Rebuilding Virtual Machines for 70-642 learning

  1. Create one machine named Dcsrv1 'Template'
  2. Install and update windows
  3. Install the virtualbox addons
  4. run sysprep to aid clean/convenient cloning of this machine (i.e. a template)
  5. Clone it three times (Dcsrv1, Boston,Binghamton)
  6. Set the machines' network connections to 'internal network' in virtualbox (i.e. so they can see each other but not the host computer's network and not the internet). Note: Not for this learning, but if you want a VM to be on the same network as the host pc (so they can see and interact with each other and other machines on the host pc's network, and be able to see the internet - use 'bridged network' and make sure the default gateway and dns server settings are the same as the host's.)
  7. Change the machines' hostnames accordingly (dcsrv1, boston, binghampton) but leave them on 'workgroup' for now.

Depending where I am up to in the book (could be starting again) follow these instructions as far as appropriate... (note, these are just the action instructions. I've left out all exercises/steps that make no permanent changes to the server(s))

Page 36...

  1. Dcsrv1 - set the ip address to 192.168.0.1 , subnet mask as is (255.255.255.0) (open the properties from the command prompt using ncpa.cpl to practice that way of opening it) (note, in these steps you might need to reboot the machines.. they seem to keep their old ip as well as the new one)
  2. Boston - Server manager -> view network connections (another way of getting to it)
  3. Open 'alternative config' tab. Set the ip to 192.168.0.200. subnet mask 255.255.255.0.
  4. Uncheck the validate settings box.
  5. At command prompt - netsh interface ip set address "Local area connection" static 192.168.0.2 255.255.255.0
  6. Enable file sharing on Dcsrv1 and boston

Page 102

  1. Dcsrv1 - ncpa.cpl at command prompt or 'run' (again - just another way of getting to the settings) - open ipv6 settings - change the ipv6 address to fd00::1, subnet prefix length 64
  2. Boston - same but set the ip to fd00::2

Page 152 (create the domain)

(note, if ever creating a DC in a real world situation you would make sure the machine is fully up-to-date with updates/patches first)

  1. Dcsrv1 - run 'dcpromo' (in the search bar type 'dcpromo' and press enter)
  2. When the wizard dialog box appears click next (i.e. don't check 'advanced mode installation') Next again.
  3. check 'create a new domain or forest' click Next.
  4. 'nwtraders.msft' as the FQDN
  5. Functional level - server 2008 r2
  6. Make sure 'DNS server' is checked.
  7. Progress until 'summary' and click the 'export settings' button and save the settings as an answer file (generally a good idea to do this)
  8. Finish the wizard and restart.
  9. Create a personal administrator account (new user, add to domain admins group)

Boston needs DNS server settings pointing to the new DC before it can be added to the domain...

  1. On boston - netsh interface ipv4 set dnsserver "local area connection" static 192.168.0.1
  2. now ipv6 - netsh interface ipv6 set dnsserver "local area connection" static fd00::1
  3. Now join the domain (make sure the name is 'boston') (if doing this from 'initial configuration tasks' use 'provide computer name and domain'... but I usually do it from 'system' in 'control panel')

Page 201 (create a GlobalNames Zone)

  1. open elevated command prompt on dcsrv1 and run dnscmd . /config /enableglobalnamessupport 1 (note the space after the dot)
  2. In DNS manager right click forward lookup zones container and choose 'New Zone', on the screen of text click Next.
  3. Leave as Primary zone, and store the zone in active directory checked
  4. select 'To All DNS Servers In This Forest' and click Next.
  5. On the Zone Name page type GlobalNames and click Next.
  6. Select Do Not Allow Dynamic Updates
  7. Click Finish
  8. Select and then right click the GlobalNames zone and choose new alias (CNAME)
  9. type 'mail' for the name
  10. type 'dcsrv1.nwtraders.msft' for fqdn and click ok

Page 218 (create an Application Directory Partition for DNS)

  1. On dcsrv1 type dnscmd . /createdirectorypartition DNSpartitionA.nwtraders.msft
  2. Select nwtraders.msft zone in forward lookups in dns manager, then right click and choose properties
  3. Click Change on the general tab for replication
  4. select To All DOmain Controllers In The Scope Of This Directory Partition
  5. In the dropdown box choose DNSpartitionA.nwtraders.msft and click ok. In the properties box click ok

Page 219 (Deploy a Secondary Zone)

  1. On boston add the dns server role and when complete open dns manager
  2. select then right click the forward lookups zone and then select new zone. Select Secondary Zone
  3. on the zone name page type 'nwtraders.msft'
  4. In the master servers area type 192.168.0.1 and press enter
  5. click finish
  6. on dcsrv1 right click the nwtraders.msft forward lookup zone and choose properties then select zone transfers tab
  7. select allow zone transfers (make sure 'to any server' is selected) and click ok
  8. on boston right click nwtraders forward lookup zone and choose transfer from master (if there is an error - wait 15 seconds and press f5)
  9. on dcsrv1 select the nwtraders.msft zone
  10. double click the NS record and click Add
  11. type boston.nwtraders.msft and click resolve, then click ok
  12. in the nwtraders.msft properties dialog box click the zone transfers tab and select only to servers listed on the name servers tab

