2008-03-18

Installing a Windows Server 2008 Core Domain Controller

In this post, I'll go through the steps to install a Windows Server 2008 Domain Controller, and to join a computer to that domain.

First of all, I've setup a new virtual machine with 512 MB memory and 100 GB of disk. This amount of memory is the bare minimum that W2k8/Vista will require to even begin installing. The amount of disk is excessive, but since I'm running this installation on a virtual machine, I don't care too much.


So, after starting up the virtual machine and attaching the Windows Server 2008 CD image, I am prompted to choose a language and a locale for this installation, alongside with the preferred keyboard layout. After this, I am greeted with the familiar Windows setup screen.


Since I'm doing a fresh install, I'll just click on "Install now". The other options are fairly useless for now: the "What to know before installing Windows" option is simply a link to a static chm-file, and the "Repair your computer" option is useful only in a situation where your Vista/Server 2008 installation has broken. Interestingly, the repair dialog states that it "cannot repair operating systems earlier than Windows Vista", implying that it could repair the next version of Windows after Vista. Probably just a bad choice of words, perhaps?

I'm running multiple virtual machines on my physical box, and I want to connect them all to a single new domain. I also want to have my Domain Controller to be a dedicated server, just as it would be in a physical setup. Therefore, I'll go for the resource-friendly "Core" -installation. Windows Server 2008 Standard is enough for Domain Controller.

Again, since I'm doing a fresh install, I'll just go with "Custom (Advanced)". One could find a case for bad usability design here, but I'll let it pass since this is a server installation, and the users running this particular setup are hopefully knowledgeable enough not to be scared by the "Custom" and "Advanced" words.

I don't want to mess around with my new domain controller's disk partitions etc, so I'll just hit "Next". After this, Windows installation will roll ahead on it's own, until rebooting the new virtual machine.

When logging on the first time to a new Windows Server 2008 installation, a password for the administrator account needs to be provided.

This is accomplished by clicking on the "Other User" button. The button is just a placeholder of some sort, and not a real user account.

After hitting it off with the other user, I can log on as the administrator by simply clicking on the arrow icon shown next to the password field. Free tip: write down the password on a notepad and save the text file next to your vmc-files. And yes, at one point I did have to reinstall some of my virtual machines because I forgot the password. Or, if you've really got the extra juice, you might want to go ahead and create a password reset disk.

First things first, I wanna get rid of the awfully small confines of the regular 80x25 command prompt window and set the layout to whatever pleases my eye. I'll admit that tweaking the colours would be too much at this point, even for me.


And, before doing anything else, I'll install the Virtual Machine Additions. However, since AutoPlay is disabled, I need to manually run "D:\Windows\Setup.exe".

Of course, these steps aren't strictly necessary, but I do feel very strongly about my working conditions - and the Virtual Machine Additions just bring a little more comfort to my work experience.

After the mandatory post-setup reboot, I can finally get to mess around with my new virtual machine. A quick ipconfig tells me that I'm at least alive.

Another thing I want to check after ipconfig is netsh interface listing of all my IPv4 interfaces. I can see that I've got two interfaces for IPv4, with number 2 being my Local Area Connection.

Since all my virtual machines are working in the 192.168.42.xxx address space, I want to configure my new domain controller to that space too. I'll just almost randomly decide that it will have the address of 192.168.42.1. You will, of course, have different addresses, masks and IPv4 interface index numbers.

I then run ipconfig /all to check that the IP address really has changed, and also to see what happens to be my virtual machine's current name. Being rather picky, I decide to change it from "win-qgybl3q9kkq" to something more humanely bearable. This requires a reboot, which is luckilly not automatical, but requires the use of shutdown /r command.

After yet another reboot, it is time to examine the dcpromo command. A simple /? switch gives some insight into the workings of dcpromo, but not nearly enough to set up a new domain for my virtual machines.

But wait, there's more! The /? switch can be refined with a request for more details, such as /?:Promotion or /?:CreateDcAccount. Since I'm creating a new domain, I choose to overload my text processing capabilities via the "Promotion" switch.

That's roughly about 100+ rows of information for using dcpromo to create, or promote, a new domain. After some trial and error, I come up with a list of satisfactory switches to create my new domain.

I want this box to be my virtual domain's DNS server, so I specify the installdns switch. This will be a new domain, so I specify both newdomain:forest and replicaornewdomain:domain switches. The name of the domain will be MyVirtual, as specified by newdomaindnsname.

Now, running this is a real bundle of joy, unless you're cunning enough to apply the /rebootonsuccess:No switch. I wasn't that smart - so all I got to see was some text swooshing by, and then... darkness. And to my horror, I realized that my server had rebooted when I saw the next screen.

Well, now I know that there's a hidden reboot trap in there. And luckilly this wasn't production environment. Actually, I have no idea what happened during the supposedly succesful dcpromo execution, but since ipconfig looks promising I guess everything went okay. This is what virtual machines and undo disks were made for.

One more thing to make sure is that Windows Firewall isn't running. Disabling it is done via the netsh command. This is a virtual network, and I'm running all my machines in shared networking mode, so I don't want to keep the excess firewall enabled.


Since my domain looks to be in order, I'll fire up another of my virtual machines and try to join the new and shiny "MyVirtual" domain, while it's still hot and trendy.

I'll leave the domain controller running, and try to join the other computer in my domain. So, through the Control Panel we go, and into the System settings window.

Once in System settings window, I want to click on the Advanced System Settings link. There are other ways to join a domain too, so you can use whatever approach suits you best.


And from here I can find the familiar XP-style dialog for changing computer name etc. I'll just click on "Change".

Type in my new domain name, and with much anticipation, I click on the OK button.

Yeah, this is the prompt for credentials that I've been working towards. Of course there is a lot more to administering a domain, but for me this is a big success and worthy of pouring myself a beer.

And so I joined my first computer to my new domain.

No comments: