Active Directory Setup Guide

by Lavanya Rath - Last Updated: September 5, 2021

Active Directory Setup Guide

Directory services can be a critical component to managing your IT infrastructure. They connect users with the set of services available in a network and give IT admins granular control over who uses what within a network.

A well-known directory service is Active Directory, introduced by Microsoft in 1999 as a part of its Windows Server 2000. This article will take a deep look into what Active Directory is, how it can benefit your organization, and how you can set it up.

What is Active Directory (AD)?

Based on the Lightweight Directory Access Protocol (LDAP), Active Directory takes care of authorizing and authenticating users in your environment to use specific resources or applications.

It also contains extensive information about every user, including their role, personal details, passwords, and their permissions to use different applications.

As you can see, it is a one-stop place to control access and prevent unauthorized use.

But is that all it offers for your organization?

Benefits of Active Directory

Here’s a look at the benefits of AD for your organization.

  • Provides simple login access for all global resources
  • Enables centralized control and security administration
  • Simplifies the identification of specific resources
  • Speeds up the process of authorization for resources
  • Optimizes productivity
  • Helps with capacity planning
  • Provides detailed information about hardware and applications, besides better understanding the network
  • Simplifies network administration and management
  • Efficiently manages trust relationships between domains within an organization
  • Improves scalability, especially when there are more organizational units

Types of Active Directory Services

There are seven types of AD services that are deployed across different environments, and they are:

  • Active Directory Domain Services (AD DS) Deployed on the server and used for identity
  • Azure Directory Federation Services (ADFS) Deployed on the server and used for single sign-on
  • Azure Active Directory (AAD) Deployed on the cloud and used for cloud identity
  • Azure Active Directory Domain Services (AAD DS) Deployed on the cloud and hybrid environments
  • Azure Active Directory Connect Server Provisioning Deployed on the server and used for syncing AD and AAD
  • Azure Active Directory Connect Cloud Provisioning Deployed on the server and used for limited syncing of AD and AAD
  • Azure Active Directory Application Proxy Deployed on the cloud and used to enable Azure AD legacy apps

Working of Active Directory

AD DS is the main service directory, and it is a part of the Windows operating system. The servers that run this service are called the Domain Controllers (DCs), and often there are multiple DCs, with each containing a copy of the entire domain. These DCs work together, such that a change made to one DC gets updated across all the DCs.

The AD stores users, applications, devices, etc., as objects with a name and attributes. Typically, the AD DS is activated when a user logs into a device or application, and it verifies if the user is authorized to access that object. It also controls which users or groups have access to which resources.

Structure of Active Directory

The Active Directory structure comprises of three components, namely,

  • Domains
  • Trees
  • Forests

Objects like users and devices that use the same AD database are grouped in the same domain. It merits to note that each domain has a DOmain Naming Structure (DNS), and multiple domains can be combined to form another structure called the tree.

These tree structures use a contiguous namespace to ensure that all their domains are arranged logically for easy reference. Also, every domain within a tree has an implicit trust relationship with other co-domains, and there is a secure connection shared among all the domains.

As you may have guessed, a collection of trees is called a forest, where admins can provide specific rights, access, and privileges at all levels of the forest, domain-wide, tree-wide, and forest-wide.

Now that you have a firm idea of what an Active Directory is let’s see how to set it up.

How to Set Up an Active Directory?

As a first step, check if you have the following prerequisites.

  • Administrative rights on the server
  • A server with a static IP address
  • Your Windows server name should match your company’s naming standards

Once you have these, it’s time to start the setup.

Check the IP Address and Admin Privileges

  • Open the Server Manager and navigate to the “Local Server” on the left-hand pane
  • Scroll down for the static IP address on the right-hand pane and click on it. This opens your network adapter
  • Right-click on your adapter and select “Properties”
  • Look for IPv4, select it, and click on the “Properties” button
  • A window with Ip address will pop up. Check if the preferred DNS address is the same as the IP address

Next, open the PowerShell terminal and double-check if you’re logged in as an administrator.

You must see C:\Users\Administrator at the prompt. Alternatively, run the command “whoami,” and this should return the name of the server/administrator.

Install the Active Directory Domain Services Role

To do this,

  • Open Server Manager and look for an option called “Manage” on the top right-hand pane. Click that, and in the drop-down menu, select “Add Roles and Features”.
  • This opens a new window, and in it, you’ll see the different things that have to be verified before you can continue under the “Before You Begin” section in the left-hand pane. Run through them all, including the displayed server name to ensure that they are correct.
  • Next, run down through the left-hand menu and in “Installation type”, choose if you want a role-based installation or Remote Desktop Services one.
  • Moving on, click “Server Selection” on the left-hand pane and choose the server on which you want to set up AD.
  • Under “Server Roles”, select Active Directory Domain Services. Sometimes, you may get a pop-up window that asks you to add specific services required for this setup. You don’t have to do much here; just click the “Add Features” button at the bottom. Ensure that the add Management Tools if the required checkbox is clicked as well.
  • Next, go back to “Server Roles” and check the “DNS Server” option, and follow the same process as above.
  • Finally, navigate to the “Confirmation” option on the left-hand pane and confirm your selection. This will install all the features for you.

