In this post, we’ll walk through the process of how I set up an Active Directory (AD) in my home lab. I know, this blog is normally database focused, so why are we looking at Active Directory? Well, yes, it isn’t strictly database related. However, where there is an enterprise SQL Server estate, there is normally Active Directory. In the next few posts, we’ll be looking at Availability Groups, which, whilst configurable without AD, generally are run in AD environments. Also, it isn’t really a great deal of work to set up in the home lab. It takes longer to install the Windows server than to actually set up AD, so it’s not really an issue to set it up to have a more realistic lab environment.
I am using Windows Server 2022 and have set up a specific VM for this purpose which is fairly modest with 2 CPU cores and 4GB of memory.
Installing the Active Directory Binaries
Once the VM is set up, I RDP’ed to the new server as the local admin user and opened an administrator PowerShell prompt. The first step is to add the AD Domain Services Windows feature. Let’s also add the management tools which will install utilities such as Active Directory Users and Computers and the PowerShell modules.
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools
The feature starts installing; we just have to wait for it:
Here’s what it looks like once complete:
As an aside, we can see the Windows feature names that the -Name parameter accepts by using the Get-WindowsFeature cmdlet and looking at the name property. We can also filter if we need to:
Get-WindowsFeature -Name "*Domain*"
Promoting to a Domain Controller
Now we have the binaries and tooling installed on the server, the next step is to actually make the server into a domain controller (DC). This process is called “promoting” the machine to a domain controller. Again, this can be done via PowerShell and we will need the ADDSDeployment module which was installed with the management tools above. The new domain will be called dualcoredomain.local and will have a NetBIOS name of DUALCORE. Adding the -InstallDNS flag will install DNS services on the server, allowing it to function as a DNS server:
Import-Module ADDSDeployment
Install-ADDSForest -DomainName "dualcoredomain.local" -InstallDNS -DomainNetbiosName DUALCORE
During the install, we are asked for a Safe Mode administrator password:
Now we are asked to confirm we are OK to restart once complete, to which I will answer Yes to All:
Again, we can follow the progress and wait for things to finish:
Eventually, we get a notification that we are going to be signed out:
We then get signed out and wait for a reboot (this took a good 5-10 minutes in my run-through). I saw the following through the VM console, rather than my RDP session:
Domain controllers do not have local accounts, so once restarted, we have to log in as the domain admin, in this case DUALCORE\Administrator.
A note at this point is that if there were any local accounts on the machine, they become domain accounts as the local SAM database is migrated to the AD database. I hadn’t created any local accounts and so this wasn’t an issue for me.
Setting up an AD User
At this point, our Active Directory is working and we have our domain controller set up. To finish things up, I’ll create an account to use as a domain admin and then we’ll join a computer to the domain.
Let’s create the new user. The command below will create a new user in the default Users container.
Import-Module ActiveDirectory
New-ADUser -DisplayName DualCoreDBA -Name DualCoreDBA -UserPrincipalName DualCoreDBA@dualcoredomain.local -GivenName DualCore -Surname DBA -Enabled $true -PasswordNeverExpires $true -AccountPassword (Read-Host -AsSecureString "Enter Password")
We don’t get any explicit feedback that it is done:
We can confirm the user was created, if we wish, with:
Get-ADUser -Identity "DualCoreDBA"
Now we can make the account a Domain Admin by adding it to that group:
Add-ADGroupMember -Identity "Domain Admins" -Members "DualCoreDBA"
Joining Computers to the Domain
Now I can join other computers to the domain. I already have a Windows jump box that I use for running SSMS, so I will add that. This will mean I will be able to connect to SQL Servers via SSMS on the jump box and authenticate with Windows authentication.
The following commands were executed from an admin PowerShell prompt on the machine I was adding, though of course, they could be run from a remote PowerShell session also if desired.
The first step is to set the new DC as the DNS server for the machine we are adding. The IP of the DC in my case is 192.168.2.96. We can set the DNS address with the command below:
$id = Get-NetAdapter | Where-Object {$_.Name -eq "Ethernet"} | Select-Object -ExpandProperty ifIndex
Set-DnsClientServerAddress -InterfaceIndex $id -ServerAddresses ("192.168.2.96")
Finally, we add the computer to the domain. It will restart after doing this. The credential we provide needs to be an account that is on the dualcoredomain.local domain – I used DUALCORE\DualCoreDBA which was set up above.
Add-Computer -DomainName "dualcoredomain.local" -Credential (Get-Credential) -Restart
Testing It
Finally, to test that everything is working, let’s RDP to the machine I added to the domain and log in to a SQL Server on the domain. I added that server in the same way as above. I also created a login for DUALCORE\DualCoreDBA.
I am using Linux and so use Remmina to RDP to Windows servers. If you are using a Windows machine, you would use a standard mstsc prompt.
The connection name is WINJUMP_DBA, which logs me into the WINJUMP server as DUALCORE\DualCoreDBA:
Now I’ll open SSMS on the WINJUMP server and log in to the SQL Server, SQL01, with Windows authentication:
With that, we are in and can see the Object Explorer, which also confirms the user we are logged in as:
Conclusion
In this post, we set up an Active Directory domain controller, creating a new Active Directory domain in the process. We added computers to the domain and used an AD account to log in to a SQL Server on our domain.
References / Further Reading
CloudJump – What Is a Security Account Manager (SAM) Database?