNS notify lists to notify other servers about changes in the zone.

  • Changing a zone from a stub zone to a primary zone or the reverse is not recommended. This contradicts the purpose of stub zones.


Performing a Staged Installation of a Read-Only Domain Controller

You can perform a staged installation of a read-only domain controller (RODC), in which different individuals complete the installation in two stages. You can use the Active Directory Domain Services Installation Wizard to complete each stage of the installation.

  • Using Advanced Mode Installation

  • Configuring Additional Domain Controller Options

  • Delegating Read-Only Domain Controller Installation and Administration

  • Specifying Password Replication Policy

  • Selecting a Read-Only Domain Controller Account

Description of a staged RODC installation

The first stage of the installation creates an account for the RODC in Active Directory Domain Services (AD DS). The second stage of the installation attaches the actual server that will be the RODC to the account that was previously created for it.

During the first stage, the Active Directory Domain Services Installation Wizard records all data about the RODC that will be stored in the distributed Active Directory database, such as the RODC's domain controller account name and the site in which it will be placed. This stage must be performed by a member of the Domain Admins group.

The user who creates the RODC account can also specify at that time which users or groups can complete the next stage of the installation. The next stage of the installation can be performed in the branch office by any user or member of a group who has been delegated the right to complete the installation when the account was created. This stage does not require any membership in built-in groups such as the Domain Admins group. If the user who creates the RODC account does not specify any delegate to complete the installation (and administer the RODC), only a member of the Domain Admins group or the Enterprise Admins group can complete the installation.

During the second stage of the installation, the wizard installs AD DS on the server that will become the RODC. This stage typically occurs in the branch office where the RODC is deployed. During this stage, all AD DS data that resides locally, such as the database, log files, and so on, is created on the RODC itself. The installation source files can be replicated to the RODC from another domain controller over the network, or you can use the install from media (IFM) feature. When you use IFM, use Ntdsutil.exe to create the installation media that is specifically created for an RODC installation. For more information about using IFM, see Installing from Media.

The server that will become the RODC must not be joined to the domain before you try to attach it to the RODC account. As part of the installation, the Active Directory Domain Services Installation Wizard automatically detects whether the name of the server matches the names of any RODC accounts that have been created in advance for the domain. When the wizard finds a matching account name, it prompts the user to use that account to complete the RODC installation.

Scenario for performing a staged installation

When an organization uses staged installation, it can deploy a domain controller to a branch office location more efficiently than it could with previous versions of Windows Server. For example, a member of the Domain Admins group in a central location can create an RODC account in AD DS. This stage of the installation completes all the deployment tasks that require Domain Admin credentials, such as creating the computer account for the domain controller, specifying the site for it, and creating an associated NTDS Settings object for the server.

When a member of the Domain Admins group creates the RODC account, he or she can delegate to another user or security group the right to complete the RODC installation at the branch office location. The task of attaching the server to the existing RODC account does not have to be performed by a member of the Domain Admins group. Any delegated administrator (or delegated group member) that the member of the Domain Admins group specifies during the first stage of the installation can perform this task.

The organization can order and ship the server directly to the branch office location where the RODC installation can be completed. In the past, domain controllers for branch offices often had to be ordered and shipped to a central location or staging site to be built before they were in turn shipped to the branch office location where they were to be deployed. As an alternative, installation media was created in a central location and then shipped to the branch office location to complete the domain controller installation. Staged installation of an RODC streamlines the domain controller deployment process by eliminating these intermediary installation steps.

How to perform staged installations

Before you can install an RODC, you must prepare your forest by running adprep /rodcprep. For more information about preparing your forest by running adprep, see Choosing an Active Directory Domain Services Deployment Configuration.

You can then create the RODC account by using the Active Directory Users and Computers snap-in. In the console tree, either right-click the Domain Controllers container or click the Domain Controllers container and click Action, and then click Pre-create Read-only Domain Controller account.

You can also create an RODC account by running dcpromo at the command line, but the command must also specify the name of the domain where you are installing the RODC. At the command line, type the following command, and then press ENTER:

dcpromo /CreateDCAccount /ReplicaDomainDNSName:DomainName

Where DomainName is the name of the domain where you plan to install an RODC.

After you create the RODC account, it appears in the Domain Controllers container as an unoccupied domain controller account until a delegated user attaches the server to it.

After the delegated administrator assigns a static IP address and configures the DNS client settings for the server, he or she can run the Active Directory Domain Services Installation Wizard to attach the server in the branch office to the existing RODC account. To attach the server to the existing account, open a command prompt on the server that will become the domain controller, type the following command, and then press ENTER:

dcpromo /UseExistingAccount:Attach

The delegated administrator is notified that the AD DS binaries are being installed. Then, the Active Directory Domain Services Installation Wizard automatically starts the second stage of the installation. The delegated administrator can add the /adv parameter to the dcpromo command or select the Use advanced mode installation check box on the Welcome to the Active Directory Domain Services Installation Wizard page in the wizard to specify the following additional installation options:

  • Whether to replicate data over the network or from media

  • Which domain controller to use as an installation partner

On the Network Credentials page of the wizard, the delegated administrator must enter the name of any domain in the forest where the RODC is being installed, along with alternate credentials to use for the installation. Alternate credentials are required to attach the server to an existing domain controller account because it must be performed by a domain user. However, the delegated administrator originally logged on to the server with a local administrator account because that server was not yet joined to the domain. Therefore, the delegated administrator must now specify the domain user account (or an account that is a member of the delegated administration group) that was delegated the right to install and administer the RODC when the member of the Domain Admins group created the account for the RODC.

Removing AD DS from an RODC

A delegated administrator can remove AD DS from the RODC by running Dcpromo.exe. The Active Directory Domain Services Installation Wizard requests information, including the password for the new local Administrator account, that is required to remove AD DS and make the computer a stand-alone server. You must restart the server to complete the removal of AD DS.

Detecting computer name and account conflicts

After the delegated administrator selects the name of the RODC account to attach the server to, the Active Directory Domain Services Installation Wizard verifies that the account is not currently used by an active domain controller. If the verification succeeds, the wizard automatically attempts to attach the server to that account and complete the installation.

If the wizard does not find a computer account with a matching name, it provides the delegated administrator with the chance to rename the server to another name that does match an existing computer account or to take other steps to remedy the name conflict.

If the wizard finds a matching domain controller account name but the account is enabled, the wizard attempts to contact that domain controller to verify that the domain controller is online. The wizard then proceeds as follows:

  • If the wizard can verify that another domain controller with the same name is already online, it blocks completion of the AD DS installation. In this case, the server on which the RODC installation is being performed must be renamed with the name of an RODC account that is not already in use.

  • If the wizard cannot verify that another domain controller with the same name is already online, it warns the delegated administrator that continuing with the installation will cause the domain controller that has the same account name to not function properly—if it is in fact online—despite the fact that it could not be contacted by the wizard.

    This condition can occur if an attempt to attach the server to the existing account was made previously but that attempt was canceled before the installation completed. In this case, the status of the RODC account might be changed from disabled to enabled before the installation is completed. If this happens, the delegated administrator can click OK to continue after the warning.

For more information, see Selecting a Read-Only Domain Controller Account.


Delegating Read-Only Domain Controller Installation and Administration

When you create an account for the installation of a read-only domain controller (RODC), you can specify which user or group will be responsible for subsequently attaching the server to the RODC account. If you do not specify a user or group, only a member of the Domain Admins group or the Enterprise Admins group can attach the server to the account. If you do specify a user or group who can attach the server to the account, that user or group will also be responsible for administering the RODC after the installation is complete. You can specify only one user or group for this purpose.

