SAMPLE CHAPTER Learn Active Directory Management in a Month of Lunches by Richard Siddaway Chapter 15 Copyright 2014 Manning Publications brief contents PART 1MANAGING ACTIVE DIRECTORY DATA .......................... 1 1 ■ Before you begin 3 2 ■ Creating user accounts 11 3 ■ Managing user accounts 26 4 ■ Managing groups 37 5 ■ Troubleshooting users and groups 53 6 ■ Managing computer accounts 64 7 ■ Managing organizational units 76 PART 2MANAGING GROUP POLICY ....................................... 91 8 ■ Creating Group Policies 93 9 ■ Managing Group Policies 107 10 ■ Fine-grained password policies 125 PART 3MANAGING THE ACTIVE DIRECTORY SERVICE ............ 139 11 ■ Creating domain controllers 141 12 ■ Managing domain controllers 155 13 ■ Protecting AD data 171 14 ■ Security: Default groups and delegation 189 15 ■ Managing DNS 205 16 ■ Managing sites and subnets 223 17 ■ AD replication 244 18 ■ Managing AD trusts 260 PART 4MAINTENANCE AND TROUBLESHOOTING ............. 273 19 ■ Troubleshooting your AD 275 20 ■ Maintaining and monitoring Active Directory 295 21 ■ Future work and final exam 311 22 ■ Into the cloud 323 Managing DNS DNS (Domain Name System) can be thought of as the telephone book for your net- work. When you need to communicate with a remote machine, you usually do so by typing the machine name into the client software or command. DNS is then interro- gated by your system to discover the IP address of the remote system. Once that address has been obtained, your system can initiate communication through auto- matic and standard networking techniques. DNS extends beyond your organization, because it’s normal for your DNS servers to be configured to communicate with DNS on the internet and hand off the reso- lution of queries they can’t handle. NOTE This chapter assumes that you’re familiar with the concept of DNS and understand how it works in your environment. The chapter starts with an overview showing how DNS works with Active Directory and explaining what’s required for a non-Microsoft DNS to work with Active Direc- tory. Next, we’ll look at a DNS server configuration and see how to work with DNS zones and records. From there, we’ll move on to testing whether your systems are working correctly with DNS, and we’ll conclude with a lab. First, though, how does DNS work with Active Directory? 15.1 Overview of DNS and Active Directory Active Directory relies on DNS for a number of services. When a machine starts on the network, it queries DNS to discover the nearest domain controller via the SRV 205 206 CHAPTER 15 Managing DNS (service) records. Without this information, your machine won’t connect to the domain and you won’t be able to log on. Many, if not most, organizations use Microsoft DNS because it integrates with Active Directory. This has a number of benefits: ■ Single replication topology—AD replication controls DNS replication, instead of requiring the configuration of a separate topology. ■ Multimaster DNS servers—Records can be written to any DNS server, instead of just the primary DNS server. ■ Dynamic updates—The client machines can update their own records. ■ Secure updates—Enables controlling which users and computers can update DNS records. It’s possible to use a non-Microsoft DNS, but this requires more work on your part. 15.1.1 Using Microsoft DNS Microsoft DNS has the advantage that it’s designed to integrate with Active Directory and it comes in the box. It also uses GUI tools that follow the pattern you’re used to and can be administered from PowerShell. INSTALLING DNS When installing Active Directory, one of the options is to install DNS at the same time. If you’re using Microsoft DNS, this is the recommended approach. You saw how to configure the domain controller creation process to install DNS in chapter 11. Once DNS is installed on your domain controller, the standard AD replication pro- cess will copy the data onto the new DNS server. You’ll learn more about replication in chapter 17. DNS MANAGEMENT TOOLS You have a number of options for managing DNS. You can manage Windows DNS using the DNS GUI console or you can use PowerShell. The DNS GUI is relatively unchanged across the current versions of Windows Server. Windows Server 2012 introduced a PowerShell module for administering DNS; it also works against Windows Server 2008 R2 servers (I haven’t tested it against Win- dows Server 2008 but I expect it to work). If you don’t have access to the Windows Server 2012 module, you can administer Windows Server 2008 and 2008 R2 DNS serv- ers using WMI. NOTE The Windows Server 2012 DNS module can’t be installed on down-level versions of Windows because it relies on WMI classes that don’t exist on these earlier versions of Windows. You can use it from a Windows Server 2012 or Windows Server 2012 R2 