Windows 2003
Content
Active Directory
Creating the first Windows Server 2003 Domain Controller in a domain Adding a user to Windows Server 2003's Active Directory Adding a computer to Windows Server 2003's Active Directory Adding a Windows XP computer to Windows Server 2003's Active Directory Adding a Windows 2000 computer to Windows Server 2003's Active Directory
Creating the first Windows Server 2003 Domain Controller in a domain
One of the greatest features of Windows Server 2003 is its ability to be a Domain Controller (DC). The features of a domain extend further than this tutorial ever could, but some of its most well known features are its ability to store user names and passwords on a central computer (the Domain Controller) or computers (several Domain Controllers). In this tutorial we will cover the "promoting" (or creating) of the first DC in a domain. This will include DNS installation, because without DNS the client computers wouldn't know who the DC is. You can host DNS on a different server, but we'll only deal with the basics.
Method:
Click Start -> Run...
Type "dcpromo" and click "OK"
You will see the first window of the wizard. As it suggests, I suggest reading the help associated with Active Directory. After this, click "Next"
Click "Next" on the compatibility window, and in the next window keep the default option of "Domain Controller for a new domain" selected, and click "Next"
In this tutorial we will create a domain in a new forest, because it is the first DC, so keep that option selected
Now we have to think of a name for our domain. If you own a web domain like "visualwin.com", you can use it, but it isn't suggested because computers inside of your domain may not be able to reach the company website. Active Directory domains don't need to be "real" domains like the one above - they can be anything you wish. So here I will create "visualwin.testdomain"
Now in order to keep things simple, we will use the first part of our domain ("visualwin"), which is the default selection, as the NetBIOS name of the domain
The next dialog suggests storing the AD database and log on separate hard disks, and so do I, but for this tutorial I'll just keep the defaults
The SYSVOL folder is a public share, where things like .MSI software packages can be kept when you will distribute packages (as I said, AD has a lot of different features). Once again, I will keep the default selection but it can be changed if you wish to use the space of another drive
Now we will get a message that basically says that you will need a DNS server in order for everything to work the way we want it (i.e., our "visualwin.testdomain" to be reachable). As I mentioned earlier, we will install the DNS server on this machine as well, but it can be installed elsewhere. So keep the default selection of "Install and configure", and click "Next"
Because, after all, this is a Windows Server 2003 tutorial website, we'll assume there are no pre-Windows 2000 servers that will be accessing this domain, so keep the default of "Permissions compatible only with Windows 2000 or Windows Server 2003 operating systems" and click "Next"
The restore mode password is the single password that all administrators hope to never use, however they should also never forget it because this is the single password that might save a failed server. Make sure it's easy to remember but difficult to guess
Now we will see a summary of what will happen. Make sure it's all correct because changing it afterwards can prove to be difficult
After the previous next was clicked, the actual process occurs. This can take several minutes. It's likely that you will be prompted for your Windows Server 2003 CD (for DNS) so have it handy
If your computer has a dynamically assigned address (from DHCP) you will be prompted to give it a static IP address. Click ok, and then in the Local Area Connection properties, click "Internet Protocol (TCP/IP)" and then "Properties"
In the next window select "Use the following IP address" and select the information that you will use for your domain (and 127.0.0.1 for the primary DNS, because your computer will host DNS. I still suggest setting up an alternate as well.) Click "OK" and then "Close" on the next window
And after a while you will see
And we're finished.
Adding users to Active Directory
Preface:
As you know, if you try to add AD users using lusrmgr.msc you will receive the following error:
And since I cover creating a local user (lusr) I thought it would only be right to cover creating an Active Directory user.
Method:
Click Start, highlight "Administrative Tools" and select "Active Directory Users and Computers"
Now, expand your domain name on the left side, and go to the bottom where it says "Users". Once you click on that, you will see all of the automatically created users, you will also see all of the users you made before you ran dcpromo - that's because they all stay through the promotion to DC. Anyway, to add a user, you can either right click the "Users" folder on the left side, or the blank area on the right side, and highlight "New" then click "User"
In the next dialog we can set the user's First name, Last name and various other pieces of information, including their log-on name, and domain to which we want to add them
After clicking "Next" you are presented with the password-settings screen. You can set the user's password and then have them change it on their first log-on by selecting "User must change password at next logon". But in this tutorial, I will set it as their password, and not allow them to ever change it without asking me (the administrator) to change it for them
In the next dialog, we get a summary of the user to be created. Click "Finish" and the user has been created
And we're finished!