If you want a delegated RODC administrator to be able to have passwords cached on the RODC, you must add the user account for that administrator to the list of security principals who are allowed to cache their passwords on the RODC (also known as the Allowed List), along with the computer account that the delegated administrator will use. Failure to add the corresponding computer account to the Allowed List will prevent the RODC from authenticating the delegated administrator when the connection to a writable domain controller is not available. For more information about the Allowed List and setting the Password Replication Policy (PRP), see Specifying Password Replication Policy.

The user or group that you specify on this page in the Active Directory Domain Services Installation Wizard will have local administrative permissions on the RODC. As a practical matter, this means that the user or group has full control of the server, including the ability to log on locally, install additional software, install device drivers, and so on. The delegated user or group will also be able to remove Active Directory Domain Services (AD DS) from the RODC.

Therefore, delegate RODC installation and administration only to the users and groups that are required to have such access rights and permissions so that they can do their jobs. In addition, assign permissions to security groups rather than to individual users to simplify the process for changing those permissions when necessary.

You may want to create a security group specifically for the purpose of administering the RODC that you plan to deploy, and then specify that group name on this wizard page. That group will then appear in the Name field on the Managed By tab of the RODC properties sheet in the Active Directory Users and Computers snap-in, where you can change it anytime after the installation.

To search the directory for a specific user or group, click Set, and then type the name of the user or group. We recommend that you delegate RODC installation and administration to a group.


Specifying Password Replication Policy

The Specify the Password Replication Policy wizard page in the Active Directory Domain Services Installation Wizard appears when you create a read-only domain controller (RODC) account—but only if you select the Use advanced mode installation check box on the Welcome to the Active Directory Domain Services Installation Wizard page in the wizard.

How the Password Replication Policy works

The Password Replication Policy (PRP) determines how an RODC performs credential caching. Credential caching is the storage of user or computer credentials.

When users or computers in a site that is serviced by an RODC attempt to authenticate to the domain, by default the RODC cannot validate their credentials. The RODC then forwards the authentication request to a writable domain controller. However, there might be a set of security principals that may need to be able to authenticate in a site that is serviced by an RODC, even in cases where they have no connectivity to writable domain controllers.

For example, you might have a set of users and computers in a branch office that you want to be authenticated, even if there is no connectivity between the branch office and the sites that contain writable domain controllers. To resolve this issue, you can configure the PRP for that RODC to allow the passwords for those users to be cached on the RODC. If the account passwords are cached on the RODC, the RODC can authenticate those accounts when connectivity to writable domain controllers is not available.

The PRP acts as an access control list (ACL). It determines whether an RODC is permitted to cache credentials for an account. After the RODC receives a user or computer logon request, it attempts to replicate the credentials for that account from a writable domain controller that runs Windows Server 2008 or Windows Server 2008 R2. The writable domain controller refers to the PRP to determine if the credentials for the account should be cached. If the PRP allows the account to be cached, the writable domain controller replicates the credentials for that account to the RODC and the RODC caches them. During subsequent logons for that account, the RODC can authenticate the account by referring to the credentials that it has cached. The RODC does not have to contact the writable domain controller.

The PRP in operation

The PRP is defined by two multivalued Active Directory attributes that contain security principals (users, computers, and groups). Each RODC computer account has these two attributes:

  • msDS-Reveal-OnDemandGroup, also known as the Allowed List

  • msDS-NeverRevealGroup, also known as the Denied List

To help manage the PRP, two other attributes that are related to the PRP are maintained for each RODC:

  • msDS-RevealedList, also known as the Revealed List

  • msDS-AuthenticatedToAccountList, also known as the Authenticated to List

The msDS-Reveal-OnDemandGroup attribute specifies what security principals can have passwords cached on an RODC. By default, this attribute has one value, which is the Allowed RODC Password Replication Group. Because this domain local group has no members by default, no account passwords can be cached on any RODC by default.

This section explains how the Allowed List, Denied List, Revealed List, and Authenticated to List attributes are used.

When an RODC makes a request to replicate a user's password, the writable Windows Server 2008 domain controller that the RODC contacts allows or denies the request. To allow it or deny the request, the writable domain controller examines the values of the Allowed List and the Denied List for the RODC that presents the request.

If the account whose password is being requested by the RODC is in the Allowed List (rather than the Denied List) for that RODC, the request is allowed.

The following illustration shows how this operation proceeds.

Process for applying a Password Replication Policy

The Denied List takes precedence over the Allowed List.

For example, suppose an organization has a security group for administrators named Admins. The organization has one site named S1 and a security group named Emp_S1 that contains employees in the site. The organization has another site named S2 and a security group named Emp_S2 that contains employees in the site.

Site S2 has only an RODC. Bob is an administrator who works at the site S2. Therefore, he belongs to both groups Emp_S2 and Admins. When the RODC in site S2 is installed, the security groups that are listed in the following table are added to the PRP.

Security group | PRP setting
Admins | Denied
Emp_S2 | Allowed

According to the specified policy, the credentials that can be cached on the RODC in site S2 are only the credentials for members of the Emp_S2 group that do not belong to Admins. Members of the Emp_S1 and Admins groups will never have their credentials cached on the RODC. Members of the Emp_S2 group may have their credentials cached on the RODC. Bob's credentials will never be cached on the RODC.

Default PRP settings

Each RODC has a PRP that defines which accounts are allowed to have their passwords replicated to the RODC and which accounts are explicitly denied from having their passwords replicated to the RODC. The default policy specifies the groups and settings in the following table.

Group name | PRP setting
Administrators | Deny
Server operators | Deny
Backup operators | Deny
Account operators | Deny
Denied RODC Password Replication Group | Deny
Allowed RODC Password Replication Group | Allow

The Denied RODC Password Replication Group has the following domain account members by default:

  • Cert Publishers

  • Domain Admins

  • Enterprise Admins

  • Enterprise Domain Controllers

  • Enterprise Read-Only Domain Controllers

  • Group Policy Creator Owners

  • krbtgt

  • Schema Admins

The Allowed RODC Password Replication Group has no members by default.

The default PRP improves the security of an RODC installation by ensuring that no account passwords are stored by default and that security-sensitive accounts (such as members of the Domain Admins group) are explicitly denied from ever having their passwords stored on the RODC.

Modifying the default PRP

You can modify the default PRP when you create an account for the RODC or after the RODC account is created. To modify the default PRP after the RODC account is created, right-click the RODC account in the Domain Controllers organizational unit (OU) in the Active Directory Users and Computers snap-in, click Properties, and then click the Password Replication Policy tab. (To open the Active Directory Users and Computers snap-in, click Start, point to Administrative Tools, and then click Active Directory Users and Computers.)

To add accounts to the default PRP when you create the RODC account, click Add on the Specify Password Replication Policy wizard page, and then specify whether to allow or deny passwords for the account to be stored on the RODC. Then, use the Select Users, Computers, or Groups dialog box to select the accounts to add.

You must include the appropriate user, computer, and service accounts in the PRP to allow the RODC to satisfy authentication and service ticket requests locally. If you do not include the computer accounts that the branch users will use to log on to the network in the Allowed List, the RODC will not be able to satisfy requests for service tickets locally and it will rely on access to a writable domain controller to satisfy those requests. If the wide area network (WAN) is offline, this might cause a service outage.

The Deny setting takes precedence over the Allow setting. If both settings are specified for a given user—either directly, or indirectly because the user is a member of a security group that is specified (or nested within a specified security group)—the user's password cannot be stored on the RODC. It is important to note, however, that a user whose password cannot be stored on the RODC can still use the RODC for logon if the WAN connection to a writable domain controller is available. The password for the user is not replicated to the RODC, but the logon can be authenticated by the writable domain controller over the WAN.

The following table describes the advantages and disadvantages of three examples of configurations for a PRP.