Page 243 (Configuring DNSSEC)

  1. On dcsrv1 right click forward lookups and click New Zone. Click next on the first page
  2. Uncheck 'Store The Zone in Active Directory' and click next
  3. Type northwindtraders.com for the name and click Next
  4. Verify that 'Do Not Allow Dynamic Updates' is selected and click Next then click Finish
  5. Right-click the northwindtraders.com container and choose New Host (A Or AAAA)
  6. Type dcsrv1 in the Name box and 192.168.0.1 in the IP Address box and then click Add Host. Then click ok
  7. Type boston in the Name box and 192.168.0.2 in the IP Address box and then click Add Host. Then click ok
  8. Click Done
  1. Open elevated command prompt and type cd \windows\system32\dns
  2. Generate KSK by typing dnscmd /OfflineSign /GenKey /Alg rsasha1 /Flags KSK /Length 1024 /Zone northwindtraders.com /SSCert /FriendlyName KSK-northwindtraders.com
  3. Generate the ZSK by typing dnscmd /OfflineSign /GenKey /Alg rsasha1 /Length 1024 /Zone northwindtraders.com /SSCert /FriendlyName ZSK-northwindtraders.com
  4. Open the DNS console. Right-click the northwindtraders.com folder and click Update Server Data File
  5. At the command prompt type dnscmd /OfflineSign /SignZone /Input northwindtraders.com.dns /Output signed.northwindtraders.com.dns /Zone northwindtraders.com /SignKey /Cert /FriendlyName KSK-northwindtraders.com /SignKey /Cert /FriendlyName ZSK-northwindtraders.com
  6. type dnscmd /ZoneDelete northwindtraders.com /f
  7. type dnscmd /ZoneAdd northwindtraders.com /Primary /File signed.northwindtraders.com.dns /Load
  8. In the DNS console right click northwindtraders.com and click Refresh.
  1. On dcsrv1 open Group Policy Management and right click on Nwtraders.msft in the domains container. Then click Create a GPO In This Doman, And Link It Here
  2. type DNSSEC Policy and click Ok
  3. right click DNSSEC Policy and click edit.
  4. Navigate to Computer Configuration\Policies\Windows Settings\Name Resolution Policy
  5. In the details pane, in the create rules area, ensure that Suffix is selected beneath 'To Which Part Of The Namespace Does This Rule Apply?' then type northwindtraders.com
  6. On the DNSSEC tab click Enable DNSSEC In This Rule
  7. In the DNSSEC Settings area click the option to require DNS clients to check that name and address data has been validated by the DNS server.
  8. Click Create then click Apply
  9. On boston type gpupdate then type ping dcsrv1.northwindtraders.com

Page 266 (Deploying a DHCP Server)

  1. start Add Roles wizard on dcsrv1. Click Next, then choose DHCP Server and click next again, and again.
  2. Verify that 192.168.0.1 is selected and click Next
  3. Verify that nwtraders.msft is the parent domain and specify 192.168.0.1 as the prefered DNS server IPv4 address and click next
  4. Make sure 'WINS is not required...' is checked and click next
  5. Click Add
  6. Fill in the next page with the following info...

    Scope Name: Nwtraders.msft IPv4
    Starting IP Address: 192.168.0.20
    Ending IP Address: 192.168.0.254
    Subnet Type: Wired
    Activate this scope: Checked
    Subnet Mask: 255.255.255.0
    Default Gateway: 192.168.0.1


    ... then click ok. then click next
  7. Leave the Enable DHCPv6 Stateless Mode For This Server option selected and click Next
  8. On the Specify Ipv6 DNS Server Settings page Verify that nwtraders.msft is the parent domain and specify fd00::1 as the prefered DNS server IPv6 address. Verify that fec0:0:0:ffff::1 is specified as the alternate DNS server IPv6 address. Click Next
  9. Verify that Use Current Credentials option is selected and click Next
  10. Click Install. When done click close.
  1. On boston, open an elevated command prompt and type netsh interface ipv4 set address "local area connection" dhcp
  2. type netsh interface ipv4 set dnsserver "local area connection" dhcp
  3. type ipconfig /all

Page 286 (Creating an Exclusion Range)

  1. In DHCP console on dcsrv1 navigate to DHCP \dcsrv1.nwtraders.msft\IPv4\Scope [192.168.0.0] Nwtraders.msft IPv4\Address Pool.
  2. Right-click the Address Pool folder and then choose New Exclusion Range
  3. type 192.168.0.200 and 192.168.0.210 in the Start IP Address and End IP Address boxes respectively.
  4. Click Add, then click close