Dark Developments Where Knowledge Meets Power


WIN2008 – Install Active Directory

Posted by Dark#Basics

Windows Server 2008 - Installing Active Directory
Active Directory is one of the core elements when using Windows Server. Active Directory provides the structure to centralize the network management and store information regarding the network resources across a domain. Domain Controllers keep al this information centralized and available to all network users.

Using the Graphical User Interface
In Windows Server 2008, just like previous server operating Systems, you can run DCPROMO to promote the server to Domain Controller and install Active Directory. Do note that Windows Server 2008 does require the server role Active Directory Domain Services. This is also installed using DCPROMO or pre-adding the role using Server Manager.

To run DCPROMO, enter Run and open DCPROMO. Alternative you can click on the DCPROMO link from Server Manager.

If AD-DS is already installed, the Active Direcotry Domain Services Installation Wizard will appear immediately or after a short while. If AD-DS isn't installed, this Active Directory Domain Services will be installed before the Active Directory Domain Services Installation wizard will appear.

Click Next on the welcome screen to start the wizard.

In the Operating System Compatibility window, read the information and click Next to continue.

Next is the Deployment Configuration window. Depending on what you are planning to do you'll need to select an option.

  • Existing forest - Add a domain controller to an existing domain - When there already is a forest and you want a backup domain controller.
  • Existing forest - Create a new domain in an existing forest (This server will become the first domain controller in the new domain). - If you want the new domain to be a child of an existing domain, select this option. For example, you could create a new domain named hq.root.local as a child domain of the domain root.local.
  • Create a new domain in a new forest - Select this option if this is the first domain in your organization or if you want the new domain the be completely independent of your current forest.

Enter a name for the new domain and click Next. Do not use single label domain names such as "mydomain" or similar. You MUST pick a full domain name such as "mydomain.local" or "mydomain.com" and so on.

Select the appropriate forest function level. Windows 2000 is selected by default, this means you can add Windows 2000, Windows Server 2003 and Windows Server 2008 Domain Controllers to the forest you're creating. The Windows 2000 forest functional level provides all Active Directory Domain Services features that are available in Windows 2000 Server. If you have domain controllers running later versions of Windows Server, some advanced features will not be available on those domain controllers while this forest is at the Windows 2000 functional level. The Windows Server 2003 forest functional level provides all features that are available in Windows 2000 forest functional level, and the following additional Domain Controller running Windows Server 2003 and Windows Server 2008. Windows Server 2008 functional level does not provide any new features over the Windows 2003 forest functional level. However, it ensures that any new Domain Controller is running Windows Server 2008, which does provide unique features.

If no DNS server has been configured, the wizard will offer to automatically install DNS on this server. The first DCs must also be a Global Catalog. Also, the first DCs in a forest cannot be a Read Only Domain controller.

You'll get a warning telling you that the server has dynamically assigned IP address(es). Mostly because IPv4 isn't manually configured or we IPv6 did not manually configure the IPv6 Address, hence the warning. In a network where IPv6 is not used, you can safely ignore this warning.

You'll probably get a warning about DNS delegation. Since no DNS has been configured yet, you can ignore the message and click Yes.

If necessary change the paths of the AD database, log files and SYSVOL folder. For example for large deployments use a different disk, RAID,... Carefully plan your DC configuration to get the maximum performance.

Enter the Restore Mode Administrator Password. Do not use the regular administrator's password and securely store it. With this password you'll be able to restore Active Directory when things go bad.

Review your selections and click Next. It is also possible to export the settings for future use in unattended installs.

The wizard will create the domain, when finished you'll need to press Finish and reboot the computer.

Using the Command Line Interface
DCPROMO will accept command line switches, and if provided correctly, it will use them to perform the required tasks.

Select All Code:
DCPROMO /unattend /replicaOrnewDomain:newDomain /replicaDomainDNSName:root.local /ConfirmGC:yes /username:root.local'administrator /Password:P@ssw0rd /safeModeAdminPassword:P@ssw0rd1

It is also possible to use an unattended or answer file. The file is a text file that provides automated user input for each page of the Active Directory Installation Wizard.

Select All Code:

After creating the unattended file start the DCPROMO process.

Select All Code:
DCPROMO /unattend:C:\

DNS – Domain Name System

Posted by Dark#Basics

DNS - Domain Name System

As most of you know DNS stands for Domain Name System and translates the names of websites, computers,.. to the correct IP-addres.

The practical implementation contists out of three parts namely the stub resolver, caching/recursing resolver (recursor) and the authoritative nameserver.

The stub resolver builds the DNS-packet that needs to be send to the recursor and the recursor queries the authorative nameservers.

A URL consits out of different labels and these labels are delimited by dots for such as darkdevelopments.org.

The right most label is the top-level domain or root (.org). The hierarchy of domains descends from right to left, each label to the left specifies a subdomain (darkdevelopments).