Example | Pros | Cons
No accounts are cached (default). | Most secure—users are authenticated by a writable domain controller, and they get their Group Policy from the RODC for fast policy processing. | No offline access for anyone—a WAN is required for logon.
Most accounts are cached. | Ease of password management—this option is intended for organizations that care most about the manageability improvements of RODC, not security. | More passwords are potentially exposed to an RODC.
Few accounts are cached. | Enables offline access for those users who need it, but provides more security than caching most accounts. | This method requires more detailed administration. You may have to map users and computers to each branch that has an RODC. You may also use tools, such as repadmin /prp, to move accounts that have authenticated to an RODC to a group that is in the Allowed List, or you may have to use Identity Lifecycle Manager (ILM) to automate that process.

The following sections explain each example in more detail.

No accounts are cached

This example provides the most secure option. No passwords are replicated to the RODC, except for the RODC computer account and its special krbtgt account. However, user and computer authentication relies on WAN availability. This example has the advantage of requiring little or no additional administrative configuration from the default settings.

You might choose to add your own security-sensitive user groups to the Denied List. Although no accounts are cached by default, adding your own security-sensitive user groups to the Denied List can protect those groups against accidental inclusion in the Allowed List, along with subsequent caching of their passwords on the RODC.

Note that the delegated RODC administrator account is not added automatically to the Allowed List. As a best practice, add the delegated RODC administrator account to the Allowed List to ensure that a delegated administrator can always log on to the RODC, regardless of whether the WAN connection to a writable domain controller is available.

Most accounts are cached

This example is the simplest administrative mode, and it removes the dependency on WAN availability for user and computer authentication. In this example, you populate the Allowed List for all RODCs with groups that represent a significant portion of the user and computer population. The Denied List does not allow security-sensitive user groups, such as Domain Admins, from having passwords cached. Most other users, however, can have their passwords cached on demand. You might choose to add your own security-sensitive user groups to the Denied List.

This configuration is most appropriate in environments where the physical security of the RODC will not be at risk. For example, you might configure the PRP this way for an RODC that you have deployed in a secure location primarily to take advantage of its reduced replication and administration requirements.

Important

You must also add the users' computer accounts to the Allowed list so that those users can log on at the branch office when the WAN is offline.

Few accounts are cached

This example restricts the accounts that can be cached. Typically, you define this distinctly for each RODC—each RODC has a different set of user and computer accounts that it is permitted to cache. This example is usually for a set of users who work at a particular physical location.

The advantage of this example is that a set of users will be able to log on to the network and be authenticated by the RODC in the branch office if the WAN is offline. At the same time, the scope of exposure for passwords is limited by the reduced number of users whose passwords can be cached.

There is administrative overhead associated with populating the Allowed List and the Denied List in this example. There is no default automated method for reading accounts from the known list of security principals who have authenticated against a given RODC, and there is no default method for populating the Allowed List with those accounts. You can use the repadmin /prp move command to move these accounts to a group that is in the Allowed List, or you can use scripts or applications such as ILM to build a process.

Although you can add user or computer accounts directly to the Allowed List, you should instead create a security group for each RODC, add it to the Allowed List and then add user and computer accounts to the security group. This way, you can use standard group management tools such as the Active Directory Users and Computers snap-in or the Dsadd or Dsmod command-line tools to manage which accounts can be cached on the RODC.

The repadmin /prp move command requires that you specify a security group. If the security group that you specify does not exist, it creates the group and adds it to the Allowed list.

As with the previous example, you must also add appropriate computer accounts to the Allowed List.


Selecting a Read-Only Domain Controller Account

To attach the server to the read-only domain controller (RODC) account, you must rename the server that will become the RODC with the name of the RODC account that was created for it by the domain administrator. The Active Directory Domain Services Installation Wizard matches the name of the server to the name of the RODC account that was created for the server.

Note

The server that you plan to attach the account to must not be joined to the domain when you start the Active Directory Domain Services Installation Wizard.

On the Select Domain Controller Account page, the wizard lists all the potential matching accounts for each domain in the forest that you specified on the Network Credentials page earlier in the wizard. You cannot select accounts from other forests.

The Active Directory Domain Services Installation Wizard provides a message that confirms that it was able to find one, and only one, RODC account with the same name. If it finds more than one account name that could be a match, you can select an account from the possible accounts that the wizard lists. You can select only one account.

If the wizard does not find an RODC account for the name that you specify, the wizard provides a message that states that the name you provide must match the name of the RODC account that was created previously. In this case, you can either:

  • Rename the computer to a name that matches an RODC account that has been created.

    Or

  • Have a domain administrator create a new RODC account, and specify an RODC account name that matches the name that you plan to provide for the server that will become the RODC in the branch office location.

The wizard does not proceed until you select exactly one matching account. After you select a matching RODC account, the wizard performs additional verification tests.

The wizard first verifies that you have permission to attach the server to the selected account. The member of the Domain Admins group grants this permission to a delegated user or group when he or she creates the RODC account. Only the following users can join the computer to the selected RODC account:

  • The delegated user

  • A member of the delegated group

  • A member of the Domain Admins group

  • A member of the Enterprise Admins group

After the wizard verifies the user credentials, the wizard determines whether the RODC account is enabled (that is, whether the account is already in use). If the RODC account is not enabled, the wizard proceeds with the RODC installation. If the RODC account is enabled, the wizard attempts to contact the computer that already has this account enabled.

If the wizard successfully contacts a computer that already has this account enabled, you have provided the name of a domain controller that is already functioning on the network. In this case, the wizard provides a message that indicates that the installation cannot continue. Instead, you must rename the computer to match the name of an RODC account that is not already in use.

If the Active Directory Domain Services Installation Wizard cannot contact a computer that has this account enabled, it provides a message that warns that if you continue to install AD DS and the other server with the same name does exist, the other server will no longer function properly. In this case, you can perform additional network diagnostic tests to determine if the computer that has the enabled account is currently functioning on the network. You can perform these additional network diagnostic tests, such as using the ping command, independently from the wizard. After you resolve the issue, you can continue with the wizard to complete the installation.

When you create the RODC account, the wizard automatically generates a NetBIOS name based on the Domain Name System (DNS) name that you provide. To use a different NetBIOS name, use the ADSI Edit snap-in to modify the NetBIOS name after you create the RODC account.


Removing Active Directory Domain Services

When you run Dcpromo.exe on a domain controller, the Active Directory Domain Services Installation Wizard detects that Active Directory Domain Services (AD DS) is already installed on the server. The wizard then starts and prompts you for information that it needs to uninstall AD DS on the server.

You can start the Active Directory Domain Services Installation Wizard on a domain controller in the following ways:

  • On the domain controller, click Start, click Run, type dcpromo, and then click OK. As an alternative, you can type dcpromo at a command prompt, and then press ENTER.

  • Click Start, click Server Manager, and then, under Roles Summary, click Remove Roles. Server Manager is also available on the Administrative Tools menu or through an icon in the notification area.

When it removes AD DS, the Active Directory Domain Services Installation Wizard informs you if the domain controller is a global catalog server so that you can ensure that other global catalog servers are still available to handle user logon requests as necessary.

When you delete the last domain controller in a domain, you delete the domain. Ensure that the domain user accounts and computer accounts are no longer required. You must delete any unoccupied or disabled RODC accounts that remain in the domain before you can remove the last domain controller. In addition, export all cryptographic keys that are stored on the server before you use the wizard to delete the domain.

Review the list of application directory partitions that the domain controller holds the last replica for. Have the wizard remove the Domain Name System (DNS) application directory partitions that it created during the AD DS installation. To remove any other application directory partitions, use a utility that the application provides. For more information, see Removing Application Directory Partitions.

If you are deleting a child domain that uses Active Directory–integrated DNS, the wizard lists the DNS application directory partition for that domain. This partition distinguished name appears in the list as DC=DomainDNSZones,DC=domain_name.

