# Configuring your first Active Directory server | Active Directory Domain Services (ADDS)

## Introduction

Welcome, doodler! In this blog, we will discuss what an Active Directory is, know how it works, and configure it in our environment.

## What is Active Directory?

It is a proprietary directory services product [*built by Microsoft Corporation introduced in 1999*](https://en.wikipedia.org/wiki/Active_Directory/)\[1\] included in the ***Windows Server Operating System***. Basically, what it does is it collects *users*, *computers*, and *devices* (and many more)—*Objects*—information—*Attributes*—and records those information in a sub-folder, under a global folder that holds all the sub-folders and other related information. The global folder we’re talking about is called, “***Domain***.”

***Domain***, as it name suggests, is a **named area**—*container or a folder, whatever you want to refer it to*—that holds, maintains, and controls (*by an Administrator*) all the attributes of the objects inside it. Objects can be records of *computers*, *devices*, *users* (***Non-Containerized Objects***), or an *Organizational Unit* (OU) that is an object that can hold new objects within it (***Containerized Object***).

Another thing is the ***Domain Controller*** (**DC**). It is a ***server*** that provides directory services to the domain. Of course, *it can run different domain services products* such as **OpenLDAP** and the one we are focusing right now, Active Directory. With it, directory service is implemented within a Domain, and *a Domain Controller could only be part of a single domain*, as opposed to a Domain with multiple Domain Controllers are involved.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729947997948/2fc40083-77fa-46aa-bb8f-e73a34931f6a.png align="center")

As additional information for this blog, but important pieces in how Active Directory works are the communication protocols it use to make all the mechanisms work to make the product—*that is, Active Directory*. The product is mainly powered and ***Lightweight Directory Access Protocol*** (**LDAP**), a protocol used in authentication to identify if the user requesting access has a valid record to perform within the Domain. [*You can find useful information here*](https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol)\[2\]. [***NTLM***](https://en.wikipedia.org/wiki/NTLM)\[3\](least preferred) and [***Kerberos***](https://en.wikipedia.org/wiki/Kerberos_\(protocol\))\[4\] are also leveraged by the product in performing authentication functionalities.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729948019412/ae7992bb-b6ec-47e6-84e1-25cd8885c306.png align="center")

***Domain Name System*** (**DNS**) service also plays a huge part on this product. It is a system of how a **Domain** *can name its territory and the objects under it*. Its naming hierarchy does the job well in defining a *Domain Name* and *structuring the directories* of the domain. We can see below that a single domain can create sub-domains under it—***child domain***—which can then contain objects as well. Sub-domains can only access both other sub-domains and objects living under it, but the *global domain* (***Parent***) can access anything under it. It is possible for a child to access parent’s objects by establishing a ***trust*** in between.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729948035687/b39e9545-4369-4d4d-a43d-32c554cf2755.png align="center")

## Do I need Active Directory?

If you’re just a *normal person* doing average computer stuff, probably you won’t appreciate doing it, ***but if you’re working in a corporate environment*** with a lot of ***computers*** to manage, ***printers*** that aren’t friendly, ***user records*** of every employee in ***each department***, you need it. **Connecting the dots**, your *corporate environment* is the **Domain**, the *every department* is an **Organizational Unit** (**OU**), and *users*, *computers*, and other *devices* are **Non-Containerize** objects.

## Setting up our Topology

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729948060455/91a23506-449b-4309-aa04-1f67ad86347b.png align="center")

We can see that both the *Domain Controller* and *Computer* lies within the same subnet. Based on the below picture, our for desktop to join the domain ***NEKWOKDOODLE.local***. To do we need to setup the *Domain Controller* to be an ***Active Directory Domain Services*** server to provide the functionality we need.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729948146026/40ea1cc5-7ed9-4734-92f7-c4930379f259.png align="center")

## Configuration Steps

1. Enable Active Directory Domain Services Role
    
2. Setup the Domain Services Feature
    
3. Join the Computer to the Domain
    

### STEP 1: Enable Active Directory Domain Services Role

In the ***Server Manager Dashboard***, go to ***Manage > Add Roles and Features***.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729937754476/ba1c7b82-d93e-4e3b-adc6-a0124ead0b15.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729937813710/2f737821-02a5-403f-9185-e23469a42fcb.png align="center")