Data in the DNS is saved as a Resource Record, this consits out of a name, type, TTL and data. The data can be an IP-address or another name.
The following types can be specified within DNS:

- SOA : Start-Of-Authority, holds the settings for the domain like TTL, primairy DNS.
- A : Returns a IPv4 address to map hostnames to an IP address.
- AAAA : Resturn an IPv6 address to map hostnames to an IP address.
- CNAME : Alias of one name to another.
- MX : Maps a domain name to a list of message transfer agents.
- PTR : Used for reverse lookup.
- SPF : SPF allows administrators to specify which hosts are allowed to send mail from a given domain by creating a specific SPF record (or TXT record) in the Domain Name System (DNS).
- SRV : Generalized service location record, used for newer protocols instead of creating protocol-specific records such as MX.

Forward / Reverse Lookup Zones

A zone is a group of addresses where the DNS-server is responsible for wihtin a certain namespace. In most cases this means the domain for example Active Directory.

If different subdomains arent in the same zone then those subzones are deligated. This means that the parent domain has created a pointer to the DNS-server that is responsible for the subzone.

Forward zones convert the hostname to the appropriate IP by using A, CNAME, MX, NS... Reverse lookup zones are used to translate the IP to the appropriate hostname by using the PTR-records.

Advanced DNS

It is possible to setup a secundairy DNS-server that contains a readonly copy of the primary DNS-server. The servers will replicate the DNS-records at certain times (Refresh interval, Retry Interval, Expire Interval). TTL contains the information how long a DNS-records needs to be cached.

Cheap Load Balancing

By using the different A-records with the same name but different IP DNS will use round robin.

DNS Server Roles
Primary - Is the only server where the content of the zone-file can be altered. This means adding, deleting, modifing records within a zone. Only one server can be the primary DNS-server in exception of Active Directory.
Secundairy - All servers that contain a read-only copy of the zone-file of the primary server, can be multiple servers.
Cache-Only - Does not contain zone information but cached queries for clients.
Forwarder - Transfers queries to another DNS-server (recursive).

DNS & Active Directory
When installing an Active Directory environment with DCPROMO, DNS will be automaticly installed. Because otherwise the domainname could not be resolved to the domain controller.

More detailed information about DNS can be found at en.wikipedia.org/wiki/Domain_Name_System


D#B Backup&Recovery Notes [PART2]: DNS, DHCP & GPO’s

Posted by Dark#Basics


The Dynamic Host Configuration Protocol (DHCP) is an auto configuration protocol used on IP networks. Computers that are connected to IP networks must be configured before they can communicate with other computers on the network. DHCP allows a computer to be configured automatically, eliminating the need for intervention by a network administrator. It also provides a central database for keeping track of computers that have been connected to the network. This prevents two computers from accidentally being configured with the same IP address.

DHCP - Backup
Making a backup of DHCP is handy for the configuration of the pools (range, subnet,...) and the reserved IP's. DHCP servers permit you to reserve an IP address for a client. This means that the specific network client will have the same IP for as long as you wanted it to.

A backup can be done through CLI with the netsh-command.

netsh dhcp server dump > <filename>

DHCP - Recovery
Running a recovery of the DHCP-settings can be done with the exact same CLI-command.

netsh exec <filename>

Do note that it's also possible to preform a recovery from the DHCP Management snap-in.









DNS - Backup
DNS-records can be dumped to a file using the dnscmd-command. If DNS is integrated in the domain controller a backup of the DNS records can be made with dnscmd but also with the System State backup (Previous Paper).

dnscmd /zoneprint <zonename> > <filename>

DNS - Recovery
Recovering the DNS-records can be done with the same CLI-command.

dnscmd /zoneadd <zonename> /primary /file <filename> /load


Group Policy is a feature of the Microsoft Windows NT family of operating systems. Group Policy is a set of rules which control the working environment of user accounts and computer accounts. Group Policy provides the centralized management and configuration of operating systems, applications and users' settings in an Active Directory environment. In other words, Group Policy in part controls what users can and can't do on a computer system. Although Group Policy is more often seen in use for enterprise environments, it is also common in schools, smaller businesses and other kinds of smaller organizations. Group Policy is often used to restrict certain actions that may pose potential security risks, for example: to block access to the Task Manager, restrict access to certain folders, disable the downloading of executable files and so on.

GPO's - Backup
Backup of the GPO's can be done with two methods. The first one is through the System State backup, second method is by using VBScript's. These VBScript's are originally created for Windows Server 2003 when the Group Policy Management Console was installed.

These scripts are not available by default in Windows Server 2008 but can be downloaded from the Windows Download Center. With one of these scripts it is possible to preform a full backup of the GPO's.

cscript.exe BackupAllGPOss.wsf <destination>

GPO's - Recovery
GPO's can be recovered using various methods. First method is by using the Group Policy Management snap-in and selecting the Manage Backups option.

The second method is by using another VBScript called RestoreAllGPOs.

cscript.exe RestoreAllGPOs.wsf <location>