If you are deleting the forest root domain, the wizard lists the DNS application directory partition for the forest in addition to the DNS application directory partition for that domain. The partition distinguished name for the forest-wide DNS zone appears in the list as DC=ForestDNSZones,DC=domain_name.

You can also use remove the AD DS binaries that are associated with the AD DS server role. You must remove the AD DS server role before you remove the AD DS binaries. The process for removing the AD DS binaries is as follows:

  1. Remove the AD DS server role. This step does not remove the AD DS binaries that are associated with the AD DS server role.

  2. Restart the server.

  3. Remove the AD DS server role binaries. This step may require another restart of the server.

The recommended methods for removing the AD DS binaries are:

  • Use the Remove Roles Wizard in Server Manager.

  • Use Dcpromo.exe. At a command prompt, type the following command, and then press ENTER:

    dcpromo /UninstallBinaries

The following topics provide more information about specific wizard pages that you may encounter when you remove AD DS:

  • Providing Network Credentials to Install or Remove Active Directory Domain Services

  • Removing Application Directory Partitions

  • Performing Metadata Cleanup


Removing Application Directory Partitions

An application directory partition is a directory partition that is replicated only to specific domain controllers. Application directory partitions are usually created by the applications that use them to store and replicate data. A domain controller that participates in the replication of a particular application directory partition hosts a replica of that partition.

For example, Domain Name System (DNS) application directory partitions are created by default on domain controllers that run Windows Server 2008 R2 if they are also hosting Active Directory–integrated DNS zones. The following DNS application directory partitions are created on these domain controllers:

  • DomainDNSZones: This application directory partition includes DNS data that is replicated to all domain controllers in the domain.

  • ForestDNSZones: This application directory partition includes DNS data that is replicated to all domain controllers in the forest.

The Active Directory Domain Services Installation Wizard can remove these DNS application directory partitions when it removes Active Directory Domain Services (AD DS) from the last domain controller that hosts the partitions.

If you are removing the last domain controller in the domain, the wizard lists the distinguished name for the DomainDNSZones application directory partition. If you are removing the last domain controller in the forest, the wizard lists the distinguished name for the ForestDNSZones application directory partition. You can click Next to have the wizard remove these DNS application directory partitions.

Before you delete the last replica of any other application directory partition, identify the applications that use the application directory partition, determine if it is safe to delete the last replica, identify the partition deletion tool that the application provides, and then remove the application directory partition by using the tool that is provided or by using the Ntdsutil command-line tool if no tool is provided.

Identify the applications that use the application directory partition

To determine what application directory partitions are hosted on a computer, refer to the list on the Application Directory Partitions page in the Active Directory Domain Services Installation Wizard. If the list does not provide enough information to identify the applications that use a particular application directory partition, you may be able to identify them in one of the following ways:

  • Consult a member of the Enterprise Admins group.

  • Consult network change-control records that your organization maintains.

  • Use Ldp.exe or the ADSI Edit snap-in to view the data that is contained in the partition.

Determine if it is safe to delete the last replica

Removing the last replica of an application directory partition causes the permanent loss of any data that is contained in the partition. If you have identified the applications that are using the application directory partition, consult the documentation that is provided with those applications to determine if there is any reason to keep the data. If the applications that use the application directory partition are out of service, it is probably safe to remove the partition.

If it is not safe to delete the last replica, or if you cannot determine whether or not it is safe and you must demote the domain controller that holds the last replica of a particular application directory partition, follow these steps:

  1. Add a replica of the partition on another domain controller.

  2. Wait for the contents of the application directory partition to replicate to the domain controller that holds the new replica.

  3. Remove the replica of the partition on the domain controller to be demoted by using the partition management subcommand of Ntdsutil.exe. For more information, see the Ntdsutil partition management topic in Command Reference (http://go.microsoft.com/fwlink/?LinkId=94210).

Identify the partition deletion tool that is provided by the application

Most applications that create application directory partitions provide a tool to remove the partitions. When possible, always delete an application directory partition by using the tool that the application provides. For example, to delete a Telephony API (TAPI) partition, use the Tapicfg.exe command-line tool. Refer to an application's documentation for information about removing application directory partitions that the application creates and uses.

If you cannot identify the application that created the application directory partition or if your application does not provide a tool to delete application directory partitions that it created, you can use the Ntdsutil command-line tool. Use the partition management subcommand of ntdsutil to remove the application directory partition.

Caution

If possible, use the application's tool for managing its application directory partitions. The application may keep other data in addition to Active Directory–managed data for the application directory partitions. If you use Ntdsutil to manage the application directory partition, the two sets of data might cause a conflict.


Performing Metadata Cleanup

The Active Directory Domain Services Installation Wizard automatically removes associated metadata from the forest when it successfully removes Active Directory Domain Services (AD DS) from a domain controller. However, certain conditions, such as lack of network connectivity, may prevent the wizard from successfully removing AD DS. If you force the removal of AD DS because the wizard cannot run successfully on the domain controller, you must delete the domain controller object. If you perform the deletion on a domain controller that runs Windows Server 2008 or Windows Server 2008 R2, the metadata that is associated with the deleted domain controller is cleaned up automatically. This eliminates the need to perform metadata cleanup, as is required for domain controllers that run Windows 2000 Server or Windows Server 2003.

To delete the domain controller object, open the Active Directory Users and Computers snap-in or the Active Directory Sites and Services snap-in, navigate to the domain controller object that you want to delete, right-click it, and then click Delete.

For more information, see AD DS Installation and Removal Step-by-Step Guide (http://go.microsoft.com/fwlink/?LinkID=139657).


Unattended Installation Return Codes

When the unattended installation of Active Directory Domain Services (AD DS) completes, Dcpromo returns one of the following codes to indicate the status of the operation. Unused numbers are reserved for future use.

  • 1-10 = success return codes

  • 11-100 = failure return codes

For more information, see AD DS Installation and Removal Step-by-Step Guide (http://go.microsoft.com/fwlink/?LinkID=139657).

Success return codes

The codes in the following table indicate successful completion of an AD DS installation or removal operation.

Value | Case | Description
1 | ExitSuccess | The operation succeeded.
2 | ExitSuccessNeedReboot | The operation succeeded, and the server must be restarted manually.
3 | ExitSuccessWithNonCriticalFailure | The operation succeeded, but there has been a failure, such as a failure with Domain Name System (DNS) installation or delegation configuration. Check Dcpromoui log files, and investigate further.
4 | ExitSuccessWithNonCriticalFailureNeedReboot | The operation succeeded, but there has been a failure, such as a failure with DNS installation or delegation configuration, and the server must be restarted manually. Check Dcpromoui log files, and investigate further.

Failure return codes

The codes in the following table indicate failed completion of an AD DS installation or removal operation.

Value | Case | Description
11 | ExitAlreadyRunning | Dcpromo is already running.
12 | ExitMustBeAdministrator | The user must be a local administrator on the computer.
13 | ExitCertSvcInstalled | Active Directory Certificate Services (AD CS) is installed.
14 | ExitInSafeBootMode | The server is running in Safe Mode.
15 | ExitRoleChangePending | A role change is in progress or requires that the server be restarted.
16 | ExitIncorrectPlatform | The server is running on the wrong platform.
17 | ExitNeedNTFS5Drive | No drives are formatted for NTFS 5.
18 | ExitInsufficientWinDirSpace | %windir% does not have enough space.
19 | ExitNameChangeNeedsReboot | A name change is pending, and the computer must be restarted.
20 | ExitBadComputerName | The computer name uses syntax that is not valid.
21 | ExitHoldsFSMOs | This domain controller holds an operations master (also known as flexible single master operations or FSMO) role, is a global catalog server, or is a DNS server.
22 | ExitNeedToInstallTcpIp | TCP/IP must be installed or is not functioning.
23 | ExitNeedToConfigDnsFirst | The DNS client must be configured first.
24 | ExitBadCredentials | The supplied credentials are not valid or are missing required elements.
25 | ExitDcNotFound | A domain controller for the specified domain could not be located.
26 | ExitUnableReadDomainList | The list of domains could not be read from the forest.
27 | ExitMustSpecifyDomain | A domain name is missing (parent, child, tree, or forest).
28 | ExitBadDomainName | The domain name is not valid.
29 | ExitParentDomainNotExists | The parent domain does not exist.
30 | ExitDomainNotInForest | The specified domain is not found in the forest.
31 | ExitChildDomainExists | The child domain already exists.
32 | ExitBadNetbiosDomainName | The NetBIOS name is not valid.
33 | ExitBadIFMPath | The path to the install from media (IFM) files is not valid.
34 | ExitBadIFMDatabase | The IFM database is bad.
35 | ExitNoSyskeyForIFM | A system key is required for the IFM database.
37 | ExitBadDBPath | The database path or database log path is not valid.
38 | ExitInsuffSpaceForDB | The volume does not have enough space for the database or the database log.
39 | ExitBadSysVolPath | The SYSVOL path is not valid.
40 | ExitBadSiteName | The site name is not valid.
41 | ExitMustSpecifySafeModePwd | You must specify a password for Safe Mode.
42 | ExitBadSafeModePwd | The Safe Mode password does not meet password complexity criteria.
43 | ExitBadAdminPwd | The administrator password does not meet criteria.
44 | ExitBadForestName | The specified forest name is not valid.
45 | ExitForestExists | A forest with the specified name already exists.
46 | ExitBadTreeName | The specified name for the tree is not valid.
47 | ExitTreeExists | A tree with the specified name already exists.
48 | ExitTreeNotFitInForest | The tree name does not fit into the forest structure.
49 | ExitDomainNotExists | The specified domain does not exist.
50 | ExitLastDcMismatch | This is not the last domain controller although it was indicated to be the last domain controller, or this is the last domain controller although it was not indicated to be the last domain controller.
51 | ExitUnconfirmedAppPartitions | Application partitions that have not been approved for removal exist on this domain controller.
52 | ExitRequiredParameterMissing | An answer file or command-line unattended installation parameters were not provided.
53 | ExitPromoDemotFailedNeedReboot | The installation or removal failed and the server must be restarted.
54 | ExitPromoDemotFailed | The installation or removal failed.
55 | ExitPromoDemoteFailedBecauseUserCancelled | The installation or removal failed because it was canceled by the user.
56 | ExitPromoDemotFailedBecauseUserCancelledNeedReboot | The installation or removal failed because it was canceled by the user. The computer must be restarted to return to the previous state.
57 | ExitDomainReadOnlyReplicaGroupNotSpecified | The operator failed to specify one of the required read-only domain controller (RODC) groups (Allowed/Denied).
58 | ExitDomainReadOnlyReplicaSiteNotSpecified | The operator failed to specify the site name for an RODC.
59 | ExitLastDnsServer | The domain controller is the last DNS server for one of its Active Directory–integrated zones.
61 | ExitInstallDNSNotAllowed | You cannot install AD DS with DNS in an existing domain that does not already host DNS.
62 | ExitAnswerFileMissingSectionName | The answer file does not have a [DCInstall] section.
63 | ExitInsufficientForestFunctionalLevelForRodc | The forest functional level is less than Windows Server 2003. The forest functional level must be Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2 to add an RODC to the forest.
64 | ExitPromoFailedBecauseComponentBinaryDetectionFailed | The installation failed because the installation of the AD DS binaries on the server could not be determined.
65 | ExitPromoFailedBecauseComponentBinaryInstallationFailed | The installation failed because the AD DS binaries could not be installed.
66 | ExitPromoFailedBecauseOSDetectionFailed | The installation failed because the operating system installation option (a full installation or a Server Core installation) could not be determined.
68 | ExitInvalidReplicationPartner | The replication partner is not valid.
69 | ExitRequiredPortInUse | The required port is already in use by some other application.
70 | ExitForestRootDcMustBeGc | The first forest root domain controller must be a global catalog server.
71 | ExitDnsAlreadyInstalled | The DNS Server service is already installed.
72 | ExitIsAppServer | The installation failed because the server is a Remote Desktop Services application server.
73 | ExitInvalidForestFunctionalLevel | The specified forest functional level is not valid.
74 | ExitInvalidDomainFunctionalLevel | The specified domain functional level is not valid.
75 | ExitDefaultPasswordReplicationPolicyCannotBeDetermined | The default password replication policy cannot be determined.
76 | ExitInvalidPasswordReplicationPolicy | Specified Allowed and Denied security groups for the password replication policy are not valid.
77 | ExitInvalidArgument | The specified argument is not valid.
78 | ExitForestCheckFailed | The installation failed because the Active Directory forest could not be examined.
79 | ExitRodcNDNCNotPrepped | An RODC cannot be installed because adprep /rodcprep has not been performed.
80 | ExitDomainNotPrepped | The installation failed because adprep /domainprep has not been performed.
81 | ExitForestNotPrepped | The installation failed because adprep /forestprep has not been performed.
82 | ExitForestSchemaMismatch | The installation failed because there is a forest schema mismatch.
83 | ExitUnsupportedSku | The installation failed because the operating system edition does not support AD DS.
84 | ExitDcAccountDetectionFailed | Unable to detect a domain controller account.
85 | ExitDcAccountSelectionFailed | Unable to select a domain controller account to which this server can be attached.
86 | ExitStage2Required | You must attach the server to an existing account.
87 | ExitDcAccountConflictingType | An RODC or writable domain controller account in the domain exists, but it does not match the type of domain controller that you want to install. Installation cannot continue.
88 | ExitServerAdminInvalid | The specified RODC server administrator is not valid.
89 | ExitRidMasterOffline | The relative ID (RID) master for the specified domain is offline.
90 | ExitDNMasterOffline | The domain naming master is offline.
91 | ExitWow64ProcessDetectionFailed | Failed to detect if the process is Wow64.
92 | ExitWow64ProcessNotSupported | The Wow64 process is not supported.
93 | ExitDcServiceNotRunningForRegularDemotion | The removal of AD DS failed because the AD DS service is not running.
94 | ExitBadLocalAdminPwd | The local administrator password does not meet complexity requirements. It could be that the password is either blank or not required.
95 | ExitCannotDemoteLastLHDC | Cannot demote the last domain controller that runs Windows Server 2008 or Windows Server 2008 R2 in a domain where an operational RODC exists.
96 | ExitComponentBinaryUninstallFailed | The AD DS binaries failed to uninstall.
97 | ExitFFLNotSupported | The specified forest functional level is not supported.


Common Configurations for Active Directory Domain Services

This section includes topics about common configurations for Active Directory Domain Services (AD DS). You can access all of these topics on the Active Directory Domain Services server role page in Server Manager. Under Resources and Support, you can view a description for each configuration in this list, and you can click links for more information from online resources.