**Continuous Next** and in *Server Roles*, ***mark*** the ***Active Directory Domain Services****.* ***Continue*** to click ***Next***

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729949442776/d311110d-34b7-4f4d-83c6-90909abc8494.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729949477726/14cc3a3a-2797-4094-b47a-2b551f0539ac.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729949523487/7901f771-c377-4799-88e7-16d94b3ed332.png align="center")

Skip ***Features*** for a while.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729949602530/6bbe92b1-242d-4517-b7b9-30dc95609c4c.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729949634217/1615aed4-0e4b-41a5-b326-f4bdacafd78f.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729949668536/ae1d0b29-10dd-4c83-b7bf-0c64946f4b3c.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729949394304/a753cbbf-817f-46b6-8d6b-6d4660162833.png align="center")

It is important for the corporate IT infrastructure to name all the devices in a systematic way. Go to ***Control Panel > System and Security > System > Change Setting***s to change server’s name first. ***Restart*** the system if prompted.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729949311094/b0d1d118-7cd0-4c8e-b6b1-a82ec5a9d857.png align="center")

### STEP 2: Setup the Domain Services Feature

We’ve successfully installed the ***Active Directory Domain Services*** (**ADDS**) role in our Windows Server. Now, ***Promoting*** to be a ***Domain Controller*** is our next task. Go back to ***Server Manager Dashboard*** after restarting.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729938878751/f1c76849-6a41-4122-b51c-059de5aa4358.png align="center")

The purpose of promoting is simple, *enabling the feature*. Here, configuring the server to be an ***Active Directory Domain Controller***.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729939250006/cfd6205e-8ae0-4d95-b5f2-6329e247d8bd.png align="center")

Enter your password. Note that this is not the account password. We can safely skip the explanation for it as we are focusing in our main goal.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729949210591/b613efd3-b57a-4b42-8c91-393701eea7c2.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729939336129/a0249a18-c2d0-4021-a36a-ab5726834a64.png align="center")

Wait until it’s done and simply click ***Next***.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729939382696/8126b9cc-640e-499e-b769-544f56408ed6.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729939404733/01e2c5fe-e9d8-4b52-94d9-02dad0454360.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729949164135/0228d057-7d31-4c4f-8f15-329540b98fc1.png align="center")

After successfully installed, the server *auto-restarts*.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729949115557/59fef09d-98a6-466d-8646-b9cb96908588.png align="center")

We can see that ***NEKWOKDOODLE.org*** domain name is successfully created. Log in using the our administrator password (unchanged).

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729939863037/b4dd9b3c-3ce7-4842-91b6-531c44e4f130.png align="center")

We can confirm the ***Primary Dns*** ***Suffix*** and ***Dns Suffix Search List***. Now, the new full name of our server is ***DC1.nekwokdoodle.org***

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729948982250/18d06181-1ecc-46cf-8c82-eddb17bae007.png align="center")

Below is the Desktop IP configurations. Notice that the ***DNS Server*** is the ***Windows Server’s IP Address***. It is important to *point the DNS query to the right server* because when the desktop is *joining a domain*, it will *resolve* an *LDAP request* to the DNS server, and if it does *not find the right DNS record*, the j*oin request will be an error.*

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729949027824/ded16c3f-f67e-49ac-9abc-276661d8e35e.png align="center")

We can reach the Domain Controller means that we can further our configuration.

### STEP 3: Join the Computer to the Domain

In ***Active Directory Users and Computers > nekwokdoodle.org > Computers***, there are no current computer listed. We can add via *Right-Click + New*, but there’s a better way to join a computer.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729942590525/ed0a3294-1117-4d8e-91f3-67da358f6d01.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729942638202/b062cebe-e4ed-472f-8db3-93949138d632.png align="center")

First things first, change the name. Go to ***Settings > System > About > Rename this PC (advanced)***

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729948792123/bbb9404b-54e1-4f89-8f9f-450bf759a8ef.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729948721094/e6049000-e6b1-47e3-a1e7-d848f8640eea.png align="center")