machine to administer DNS on down-level machines. The Windows Server 2008 WMI classes are installed on DNS servers when DNS is installed. The classes are well documented at http://msdn.microsoft.com/en-us/ library/windows/desktop/ms682123(v=vs.85).aspx. This chapter provides the DNS server administration 207 information required to administer DNS to meet your needs as an AD administrator. If you’d like to dig further into DNS, reading chapter 9 of my book PowerShell in Practice (Manning, 2010) is highly recommended. You don’t have to use Microsoft DNS with your Active Directory. You can use a non- Microsoft DNS if you already have a DNS infrastructure in place. There are a few issues you need to be aware of if you follow that route. 15.1.2 Using non-Microsoft DNS It’s possible to use a non-Microsoft DNS such as BIND (https://www.isc.org/downloads /bind/), Cisco Network Registrar (http://www.cisco.com/en/US/products/sw/ netmgtsw/ps1982/), or the Nominum products (http://www.nominum.com/ solutions/). Other free and commercial offerings are available, which can be discov- ered through an internet search. A non-Microsoft implementation of DNS has to meet the following requirements to support DNS: ■ Must support SRV records ■ Should support dynamic updates ■ Should ideally support incremental zone transfers The latest versions of BIND support all of these. You must check compliance on any other DNS in use in your organization. If you use a non-Microsoft DNS, you’ll need to utilize the management tools that are applicable to your DNS implementation. The rest of the chapter assumes you’re using Microsoft DNS. You’ll need to amend the techniques to use the appropriate management tools for your environment. The tasks will be the same irrespective of the type of DNS you use. 15.2 DNS server administration DNS is a system that tends to look after itself. If you’ve implemented a dynamic DNS (recommended), your systems will register themselves in DNS when they start. This saves you a lot of work! Unfortunately, this doesn’t mean that everything is done for you. There are still a number of tasks you need to perform, including viewing and changing the server level settings, managing DNS zones, and managing forwarders. Let’s examine the server configuration. 15.2.1 Viewing DNS server settings Once the DNS server is installed, you probably won’t need to do much to it in the way of administration. Your time will be spent working with the zones and records. You may need to check DNS server settings. You can view the settings as follows: 1 Open the DNS Manager console. 2 Right-click the DNS server. 3 Choose Properties. 208 CHAPTER 15 Managing DNS You can control ■ The IP addresses on which DNS listens for requests ■ Servers to which your DNS server will forward requests it can’t resolve—usually the internet ■ Root hints—the top-level DNS servers on the internet ■ Logging and monitoring ■ Security ■ Record scavenging A full listing of the DNS server settings, including the zones on the server, can be obtained using the Windows Server 2012 PowerShell cmdlet: Get-DnsServer -ComputerName server02 TRY IT NOW: Examine DNS server settings Find the DNS server in your environment—preferably your test environment—and ex- amine the settings using the GUI tools and PowerShell. Is there any information avail- able in one that isn’t available in the other? Once your DNS server is configured to your satisfaction, it’s time to look at DNS zones. 15.2.2 Creating zones A DNS zone is a partition in the DNS namespace. One DNS zone will match the name of your AD domain. This is the forward lookup zone used to discover IP addresses from machine names. A reverse lookup zone is used to supply a machine name when an IP address is given. You can think of DNS zones as analogous to OUs in AD—they’re containers for DNS records. If you install DNS as part of your initial Active Directory installation, you’ll find two zones are created: 1 A forward lookup zone that matches the AD domain name—for example, manticore.org in figure 15.1. 2 A forward lookup zone whose name starts with _msdcs—for example, _msdcs.manticore.org in figure 15.1. This is used by Active Directory to store the SRV DNS records that are used to advertise AD services through DNS. You may need to create additional zones because ■ You introduce additional domains into the environment. ■ You need to create a reverse lookup zone. ■ You segregate part of the environment. You can create a zone using the DNS GUI tool or PowerShell. DNS server administration 209 _msdcs zone for Active Directory Reverse Forward lookup zone lookup zone Figure 15.1 AD-integrated zones CREATING A FORWARD LOOKUP ZONE WITH THE GUI Creating a zone using the GUI tools involves running a wizard: 1 Open the DNS Manager console (figure 15.1).