Adding a computer to Active Directory
Preface:
Earlier, I showed you how to add users to your Active Directory domain. This tutorial will focus on how to add computers. This step is not "really" necessary for workstation computers - at least, I was able to add a Windows XP machine to my domain without adding the computer name first. This is section is really for looking at which computers join, and allow other servers to join as DC's, etc. I will show you how to add the computer using "Active Directory Users and Computers", then in other tutorials, I will demonstrate how to add a Windows 2000 computer and Windows XP computer to this domain.
Update:
Brian Desmond (Windows Server MVP) emailed me with the following information on why someone might want to add a computer to AD manually: "By default a computer will get dumped in the Computers container, unless a Windows 2003 Native Mode Domain is inplace, and redircomp has been run to change this. Precreating computer accounts in OUs will ensure that when the unit is joined, it is in the correct OU, which guarantees policy consistency, and other administrative things. One can also specify who can reset the machine’s password. This will allow an admin to create an account for a computer, and let a normal user join the machine with their credentials."
Method:
Click Start, highlight "Administrative Tools" and select "Active Directory Users and Computers"
Expand your domain name, and right-click "Computers", highlight "New" then click "Computer"
In this dialog we have to type the name of the computer we want to add
In the next dialog just click "Next", then you will see a final report of what will be added, and you can click "Finish". And, we're done!
Adding a Windows XP computer to a Windows Server 2003 domain
Preface:
This is basically the same procedure as the Windows 2000 tutorial. Some things to note about adding a Windows XP computer to a domain are the following:
You need Windows XP Professional to join a XP computer to a domain. Home can't be used fully for this You will loose the "fancy" log on screen and you will receive the "classic" log on screen instead. This is for security and cannot be changed, unless you revert to workgroup mode You will loose the "Fast User Switching". This cannot be restored, except by reverting back to workgroup mode.
Method:
Click Start, right click "My Computer" and click "Properties"
Go to the "Computer Name" tab and click "Change..."
Select the "Domain" radio button then put in your domain name, not including the . extension (in my example I used the domain "hello.test" but when joining the computer to a domain, I will only type "hello")
Press "OK". Then you will be presented with a user name and password prompt. Enter the user name and password of a Domain Administrator
Press "OK" and after a minute or two you will receive a message welcoming you to the domain. Then you will receive a message telling you that a reboot is required, click "OK" to that, and the properties window. Then click "Yes" when you are prompted to reboot. And we're finished. You have just learnt how to add a Windows XP computer to a Windows Server 2003 domain
Additive:
After the XP computer boots to Control-Alt-Delete you may need to change it from logging onto itself (which will use the local info) to logging onto the domain. To do this, press Ctrl-Alt-Del, then the "Options >>>" button on the log on screen. Then select the domain from the drop-down box
After that you can log on using domain credentials
Adding a Windows 2000 computer to a Windows Server 2003 domain
Preface:
I have already shown you how to add AD users and computers to a Windows Server 2003 Active Directory domain, in this tutorial I will show you how to add a Windows 2000 computer to the domain. The method for adding Windows XP is basically the same, but I have created another tutorial for XP which is available here.
Method:
On the Windows 2000 computer, go to the desktop and right click "My Computer" and select "Properties"
In the dialog that comes up, go to the "Network Identification" tab and press the "Properties" button
Under "Member of" click the "Domain" radio button, then type the name of your domain without the trialing extension (for example, my domain name is "hello.test" but I only typed in "hello"
Now you will be prompted to put in the user name and password of a Domain Administrator. Enter the correct information, and press "OK"
Now, wait for about a minute or two and you should receive this message welcoming you to the domain
That's it, press "OK" then "OK", then "OK" in the configuration dialog, and finally "Yes" to reboot and you will be able to log onto the domain using an AD user name and password (not the local 2000 password) to log on.