Make the Server as a Domain Controller

Once the features are installed, look for a link on the right-hand pane that says “Promote this server to a domain controller” and click it. This opens the Deployment Configuration window, and here’s a step-by-step guide on the selection.

  • First off, select the deployment option you want. You can add this domain controller to an existing domain, or you can add it to a new domain in an existing forest, or create a new forest altogether. Next, give the root domain name. Click next, and this will take you to the domain controller option.
  • In this example, let’s assume we are creating a new forest to select the functional level. In general, use the maximum available value or the lowest one from the drop-down box. Do the same for the domain functional level as well.
  • Next, select the domain controller capabilities and, finally, give a password.
  • Moving down, in the “Additional Options” heading, verify the NetBIOS name assigned to the domain and make a change if necessary.
  • Next, navigate to “Paths,” where you specify the location of your AD DS database, log files, and SYSVOL folder.
  • Finally, review your selection and confirm it.
  • The system will run through the prerequisites to ensure that you have everything in place, and if all the prerequisites are present, you can see a green tick box at the top.

After the installation completes, your system will restart automatically. When the system continues, you’ll be prompted for the password you gave earlier. Next, open the Server Manager and click on “Tools” on the right-hand top corner, and in the dropdown menu, you’ll see the management consoles for this Active Directory. Using these consoles, you can manage your AD services.

If you find it overwhelming to manage your AD services, you can always choose third-party tools to manage it.

Here’s a look at some of the popular tools for Active Directory management:

  1. SolarWinds Access Rights Manager (ARM) – FREE TRIAL A comprehensive tool for managing and auditing access across your entire IT infrastructure.
  2. SolarWinds Server & Application Monitor (SAM) – FREE TRIAL This comprehensive tool simplifies server and application monitoring.
  3. ManageEngine ADAuditPlus Helps keep your Windows safe and compliant by providing complete control and visibility into the activities in it.

Let’s take a detailed look at each of these tools.

1. SolarWinds Access Rights Manager (ARM) – FREE TRIAL

SolarWinds Access Rights Manager (ARM)

SolarWinds Access Rights Manager (ARM) is a top-notch tool from SolarWinds that manages and audits access across your entire IT infrastructure through your Active Directory.

Features

The salient features of SolarWinds Access Rights Manager (ARM) are:

  • Validates IT compliance for many popular standards
  • Mitigates security risks in real-time
  • The Active Directory group management tool makes it easy to implement policies and permissions
  • Generates permission reports for security and analysis
  • Supports SLAs using its provisioning tools
  • Automates user account management
  • Protects against malicious and accidental data leaks
  • Optimizes account management with Azure AD monitoring
  • Delegates access rights management
  • Understand and acts high-risk access

Pricing: It starts at $1,838 – see https://www.solarwinds.com/access-rights-manager/registration

Download: You can test-drive SolarWinds Access Rights Manager (ARM) for a fully functional 30-day free trial.

Download Button

2. SolarWinds Server & Application Monitor (SAM) – FREE TRIAL

SolarWinds Server and Application Monitor (SAM)

SolarWinds Server & Application Monitor is an end-to-end monitoring tool that can stay on top of the performance of more than 1.200 applications, besides auditing Active Directory.

Features

Here’s a look at some of the features of SAM related to Active Directory monitoring.

  • Checks the replication status among domain controllers to diagnose any related issues
  • Regularly reviews domain controllers and their corresponding FSMO roles
  • Provides insights into site details, especially remote ones
  • Monitors logon and Windows events
  • Analyzes the schemas, configurations, ForestDNSzones, and more to give you an accurate picture
  • Allows you to view, sort, and search for various FSMO roles

Pricing: SAM starts at $1,622 – see https://www.solarwinds.com/server-application-monitor/registration

Download: You can try SolarWinds Server & Application Monitor (SAM) for a fully functional 30-day free trial.

Download Button

3. ManageEngine ADAudit Plus

ManageEngine ADAudit Plus

ADAuditPlus is a tool that gives comprehensive visibility into the activities that happen in the Windows ecosystem, so you can keep it secure and compliant to industry standards.

Features

The well-known features of ManageEngine ADAuditPlus are:

  • Monitors logins to the different resources on the Windows ecosystem
  • Analyzes lockouts to give you complete control over access rights
  • Detects changes to users, groups, organizational units, AD objects, and more
  • Tracks file accesses and permissions
  • Monitors the integrity of Windows workstations
  • Sends alerts in real-time
  • Generates audit-ready reports
  • Detects critical activities and misshapenings

Pricing: Click here to get an online quote.

Download: Click here for a free download.

Conclusion

To conclude, Active Directory is a directory that monitors users, resources, and interactions among these groups. Since this centralizes management and administration and gives fine control over access privileges, it is popularly used in Windows environments the world over today.

Such a comprehensive tool has a multi-step process for enabling and setting it up on Windows servers, and following the above steps can help you get it going within just a few minutes. Besides setup, you also have to monitor it regularly, and for this, there are many third-party tools.

The above three tools mentioned in this article are well-known and comprehensive in their monitoring, and they can come in handy to manage your Active Directory environment with relative ease. However, while you can pick any of the three tools, consider the size and complexity of your environment, the ancillary services you may need, the associated integrations, and your budgetary constraints before choosing the appropriate one.