The directory structure that Microsoft networks use to house their users and computer accounts is called Active Directory (AD), and the directory information is controlled and managed by Domain Controller (DC) servers. Two other server roles that almost always go hand-in-hand with Active Directory are DNS and DHCP, and in many networks, these three roles are combined on each server where they reside. A lot of small businesses have always made do with a single server containing all three of these roles, but in recent years, virtualization has become so easy that almost everyone runs at least two DCs for redundancy purposes. And if you are going to have two DCs, you may as well put the DNS and DHCP roles on them both to make those services redundant as well. But I'm getting ahead of myself. For this recipe, let's get started building these services by installing the roles and configuring them for the first...

AD is the core of your network. It has ties to everything! As such, it makes sense that you would want this to be as redundant as possible. In Windows Server 2019, creating a secondary DC is so easy that you really have no reason not to do it. Can you imagine rebuilding your directory by following a single server hardware failure where you have 100 user accounts and computers that are all part of the domain that just failed? How about with 1,000 or even 10,000 users? That could take weeks to clean up, and you'll probably never get it back exactly the way it was before. Additionally, while you are stuck in the middle of this downtime, you will have all kinds of trouble inside your network since your user and computer accounts are relying on AD, which would then be offline. In this recipe, we'll go through the steps you need to follow to take a second server into your network and join it to the existing domain that is running on the primary DC to create our...

AD is the structure in which all your user, computer, and server accounts reside. As you add new users and computers into your domain, they will be automatically placed into a generic OU (called an OU), which is a type of storage container. You could get away with leaving all your objects in their default locations, but there are a lot of advantages to putting a little time and effort into creating an organizational structure.

In this recipe, we will create some OUs inside Active Directory and move our existing objects into these OUs so that we can create some structure.

Getting ready

We will need a DC online for this recipe, which is a Server 2019 machine with the Active Directory Domain Services role installed. Specifically, I will be using the DC01 server that we prepped in the Configuring a combination Domain Controller, DNS server, and DHCP server recipe.

How to do it…

Let's get comfortable working...

Most folks working in IT are familiar with using the ping command to test network connectivity. If you are trying to test the connection between your computer and another, you can ping it from Command Prompt and test whether or not it replies. The PowerShell equivalent is Test-Connection. This assumes that the firewalls in your computers and network allow the ping to respond correctly, which generally is true. If you are inside a domain network and ping a device by its name, that name resolves to an IP address, which is the device's address on the network. But what tells your computer which IP address corresponds to which name? This is where DNS comes in. Any time your computer makes a request for a name, whether it is you pinging another computer or your Outlook email client requesting the name of your Exchange Server, your computer always reaches out to your network's DNS servers and asks, 'How do I get to this name?'.

DNS...

Now that we are familiar with moving around a little bit inside the DNS management tool, we are going to create and test another type of record. This one is called a CNAME (which is short for canonical name), and it is easiest to think of this one as an alias record. Rather than taking a DNS name and pointing it at an IP address as we do with a host record, with a CNAME, we are going to take a DNS name and point it at another DNS name! Why would this be necessary? If you are hosting multiple services on a single server but want those services to be contacted by using different names, CNAME records can be your best friend. Some corporate naming schemes are also very unfriendly to being used by users (imagine getting your users to remember that W19UE1WEB7 is the payroll server), and a CNAME allows us to assign a more memorable name for users to use.

Getting ready

We are going to make use of the same environment that we used to create our...

In the Configuring a combination Domain Controller, DNS server, and DHCP server recipe, we installed the DHCP role onto a server called DC01. Without some configuration, however, that role isn't doing anything. In most companies that I work with, all the servers have statically assigned IP addresses, which are IPs entered by hand into the NIC properties. This way, those servers always retain the same IP address. But what about client machines that might move around or even move in and out of the network? What about phones, tablets, and laptops that join your Wi-Fi networks? DHCP is a mechanism that clients use in order to obtain IP addressing information for the network that they are currently plugged into.

This way, users or admins don't have to worry about configuring IP settings on the client machine as they are configured automatically by the DHCP server. In order for our DHCP server to hand out IP addresses, we...

In a simple DHCP scope, any device that connects and asks for an IP address is handed whatever IP is next available within the scope. If you have a device that you always want to keep the same IP address for, you could manually configure the NIC properties with a static IP address. Otherwise, a more centralized way to assign a particular IP to the same device on a long-term basis is to use a DHCP reservation. Using a reservation in DHCP to assign an IP to a device makes a lot of sense because you can see that reservation right in the DHCP console, and you don't have to worry about keeping track of the static IP addresses that you have configured out in the field. Let's walk through configuring a quick reservation so that you are familiar with this process.

Getting ready

We will be using a Windows Server 2019 machine as our DHCP server where we will create the DHCP reservation. Additionally, we will use our...

Joining computers to your domain is going to be a very normal task for any IT professional, enough that you are probably familiar with the process of doing so. What you may not realize, though, is that when you join computers or servers to your domain, they get lumped automatically into a generic Computers OU inside AD. Sometimes, this doesn't present any problem at all and all of your machines can reside inside this Computers OU forever. Most of the time, however, organizations will set up policies that filter down into the Computers container automatically. When this is the case, these policies and settings will immediately apply to all the computers that you join to your domain. For a desktop computer, this might be desired behavior. When configuring a new server, though, this can present big problems.

Let's say you are interested in turning on a new web server that is going to be running IIS. You have a domain policy...

Creating new user accounts in Active Directory is pretty standard stuff, but doing it the traditional way requires a lot of mouse clicks. Since we know that PowerShell can be used to accomplish anything within Windows Server 2019, but not many people actually employ it regularly, let's implement this common task as a recipe to be accomplished with PowerShell rather than the GUI.

Getting ready

We will use PowerShell on any Windows machine that is either a DC or has the Active Directory RSAT tools installed.

How to do it…

Follow along to create a new user account in Active Directory by using the PowerShell Command Prompt:

1. Launch a PowerShell Command Prompt as an Administrator.
2. Enter the following command in order to create a new user account with very simple parameters:

   Import-Module ActiveDirectory
   New-ADUser -Name 'John Smith' -UserPrincipalName '[email protected] &apos...

If you find yourself constantly having to log onto various servers to perform maintenance tasks, you may eventually run into something that can't be done by the Windows Admin Center, Server Manager, or any of the RSAT tools. You might need to delete a file or adjust a firewall rule. In the past, we would have fired up Remote Desktop, typed in our username and password, waited for the desktop to load in, then started Command Prompt, Windows Explorer, or any number of other mundane maintenance tasks.

With PowerShell, however, there is often no need to jump through the RDP hoops to access a server. In the same way that you can ssh into another server to run commands with Linux, PowerShell has Enter-PSSession, Invoke-Command, and other commands that can be used to configure servers remotely. In this recipe, we'll go through some of these commands to show you how they can save you time in the future.

Getting ready

We...