Additive:
After the 2000 computer boots to Control-Alt-Delete you may need to change it from logging onto itself (which will use the local info) to logging onto the domain. To do this, press Ctrl-Alt-Del, then the "Options >>>" button on the log on screen. Then select the domain from the drop-down box
After that you can log on using domain credentials
Creating the first Windows Server 2003 Domain Controller in a domain Adding a user to Windows Server 2003's Active Directory Adding a computer to Windows Server 2003's Active Directory Adding a Windows XP computer to Windows Server 2003's Active Directory Adding a Windows 2000 computer to Windows Server 2003's Active Directory
Creating the first Windows Server 2003 Domain Controller in a domain
One of the greatest features of Windows Server 2003 is its ability to be a Domain Controller (DC). The features of a domain extend further than this tutorial ever could, but some of its most well known features are its ability to store user names and passwords on a central computer (the Domain Controller) or computers (several Domain Controllers). In this tutorial we will cover the "promoting" (or creating) of the first DC in a domain. This will include DNS installation, because without DNS the client computers wouldn't know who the DC is. You can host DNS on a different server, but we'll only deal with the basics.
Method:
Click Start -> Run...
Type "dcpromo" and click "OK"
You will see the first window of the wizard. As it suggests, I suggest reading the help associated with Active Directory. After this, click "Next"
Click "Next" on the compatibility window, and in the next window keep the default option of "Domain Controller for a new domain" selected, and click "Next"
In this tutorial we will create a domain in a new forest, because it is the first DC, so keep that option selected
Now we have to think of a name for our domain. If you own a web domain like "visualwin.com", you can use it, but it isn't suggested because computers inside of your domain may not be able to reach the company website. Active Directory domains don't need to be "real" domains like the one above - they can be anything you wish. So here I will create "visualwin.testdomain"
Now in order to keep things simple, we will use the first part of our domain ("visualwin"), which is the default selection, as the NetBIOS name of the domain
The next dialog suggests storing the AD database and log on separate hard disks, and so do I, but for this tutorial I'll just keep the defaults
The SYSVOL folder is a public share, where things like .MSI software packages can be kept when you will distribute packages (as I said, AD has a lot of different features). Once again, I will keep the default selection but it can be changed if you wish to use the space of another drive
Now we will get a message that basically says that you will need a DNS server in order for everything to work the way we want it (i.e., our "visualwin.testdomain" to be reachable). As I mentioned earlier, we will install the DNS server on this machine as well, but it can be installed elsewhere. So keep the default selection of "Install and configure", and click "Next"
Because, after all, this is a Windows Server 2003 tutorial website, we'll assume there are no pre-Windows 2000 servers that will be accessing this domain, so keep the default of "Permissions compatible only with Windows 2000 or Windows Server 2003 operating systems" and click "Next"
The restore mode password is the single password that all administrators hope to never use, however they should also never forget it because this is the single password that might save a failed server. Make sure it's easy to remember but difficult to guess
Now we will see a summary of what will happen. Make sure it's all correct because changing it afterwards can prove to be difficult
After the previous next was clicked, the actual process occurs. This can take several minutes. It's likely that you will be prompted for your Windows Server 2003 CD (for DNS) so have it handy
If your computer has a dynamically assigned address (from DHCP) you will be prompted to give it a static IP address. Click ok, and then in the Local Area Connection properties, click "Internet Protocol (TCP/IP)" and then "Properties"
In the next window select "Use the following IP address" and select the information that you will use for your domain (and 127.0.0.1 for the primary DNS, because your computer will host DNS. I still suggest setting up an alternate as well.) Click "OK" and then "Close" on the next window
And after a while you will see
And we're finished.
Adding users to Active Directory
Preface:
As you know, if you try to add AD users using lusrmgr.msc you will receive the following error:
And since I cover creating a local user (lusr) I thought it would only be right to cover creating an Active Directory user.
Method:
Click Start, highlight "Administrative Tools" and select "Active Directory Users and Computers"
Now, expand your domain name on the left side, and go to the bottom where it says "Users". Once you click on that, you will see all of the automatically created users, you will also see all of the users you made before you ran dcpromo - that's because they all stay through the promotion to DC. Anyway, to add a user, you can either right click the "Users" folder on the left side, or the blank area on the right side, and highlight "New" then click "User"
In the next dialog we can set the user's First name, Last name and various other pieces of information, including their log-on name, and domain to which we want to add them
After clicking "Next" you are presented with the password-settings screen. You can set the user's password and then have them change it on their first log-on by selecting "User must change password at next logon". But in this tutorial, I will set it as their password, and not allow them to ever change it without asking me (the administrator) to change it for them
In the next dialog, we get a summary of the user to be created. Click "Finish" and the user has been created
And we're finished!