  • Improve Active Directory Redundancy by Adding Another Domain Controller

  • Optimize Resource Access or Network Utilization by Deploying an Additional Domain

  • Improve Security and Reduce Network Traffic for a Branch Office by Deploying an RODC

  • Ensure Successful Active Directory Operations by Managing Operations Master Roles

  • Optimize Network Utilization Across Geographic Locations by Adding an Active Directory Site

  • Share Resources with Other Forests by Creating Trust Relationships

  • Help Prepare for Disaster Recovery by Performing Routine Backups of the Active Directory Database

  • Reduce Directory Size and Ensure Its Integrity and Performance by Performing Offline Defragmentation

  • Improve Resource Access Efficiency by Using Security Groups

  • Ensure That DNS Clients Can Locate Domain Controllers by Configuring DNS Support for AD DS

  • Simplify Active Directory Administration by Delegating Management of Users, Computers, and Other Network Resources

  • Simplify Management of User and Computer Accounts by Using Group Policy to Apply Common Configurations

  • Consolidate Servers by Retiring a Domain Controller and Removing AD DS from the Server

  • Ensure That Clients Can Access Resources by Configuring Time Synchronization Throughout the Forest

  • Enable Advanced Features by Raising the Domain or Forest Functional Level

  • Ensure Replication of Group Policy Objects and Network Scripts in SYSVOL by Using FRS and DFS Replication


Improve Active Directory Redundancy by Adding Another Domain Controller

You can add domain controllers to a domain to improve load balancing in a site and fault tolerance in a domain. Additional domain controllers improve the performance of authentication requests and global catalog server lookups. They also help Active Directory Domain Services (AD DS) overcome hardware, software, or administrator errors. When you add a domain controller, information is replicated over the network.

Deploying another domain controller

The following table lists the steps that you can take to add another domain controller to a domain.

Note

The following table refers to running Adprep.exe to prepare your environment for a domain controller that runs Windows Server 2008 R2. Adprep.exe is located in the support\adprep folder of the Windows Server 2008 R2 installation disc. In addition, Windows Server 2008 R2 includes a 32-bit version (Adprep32.exe) and a 64-bit version (Adprep.exe). The 64-bit version runs by default. If you are running Adprep on a 32-bit computer, run the 32-bit version.

 | Step | Reference
Check box | If this is the first domain controller in your forest that runs Windows Server 2008 R2, prepare the forest schema by running adprep forestprep. | Prepare a Windows 2000 or Windows Server 2003 Forest Schema for a Domain Controller That Runs Windows Server 2008 or Windows Server 2008 R2 (http://go.microsoft.com/fwlink/?LinkId=93242)
Check box | If this is the first domain controller in your domain that runs Windows Server 2008 R2, prepare the domain by running adprep /domainprep /gpprep. | Prepare a Windows 2000 or Windows Server 2003 Domain for a Domain Controller That Runs Windows Server 2008 or Windows Server 2008 R2 (http://go.microsoft.com/fwlink/?LinkId=93243)
Check box | If you plan to install a read-only domain controller (RODC), raise the forest functional level to Windows Server 2003. | Raising the Functional Levels (http://go.microsoft.com/fwlink/?LinkId=93174)
Check box | If you are installing the first RODC in your forest, prepare your forest by running adprep /rodcprep. | Prepare a Forest for a Read-Only Domain Controller (http://go.microsoft.com/fwlink/?LinkId=93244)
Check box | Determine the user account and password that you will use to install the domain controller. The account must be a member of the Domain Admins group in the domain where you are installing the domain controller, or it must be delegated sufficient privileges. | Providing Network Credentials to Install or Remove Active Directory Domain Services
Check box | Determine the fully qualified Domain Name System (DNS) name of the domain where you plan to install the domain controller. Your AD DS design team may provide this information. | Collect Regional Domain Design Information (http://go.microsoft.com/fwlink/?LinkId=93249)
Check box | Decide where you plan to store the database, log files, and SYSVOL. For improved performance and efficient backup and recovery operations, store these components on separate volumes. | Placing Active Directory Domain Services Files
Check box | If you plan to install from media (IFM), use the ntdsutil ifm subcommand to create the installation media. | Installing AD DS from Media (http://go.microsoft.com/fwlink/?LinkId=93264)
Check box | Determine a strong password that you will assign for the Directory Services Restore Mode (DSRM) account. | Providing a Directory Services Restore Mode Administrator Password
Check box | Determine which additional domain controller options you want to install. For example, determine if you want the domain controller to be a DNS server, global catalog server, or an RODC. | Configuring Additional Domain Controller Options
Check box | Use Dcdiag.exe to verify connectivity with operations masters. | Verify the availability of the operations masters (http://go.microsoft.com/fwlink/?LinkId=93271)
Check box | Install AD DS. | Installing an Additional Domain Controller (http://go.microsoft.com/fwlink/?LinkId=93254)


Optimize Resource Access or Network Utilization by Deploying an Additional Domain

By default, an Active Directory forest includes one domain. If necessary, you can deploy an additional domain to isolate the replication of domain data, such as computer accounts, user accounts, and group accounts. Domain data is replicated only to the domain controllers for that domain. You may create additional domains for business requirements, such as a planned acquisition of a business unit.

Deploying an additional domain

The following table lists the steps that you can take to deploy an additional domain.

 | Step | Reference
Check box | Review domain design information and determine what (if any) additional domains you need. | Determining the Number of Domains Required (http://go.microsoft.com/fwlink/?LinkId=93247)
Check box | Complete the steps for deploying a regional domain. | Deploying Active Directory Regional Domains (http://go.microsoft.com/fwlink/?LinkId=93248)


Improve Security and Reduce Network Traffic for a Branch Office by Deploying an RODC

A read-only domain controller (RODC) hosts read-only partitions of the Active Directory database. RODCs provide a way for you to deploy a domain controller in scenarios where physical security cannot be guaranteed, such as branch office locations, or in scenarios where local storage of all domain passwords is considered a primary threat, such as an extranet or for specific application support. Because RODC administration can be delegated to a domain user or a security group, an RODC is well suited for a site that does not have a user who is a member of the Domain Admins group.

Before you can install an RODC, the forest functional level must be Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2. You can install an RODC on a full installation or a Server Core installation ofWindows Server 2008 R2. You can also perform a staged RODC installation, in which the installation is completed in two stages. For more information about performing a staged RODC installation, see Performing a Staged Installation of a Read-Only Domain Controller.

Deploying an RODC

The following table lists the steps that you can take to deploy an RODC.

 | Step | Reference
Check box | Raise the forest functional level to Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2. | Raising the Functional Levels (http://go.microsoft.com/fwlink/?LinkId=93174)
Check box | Run adprep /forestprep. | Prepare a Windows 2000 or Windows Server 2003 Forest Schema for a Domain Controller That Runs Windows Server 2008 or Windows Server 2008 R2 (http://go.microsoft.com/fwlink/?LinkId=93242)
Check box | Run adprep /domainprep /gpprep. | Prepare a Windows 2000 or Windows Server 2003 Domain for a Domain Controller That Runs Windows Server 2008 or Windows Server 2008 R2 (http://go.microsoft.com/fwlink/?LinkId=93243)
Check box | Run adprep /rodcprep. | Prepare a Forest for a Read-Only Domain Controller (http://go.microsoft.com/fwlink/?LinkId=93244)
Check box | Install at least one writable domain controller that runs Windows Server 2008 or Windows Server 2008 R2. For fault tolerance, you can deploy multiple writable domain controllers. | Steps for Installing AD DS (http://go.microsoft.com/fwlink/?LinkId=93245)
Check box | Install an RODC, either by performing a normal installation or by performing a staged installation. | Performing a Staged RODC Installation (http://go.microsoft.com/fwlink/?LinkId=93246) Installing an Additional Domain Controller (http://go.microsoft.com/fwlink/?LinkId=93254)

See Also

  • Performing a Staged Installation of a Read-Only Domain Controller


Ensure Successful Active Directory Operations by Managing Operations Master Roles

Operations master roles (also known as flexible single master operations or FSMO) are configured by default when Active Directory Domain Services (AD DS) is installed. Typically, these roles do not require ongoing management. However, for a change such as a replacement of a domain controller, you may have to transfer the operations master roles to another domain controller. As a last resort in case you cannot transfer an operations master role, you can seize the role to another domain controller.