After changing the name, click ***Member of > Domain***, and type our domain name, ***NEKWOKDOODLE.org*** and ***OK****.*

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729942855883/cc86e4c7-8fe1-4bb3-8a79-180afbdb0cc6.png align="center")

Administrator credentials for the domain is needed for security purposes.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729942918528/d73bb803-5704-422e-a58e-7069e843b4b6.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729942953354/30b8dfb2-3c16-4cd1-80b6-53d71b80f7aa.png align="center")

Great! ***DESK-CLIENT-1*** is automatically added to the ***Computers*** directory, and we can confirm its *DNS Suffix*. Now the new full name of our computer is ***DESK-CLIENT-1.NEKWOKDOODLE.org***.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729943004943/49fdc1c3-b5dc-492d-94b7-5f88f85af591.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729943131140/6a0c4afa-8ab2-4ae2-9f9f-2e5c498c1896.png align="center")

A ***ping*** test from our server shows that *it can resolve our desktop’s full name.*

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729943217123/e164520c-2fd8-400f-89f0-87fc6f0940fb.png align="center")

Our computer now is part of the domain and the Administrator can directly manage access. To have an idea, *Administrators* can enforce *policies* to limit certain usage based on the corporate policy guidelines.

### Bonus Configuration: Creating a User and Attaching it to the Desktop Client

Now that the computer is part of our domain, we can create a user and limit its access to ***DESKTOP-CLIENT-1.NEKWOKDOODLE.org***

To create a new account, go to ***Active Directory Users and Computers > Users > New > User***, fill the form until finish.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729943488906/9bc0ec74-9785-478f-a286-be4c0ee2fcce.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729943573599/ebddf50a-3ae8-4494-95ae-c407b702c777.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729943629903/46f2c0bb-78c0-4ded-83b6-1fd533793a6a.png align="center")

Keep an eye of the logon name and email address. Also, do not forget the created password.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729943650414/8be663b7-52a0-4ade-b6fd-bb5f849de0fa.png align="center")

User is created. ***Right Click + Properties > Account > Log On To,*** add the name of our desktop client.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729943703916/00bed64c-6e85-45e7-ad03-e2113629e1bc.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729943744412/39a71c62-6e0c-47ac-aa18-bff44f24b5be.png align="center")

Click ***OK***, and another ***OK***. This means that ***Dwiight Schrute*** user c*an only log in to the computer we define*.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729943796655/d6768b29-838d-48d0-939c-aa825679912f.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729944109864/1cb74029-50e6-49d9-a211-e0694ff10171.png align="center")

Log in success, and we can verify it!

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1729944220745/e80eb0ea-0a73-441e-87c8-232b9bac040c.png align="center")

## Summary

To wrap up, ***Active Directory*** is a directory service product developed by ***Microsoft Corporation***. It’s mainly use is to ***authenticate*** objects and enforce the right amount of ***authorization*** in corporate resources.

Server is installed an ***Active Directory Domain Services***, *promote* to be an ***Active Directory Domain Controller***, and provides a ***Domain Name*** in order to use the feature. The server becomes a ***Domain Controller***, the desktop c*lient joined the domain* by using the same ***Domain Name***, and supplied the *Administrator credentials* for security process. Verifying that the devices are already part of the domain, the ***DNS Suffix*** has the ***Domain Name*** *as its value*. Additionally, devices *name/full name can be resolvable into IP Addresses* when doing ***ping*** and ***nslookup***.

As an added knowledge, *a user is created and bonded to the desktop*. This is a common use of having devices joining in a domain.

A domain has been established means that any Administrator can fully manage the device to align with the corporate acceptable use and policy guidelines.

## References

\[1\] [*https://en.wikipedia.org/wiki/Active\_Directory/*](https://en.wikipedia.org/wiki/Active_Directory/)

\[2\] [*https://en.wikipedia.org/wiki/Lightweight\_Directory\_Access\_Protocol*](https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol)

\[3\] [*https://en.wikipedia.org/wiki/NTLM*](https://en.wikipedia.org/wiki/NTLM)

\[4\] [*https://en.wikipedia.org/wiki/Kerberos\_(protocol)*](https://en.wikipedia.org/wiki/Kerberos_\(protocol\))