Adding a computer to Active Directory
Preface:
Earlier, I showed you how to add users to your Active Directory domain. This tutorial will focus on how to add computers. This step is not "really" necessary for workstation computers - at least, I was able to add a Windows XP machine to my domain without adding the computer name first. This is section is really for looking at which computers join, and allow other servers to join as DC's, etc. I will show you how to add the computer using "Active Directory Users and Computers", then in other tutorials, I will demonstrate how to add a Windows 2000 computer and Windows XP computer to this domain.
Update:
Brian Desmond (Windows Server MVP) emailed me with the following information on why someone might want to add a computer to AD manually: "By default a computer will get dumped in the Computers container, unless a Windows 2003 Native Mode Domain is inplace, and redircomp has been run to change this. Precreating computer accounts in OUs will ensure that when the unit is joined, it is in the correct OU, which guarantees policy consistency, and other administrative things. One can also specify who can reset the machine’s password. This will allow an admin to create an account for a computer, and let a normal user join the machine with their credentials."
Method:
Click Start, highlight "Administrative Tools" and select "Active Directory Users and Computers"
Expand your domain name, and right-click "Computers", highlight "New" then click "Computer"
In this dialog we have to type the name of the computer we want to add
In the next dialog just click "Next", then you will see a final report of what will be added, and you can click "Finish". And, we're done!
Adding a Windows XP computer to a Windows Server 2003 domain
Preface:
This is basically the same procedure as the Windows 2000 tutorial. Some things to note about adding a Windows XP computer to a domain are the following:
You need Windows XP Professional to join a XP computer to a domain. Home can't be used fully for this You will loose the "fancy" log on screen and you will receive the "classic" log on screen instead. This is for security and cannot be changed, unless you revert to workgroup mode You will loose the "Fast User Switching". This cannot be restored, except by reverting back to workgroup mode.
Method:
Click Start, right click "My Computer" and click "Properties"
Go to the "Computer Name" tab and click "Change..."
Select the "Domain" radio button then put in your domain name, not including the . extension (in my example I used the domain "hello.test" but when joining the computer to a domain, I will only type "hello")
Press "OK". Then you will be presented with a user name and password prompt. Enter the user name and password of a Domain Administrator
Press "OK" and after a minute or two you will receive a message welcoming you to the domain. Then you will receive a message telling you that a reboot is required, click "OK" to that, and the properties window. Then click "Yes" when you are prompted to reboot. And we're finished. You have just learnt how to add a Windows XP computer to a Windows Server 2003 domain
Additive:
After the XP computer boots to Control-Alt-Delete you may need to change it from logging onto itself (which will use the local info) to logging onto the domain. To do this, press Ctrl-Alt-Del, then the "Options >>>" button on the log on screen. Then select the domain from the drop-down box
After that you can log on using domain credentials
Adding a Windows 2000 computer to a Windows Server 2003 domain
Preface:
I have already shown you how to add AD users and computers to a Windows Server 2003 Active Directory domain, in this tutorial I will show you how to add a Windows 2000 computer to the domain. The method for adding Windows XP is basically the same, but I have created another tutorial for XP which is available here.
Method:
On the Windows 2000 computer, go to the desktop and right click "My Computer" and select "Properties"
In the dialog that comes up, go to the "Network Identification" tab and press the "Properties" button
Under "Member of" click the "Domain" radio button, then type the name of your domain without the trialing extension (for example, my domain name is "hello.test" but I only typed in "hello"
Now you will be prompted to put in the user name and password of a Domain Administrator. Enter the correct information, and press "OK"
Now, wait for about a minute or two and you should receive this message welcoming you to the domain
That's it, press "OK" then "OK", then "OK" in the configuration dialog, and finally "Yes" to reboot and you will be able to log onto the domain using an AD user name and password (not the local 2000 password) to log on.
Additive:
After the 2000 computer boots to Control-Alt-Delete you may need to change it from logging onto itself (which will use the local info) to logging onto the domain. To do this, press Ctrl-Alt-Del, then the "Options >>>" button on the log on screen. Then select the domain from the drop-down box
After that you can log on using domain credentials