Managing an operations master role

The following table lists the steps that you can take to transfer or seize an operations master role.

 | Step | Reference
Check box | Transfer an operations master role. | Transferring an Operations Master Role (http://go.microsoft.com/fwlink/?LinkId=93239)
Check box | Seize an operations master role. | Seizing an Operations Master Role (http://go.microsoft.com/fwlink/?LinkId=93240)


Optimize Network Utilization Across Geographic Locations by Adding an Active Directory Site

Sites are boundaries for intrasite replication. They provide a way to define which domain controller is used for authentication and directory searches by a collection of client computers on a common IP subnet. Sites are created for IP subnets that contain a large number of users or a small number of users who need to avoid authentication and directory searches across a wide area network (WAN) link. Sites also provide a way for site-aware clients to target authentication requests, directory searches, and other operations against a domain controller in the same site or in a nearby site.

Creating an Active Directory site

The following table lists the references that you can use when you need to create an Active Directory site.

 | Step | Reference
Check box | On a domain controller, click Start, click Administrative Tools, click Active Directory Sites and Services, and then press F1. Review the Help topic titled Checklist: Configure an Additional Site. | Active Directory Sites and Services Help
Check box | On a domain controller, click Start, click Administrative Tools, click Active Directory Sites and Services, and then press F1. Review the Help topic titled Adding a Site to the Forest. | Active Directory Sites and Services Help
Check box | Review the information on the Web and complete the steps for creating an Active Directory site. | Adding a New Site (http://go.microsoft.com/fwlink/?LinkId=93237)


Share Resources with Other Forests by Creating Trust Relationships

When a trust exists between two Active Directory forests, the authentication mechanisms for each forest trust the authentications that come from the other forest. Trusts help to control access to shared resources in a resource domain (the trusting domain) by verifying that incoming authentication requests come from a trusted authority (the trusted domain). Trusts between forests can be external trusts or forest trusts. External trusts can exist with Windows 2000 Server or Windows Server 2003 domains, regardless of their functional level, and they use NTLM authentication. Forest trusts can exist with forests that operate at the Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2 forest functional level. These trusts use Kerberos authentication.

Creating a trust

The following table lists the steps that you can take to create a trust for sharing resources with other forests. The trust can be either one-way or two-way, and it can be either incoming or outgoing.

 | Step | Reference
Check box | Review information, including any known issues, about creating domain and forest trusts. | Creating Domain and Forest Trusts (http://go.microsoft.com/fwlink/?LinkId=93232)
Check box | As necessary, complete the steps for creating an external trust. | Creating External Trusts (http://go.microsoft.com/fwlink/?LinkId=93233)
Check box | As necessary, complete the steps for creating a forest trust. | Creating Forest Trusts (http://go.microsoft.com/fwlink/?LinkId=93235)


Help Prepare for Disaster Recovery by Performing Routine Backups of the Active Directory Database

Incorporate domain controller backups into your routine operations schedule to protect against user error, software error, or hardware error. Windows Server Backup is an optional Windows Server 2008 feature that you install by using Server Manager. Use Windows Server Backup to back up all volumes on a domain controller (also known as a full server backup) or a specified set of critical volumes that contain system state data. Critical volumes include volumes that host the Active Directory database (Ntds.dit) and log files, SYSVOL, the registry, and select operating system files.

Note

For install from media (IFM) installations, use Ntdsutil.exe, rather than Windows Server Backup, to create the installation media. Ntdsutil.exe includes an ifm subcommand that creates installation media for the installation of additional domain controllers. The ifm subcommand creates installation media that includes only the files that are required to install AD DS, and you can use it to create secure installation media for RODC installation. For more information about using the ntdsutil ifm subcommand, see Installing AD DS from Media (http://go.microsoft.com/fwlink/?LinkId=93228).

Performing domain controller backups

The following table lists references that you can use to perform backups of domain controllers that run Windows Server 2008.

 | Step | Reference
Check box | If necessary, install Windows Server Backup. | Installing Windows Server Backup (http://go.microsoft.com/fwlink/?LinkId=93229)
Check box | As needed, perform a backup of system state data or the critical volumes that are required to recover a domain controller. | Performing an Unscheduled Backup of a Domain Controller (http://go.microsoft.com/fwlink/?LinkId=93224)
Check box | As needed, perform a backup of all volumes that are hosted on a domain controller. | Perform a Full Server Backup of a Domain Controller by Using the GUI (Windows Server Backup) (http://go.microsoft.com/fwlink/?LinkId=93230)
Check box | Automate domain controller backups by scheduling Windows Server Backup to perform daily backup jobs. | Scheduling Regular Full Server Backups of a Domain Controller (http://go.microsoft.com/fwlink/?LinkId=93231)


Reduce Directory Size and Ensure Its Integrity and Performance by Performing Offline Defragmentation

Although the Active Directory database is automatically defragmented while it is running (also known as online defragmentation), you can also stop Active Directory Domain Services (AD DS) to perform offline defragmentation to further reduce the size of the database. Offline defragmentation provides additional checks that can help ensure database integrity and performance.

Performing offline defragmentation

The following table lists the steps that you can take to perform offline defragmentation of the Active Directory database.

 | Step | Reference or procedure to use
Check box | Review guidelines about performing offline defragmentation. | Returning Unused Disk Space from the Active Directory Database to the Windows File System (http://go.microsoft.com/fwlink/?LinkId=93219)
Check box | Change the garbage collection logging level to determine how much free space is available. | Change the Garbage Collection Logging Level to 1 (http://go.microsoft.com/fwlink/?LinkId=93222)
Check box | Back up system state. | Performing an Unscheduled Backup of a Domain Controller (http://go.microsoft.com/fwlink/?LinkId=93224)
Check box | Stop AD DS. | Click Start, click Administrative Tools, and then click Services. Right-click Active Directory Domain Services, and then click Stop. When you are prompted to stop dependent services, click Yes.
Check box | Perform the offline defragmentation procedure. | Compact the Directory Database File (Offline Defragmentation) (http://go.microsoft.com/fwlink/?LinkId=93225)
Check box | Restart AD DS. | Click Start, click Administrative Tools, and then click Services. Right-click Active Directory Domain Services, and then click Start.


Improve Resource Access Efficiency by Using Security Groups

As a best practice, assign resource access to security groups—instead of to individual users—to simplify administration and troubleshooting. Resources can include the following:

  • Files

  • Folders and shared folders

  • Registry settings

  • Active Directory Domain Services (AD DS)

  • Applications

For efficiency, create global groups for users based on criteria such as job function or department. Create domain local groups, and then place global groups into domain local groups. Assign permissions to the domain local groups as required for your environment. This practice simplifies troubleshooting. It also simplifies management of changes when they occur, for example, when users change job functions.

Using security groups

The following table provides a reference for more information about using security groups.

 | Step | Reference
Check box | Review best practice information about assigning permissions on Active Directory objects. | Best Practices for Assigning Permissions on Active Directory Objects (http://go.microsoft.com/fwlink/?LinkId=93217)


Ensure That DNS Clients Can Locate Domain Controllers by Configuring DNS Support for AD DS

The Active Directory Domain Services (AD DS) server role needs Domain Name System (DNS) services to locate computers, domain controllers, member servers, and network services by name. The DNS Server role provides DNS name resolution services for TCP/IP-based networks by mapping names to IP addresses, which makes it possible for computers to locate network resources in an AD DS environment.

AD DS registers resource records in DNS zones so that DNS clients can locate domain controllers. You must configure DNS clients with the address of a DNS server that can refer to the required zone data. The DNS server must either host the required zones itself or be able to use forwarding or delegations to reach another DNS server that hosts the required zones.

