The process of installing an Active Directory domain is quite simple, but if you dont know your basicsyou might stumble across a few pitfalls. For additional information about any of the information in thisarticle, refer to the Windows 2000 online Help and theWhat do we need in order to successfully install Active Directory on a Windows 2000 orWindows Server 2003 server?Here is a quick list of what you must have: An NTFS partition with enough free space An Administrators username and password The correct operating system version A NIC Properly configured TCP/IP (IP address, subnet mask and - optional - default gateway) A network connection (to a hub or to another computer via a crossover cable) An operational DNS server (which can be installed on the DC itself) A Domain name that you want to use The Windows 2000 or Windows Server 2003 CD media (or at least the i386 folder) Brains (recommended, not required...)An NTFS PartitionTo successfully install AD you must have at least one NTFS formatted partition, preferably thepartition Windows is installed on (This is NOT true when you have performance issues on yourmind. You will then install the AD db on another different fast physical disk, but thats anothertopic). To convert a partition (C:) to NTFS type the following command in the command promptwindow:convert c:/fs:ntfsThe NTFS partition is required for the SYSVOL folder.Free space on your diskYou need at least 250mb of free space on the partition you plan to install AD on. Of course youllneed more than that if you plan to create more users, groups and various AD objects.Local Administrators username and passwordOnly a local Administrator (or equivalent) can install the first domain and thus create the newforest.
If you plan to create another Domain Controller for an existing domain - then you must haveDomain Admin right in the domain youre planning to join.If you want to create a child domain under an existing domain, or another tree in an existingforest - you must have Enterprise Admin rights.Windows 2000 Server (or Advanced Server or Data CenterServer), or Windows Server 2003 (or Enterprise Server orData Center)Duh... you cannot install AD on a Professional computer.IP ConfigurationYou need a dedicated IP address to install Active Directory. If you do not use a dedicated IPaddress, DNS registrations may not work and Active Directory functionality may be lost. If thecomputer is a multi-homed computer, the network adapter that is not connected to the Internetcan host the dedicated IP address.The Active Directory domain controller should point to its own IP address in the DNS server listto prevent possible DNS connectivity issues.To configure your IP configuration, use the following steps: 1. Right-click My Network Places, and then click Properties. 2. Right-click Local Area Connection, and then click Properties 3. Click Internet Protocol (TCP/IP), and then click Properties.
Click Internet Protocol (TCP/IP), and then click Properties. Make sure you have a static and dedicated IP address. If you dont need Internet connectivity through this specific NIC you can use a Private IP range such as 192.168.0.0 with a Subnet Mask of 255.255.255.0. 1. Click Advanced, and then click the DNS tab. The DNS information should be configured as follows: Configure the DNS server addresses to point to the DNS server. This should be the computers own IP address if it is the first server or if you are not going to configure a dedicated DNS server. If the Append these DNS suffixes (in order) option is selected for the resolution of unqualified names, the Active Directory DNS domain name should be listed first, at the top of the list. Verify that the information in the DNS Suffix for this connection box is the same as the Active Directory domain name. Make sure that the Register this connections addresses in DNS check box is selected.Active Network Connection Required During InstallationThe installation of Active Directory requires an active network connection. When you attempt touse Dcpromo.exe to promote a Windows 2000 Server-based computer to a domain controller,you may receive the following error message:Active Directory Installation FailedThe operation failed with the following errorThe network location cannot be reached. For further information about network troubleshooting,see Windows Help.This problem can occur if the network cable is not plugged into a hub or other network device. (Sample of a disconnected or un-plugged network cable)(Screenshot of a connected NIC)To resolve this problem, plug the network cable into a hub or other network device. If networkconnectivity is not available and this is the first domain controller in a new forest, you can finishDcpromo.exe by installing Microsoft Loopback Adapter.The Microsoft Loopback adapter is a tool for testing in a virtual network environment whereaccess to a network is not feasible. Also, the Loopback adapter is essential if there are conflictswith a network adapter or a network adapter driver. Network clients, protocols, and so on, can bebound to the Loopback adapter, and the network adapter driver or network adapter can be
installed at a later time while retaining the network configuration information. The Loopbackadapter can also be installed during the unattended installation process. To manually install: 1. Click Start, point to Settings, click Control Panel, and then double-click Add/Remove Hardware. 2. Click Add/Troubleshoot a device, and then click Next. 3. Click Add a new device, and then click Next. 4. Click No, I want to select the hardware from a list, and then click Next. 5. Click Network adapters, and then click Next. 6. In the Manufacturers box, click Microsoft. 7. In the Network Adapter box, click Microsoft Loopback Adapter, and then click Next. 8. Click Finish.After the adapter is installed successfully, you can configure its options manually, as with anyother adapter. Note that if the TCP/IP properties are configured to use DHCP (the default), theadapter will eventually use an autonet APIPA address (169.254.x.x/16) because it is not actuallyconnected to any physical media."Always On" Internet Connection (recommended)An "always on" connection (for example, a cable modem or digital subscriber line [DSL] line) isrecommended (but not required) to enable clients to obtain Internet access. If you do not use an"always on" connection, you must configure a demand-dial interface using Network AddressTranslation (NAT) for clients to access the Internet.This is really not a requirement for AD, but if you later want to install and configure Exchange2000 or other Internet-aware applications or services youll need an Internet connection.DNS ConfigurationA DNS server that supports Active Directory DNS entries (SRV records) must be present forActive Directory to function properly. Read Create a New DNS Server for AD for more info.You need to keep in mind the following DNS configuration issues when you install ActiveDirectory on a home network: Root Zone entries and DNS Forwarders. Root zone entriesExternal DNS queries to the Internet do not work if a root zone entry exists on the DNS server.To resolve this issue, remove the root zone entry. This entry is identified with a dot (.) in theDNS Manager forward lookup zones. To check for the existence of the root zone entry, open theforward lookup zones in the DNS Management console. You should see the entry for thedomain. If the "dot" zone exists, delete it. For additional information about the root zone entry,see 260371 .
You can also read my No Forwarding or Root Hints on DNS server? tip. DNS forwarders (recommended)If you plan to have full Internet connectivity then DNS forwarders are necessary to ensure thatall DNS entries are correctly sent to your Internet service providers DNS server and thatcomputers on your network will be able to resole Internet addresses correctly. You can onlyconfigure DNS forwarders if no root zone entry is present.To configure forwarders on the DNS server: 1. Start the DNS Management console. 2. Right-click the name of the server, and then click Properties. 3. On the Forwarders tab, click to select the Enable Forwarders check box. 4. Type the appropriate IP addresses for the DNS servers that may be accepting forwarded requests from this DNS server. The list reads top-down in order, so place a preferred DNS server at the top of the list.It is recommended that you have all the Root Hints (Top Level DNS server) listed in the Root Hints tab. 1. If not, copy the Cache.dns file from the %systemroot%system32dnssamples folder to the %systemroot%system32dns folder and restart the DNS service. 2. Click OK to accept the changes.You can also read Configure DNS Forwarding on Windows 2000.For additional information about DNS issues go to 237675 .Client ConnectionsWhen you have a scenario in which clients on the LAN connect directly to the Internet and notthrough a NAT device, the clients should connect to the Active Directory domain controllerusing an internal network on a second network adapter. This prevents any issues that may arise ifclients obtain an IP address from your Internet service provider (ISP). You can achieve thisconfiguration with a second network adapter on the server connected to a hub. You can use NATor ICS to isolate the clients on the local network. The clients should point to the domains DNSserver to ensure proper DNS connectivity. The DNS servers forwarder will then allow the clientsto access DNS addresses on the Internet.Do not use ICS (recommended)Use NAT instead. ICS (Internet Connection Sharing) will break down all the DHCP and DNSfunctionality on your LAN. Try to avoid ICS at all costs. If you must, make the Domain
Controller itself the ICS server, and let all clients obtain their IP configuration automatically.This of course is not a good security decision, because you will expose your Domain Controllerto potential Internet threats. Again, and I cannot stress this more, avoid ICS on your corporateLAN and use NAT instead.NetBIOS Over TCP/IPA common security consideration with an active connection to the Internet is the restriction ofNetBIOS connections on the network adapter that is directly connected to the Internet. If clientsconnect on a second network adapter, you can safely disable NetBIOS over TCP/IP on theexternal network adapter, and prevent any attempts of unauthorized NetBIOS access by outsidesources.To disable NetBIOS on the NIC that is connected to the Internet, use the following steps: 1. Right-click My Network Places, and then click Properties. 2. Right-click the icon of the NIC that is connected to the Internet, and then click Properties. 3. Un-check the File and Print Sharing for Microsoft Networks check box. 4. Click TCP/IP and then Properties. 5. Click Advanced and go to the WINS tab. 6. Select the Disable NetBIOS Over TCP/IP radio box. 7. Click Ok all the way out.Do not use Single-Label domain namesAs a general rule, Microsoft recommends that you register DNS domain names for internal andexternal namespaces with Internet authorities. This includes the DNS names of Active Directorydomains, unless such names are sub-domains of names that are registered by your organizationname, for example, "corp.example.com" is a sub-domain of "example.com". When you registerDNS names with Internet authorities, it prevents possible name collisions should registration forthe same DNS domain be requested by another organization, or if your organization merges,acquires or is acquired by another organization that uses the same DNS names.DNS names that dont include a period ("dot", ".") are said to be single-label (for example, com,net, org, bank, companyname) and cannot be registered on the Internet with most Inter