Configure DNS support for AD DS

The following table lists the steps that you can take to configure DNS support for AD DS.

 | Step | Reference
Check box | Review information about the DNS server role in Windows Server 2008. | DNS Server (http://go.microsoft.com/fwlink/?LinkId=93215)
Check box | Configure DNS client settings. | Configuring TCP/IP and DNS Client Settings
Check box | Create any necessary DNS delegation records. | Creating or Updating a DNS Delegation
Check box | Configure forwarders. | Configure a DNS Server to Use Forwarders
Check box | If your organization uses root hints for recursive name resolution, configure root hints on your DNS servers. | Update Root Hints on the DNS Server


Simplify Active Directory Administration by Delegating Management of Users, Computers, and Other Network Resources

You can use the Delegation of Control Wizard to delegate administrative control of a particular domain or organizational unit (OU) to groups or individuals who are responsible for only that domain or OU. By delegating administration, you can make it possible for groups or individuals in your organization to perform tasks such as:

  • User, computer, and security group management.

  • Password resets.

  • Group Policy management.

  • Replication topology and schedule setting.

You can also help secure your network from accidental or malicious damage by limiting the capabilities of the groups or individuals to whom you delegate control.

To use the Delegation of Control Wizard, open the Active Directory Users and Computers snap-in, right-click the OU that you want to delegate control of, and then click Delegate Control.

Delegating management of users, computers, and other network resources

The following table lists references for more information about delegating Active Directory administration.

 | Step | Reference
Check box | Review best practice information for delegating Active Directory administration. | Best Practices for Delegating Active Directory Administration (http://go.microsoft.com/fwlink/?LinkId=93213)
Check box | Review a list of Active Directory administrative tasks for service administration and data administration, along with the permissions required to perform each task. | Best Practices for Delegating Active Directory Administration: Appendices (http://go.microsoft.com/fwlink/?LinkId=93214)


Simplify Management of User and Computer Accounts by Using Group Policy to Apply Common Configurations

Group Policy simplifies administration and reduces information technology (IT) costs by automating the management of user accounts and computer accounts. By using the Group Policy Management Console (GPMC), an administrator can implement security settings efficiently; enforce IT policies; and distribute software consistently across sites, domains, or organizational units (OUs) that the administrator selects.

Using Group Policy

The following table lists the steps that you can take to use Group Policy on a server running Windows Server 2008.

 | Step | Reference
Check box | If necessary, install the Group Policy Management Console by using the Add Features Wizard in Server Manager. If you are prompted to do so, restart the server after you install the Group Policy Management Console. | Click Start, click Server Manager, and then click Add Features. Select the Group Policy Management Console check box, click Next, and then click Install.
Check box | Review information about using Group Policy, including references for creating and editing custom ADMX files. | Group Policy (http://go.microsoft.com/fwlink/?LinkId=93212)


Consolidate Servers by Retiring a Domain Controller and Removing AD DS from the Server

To remove Active Directory Domain Services (AD DS) from a domain controller, run the Active Directory Domain Services Installation Wizard (Dcpromo.exe). The wizard automatically detects that the server is already a domain controller and guides you through the steps to remove AD DS. If the wizard cannot successfully remove AD DS for some reason, you may have to force the removal of the domain controller.

Removing AD DS from a server

The following table lists the steps that you can take to remove AD DS from a server.

 | Step | Reference
Check box | If you plan to retain other domain controllers in the domain, follow the steps for removing a domain controller from the domain. | Removing a Domain Controller from a Domain (http://go.microsoft.com/fwlink/?LinkId=93207)
Check box | If you plan to retire the last domain controller in a domain, follow the steps for removing the last domain controller in the domain. | Removing the Last Domain Controller in a Domain (http://go.microsoft.com/fwlink/?LinkId=93208)
Check box | If you plan to retire the last domain controller from the only domain in the forest, follow the steps for removing the last domain controller in the forest. | Removing the Last Domain Controller in a Forest (http://go.microsoft.com/fwlink/?LinkId=93209)
Check box | If the domain controller that you want to retire has no connectivity to other domain controllers, you may have to force the removal of AD DS from the server. | Forcing the Removal of a Domain Controller (http://go.microsoft.com/fwlink/?LinkId=93210)


Ensure That Clients Can Access Resources by Configuring Time Synchronization Throughout the Forest

The Windows Time service (also known as W32time) synchronizes the date and time for computers running on a Windows Server 2008 R2 network. The Windows Time service is essential to the successful operation of Kerberos authentication and, therefore, to Active Directory–based authentication. Any Kerberos-aware application, including most security services, relies on time synchronization between the computers that are participating in the authentication request. Active Directory domain controllers must also have synchronized clocks to help ensure accurate data replication.

Configuring time synchronization

The following table lists the steps that you can take to configure time synchronization for computers in your organization.

 | Step | Reference
Check box | When you deploy the first domain in your forest, configure the primary domain controller (PDC) emulator operations master in that domain to synchronize from a valid Network Time Protocol (NTP) source. | Configure the Windows Time Service (http://go.microsoft.com/fwlink/?LinkId=93177)
Check box | Some Windows-based client computers do not automatically synchronize their time with the Active Directory domain. You can configure these computers to request time from a particular source, such as a domain controller in the domain. If you do not specify a source that is synchronized with the domain, each computer’s internal hardware clock governs its time. | Configuring Windows-Based Clients to Synchronize Time (http://go.microsoft.com/fwlink/?LinkId=93178)
Check box | If the local Windows Time service settings are not configured correctly, you may prefer to simply restore the Windows Time service to its default settings rather than spending time troubleshooting the problem. | Restoring the Windows Time Service to Default Settings (http://go.microsoft.com/fwlink/?LinkId=93179)


Enable Advanced Features by Raising the Domain or Forest Functional Level

After you remove domain controllers that are running older versions of Windows Server or you upgrade them to Windows Server 2008 R2, you can raise the domain or forest functional level. Raising functional levels enables advanced features in the domain or forest, such as improved replication of group membership changes and the ability to create forest trusts. Raising the functional level limits which versions of Windows Server can host the domain controller role. Client and application compatibility are not affected by changes to functional levels.

Raising functional levels

The following table lists the steps that you can take to raise your domain or forest functional level.

 | Step | Reference
Check box | Review the list of features that are enabled at various domain and forest functional levels. | Setting the Domain or Forest Functional Level
Check box | Review planning information about raising domain and forest functional levels. | Enabling Windows Server 2008 Advanced Features for AD DS (http://go.microsoft.com/fwlink/?LinkId=93175)
Check box | Complete the steps for raising the domain or forest functional level. | Raising the Functional Levels (http://go.microsoft.com/fwlink/?LinkId=93174)


Ensure Replication of Group Policy Objects and Network Scripts in SYSVOL by Using FRS and DFS Replication

Windows Server 2008 R2 contains both the File Replication Service (FRS) and new Distributed File System (DFS) Replication to replicate SYSVOL. FRS enables interoperability with domain controllers that run Windows 2000 Server or Windows Server 2003. After these domain controllers are removed from the domain or upgraded to Windows Server 2008 or Windows Server 2008 R2, you can raise the domain functional level to use DFS Replication of SYSVOL. DFS Replication is a new state-based, multimaster replication engine that supports scheduling and bandwidth throttling. It uses a new compression algorithm to replicate only the changes when files are updated.

Using FRS and DFS Replication

The following table lists references to help you use FRS and DFS Replication on a server running Windows Server 2008 R2.

 | Step | Reference
Check box | FRS is used to replicate SYSVOL by default unless the domain functional level is Windows Server 2008.To use DFS Replication to replicate SYSVOL, raise the domain functional level to Windows Server 2008 or Windows Server 2008 R2. | Raising the Functional Levels (http://go.microsoft.com/fwlink/?LinkId=93174)
Check box | Review information about using DFS Replication. | File Services (http://go.microsoft.com/fwlink/?LinkId=93167)
Check box | If necessary, migrate from FRS to DFS Replication. | File Services (http://go.microsoft.com/fwlink/?LinkId=93167)