Get started
Solutions

Deploying Active Directory

The scenario provides an example of how to deploy Active Directory in Yandex.Cloud.

To deploy the Active Directory infrastructure:

  1. Before you start
  2. Required paid resources
  3. Create a cloud network and subnets
  4. Create a script to manage a local administrator account
  5. Create a VM for Active Directory
  6. Create a VM for a bastion host
  7. Install and configure Active Directory
  8. Configure the second domain controller
  9. Test Active Directory
  10. Delete the created resources

Before you start

Before deploying servers, you need to sign up for Yandex.Cloud and create a billing account:

  1. Go to the management console. Then log in to Yandex.Cloud or sign up if don't already have an account.
  2. On the billing page, make sure you linked a billing account, and it has the ACTIVE or TRIAL_ACTIVE status. If you don't have a billing account, create one.

If you have an active billing account, you can create or select a folder to run your VM in from the Yandex.Cloud page.

Learn more about clouds and folders.

The cost of an Active Directory installation includes:

Create a cloud network and subnets

Create a cloud network named ad-network with subnets in all the availability zones where your VMs will be located.

  1. Create a cloud network:

    To create a cloud network:

    1. Open the Virtual Private Cloud section in the folder where you want to create the cloud network.
    2. Click Create network.
    3. Enter the network name ad-network.
    4. Click Create network.

    To create a cloud network, run the command:

    $ yc vpc network create --name ad-network

  2. Create three ad-network subnets:

    To create a subnet:

    1. Open the Virtual Private Cloud section in the folder where you want to create the subnet.
    2. Click on the name of the cloud network.
    3. Click Add subnet.
    4. Fill out the form: set the subnet name to ad-subnet-a and select the ru-central1-a availability zone from the drop-down list.
    5. Enter the subnet CIDR, which is its IP address and mask: 10.1.0.0/16. For more information about subnet IP ranges, see Cloud networks and subnets.
    6. Click Create subnet.

    Repeat these steps for two more subnets, ad-subnet-b and ad-subnet-c, in the ru-central1-b and ru-central1-c availability zones with the 10.2.0.0/16 and 10.3.0.0/16 CIDR, respectively.

    To create subnets, run the following commands:

    yc vpc subnet create \
  --name ad-subnet-a \
  --zone ru-central1-a \
  --network-name ad-network \
  --range 10.1.0.0/16

yc vpc subnet create \
  --name ad-subnet-b \
  --zone ru-central1-b \
  --network-name ad-network \
  --range 10.2.0.0/16

yc vpc subnet create \
  --name ad-subnet-c \
  --zone ru-central1-c \
  --network-name ad-network \
  --range 10.3.0.0/16

Create a script to manage a local administrator account

Create a file named setpass with a script that sets a password for the local administrator account when creating VMs via the CLI:

#ps1
Get-LocalUser | Where-Object SID -like *-500 | Set-LocalUser -Password (ConvertTo-SecureString "<your password>" -AsPlainText -Force)

Your password must meet complexity requirements.

Read more about Active Directory security practices on the developer's website.

Create a VM for Active Directory

Create two VMs for Active Directory domain controllers. These VMs don't have internet access.

  1. On the folder page in the management console, click Create resource and select Virtual machine.

  2. In the Name field, enter the VM name ad-vm-a.

  3. Select availability zone ru-central1-a.

  4. Under Images from Cloud Marketplace, click Select. In the window that opens, select the 2016 Datacenter image.

  5. Under Disks, enter 35 GB for the size of the boot disk.

  6. Under Computing resources:

    • Choose the platform: Intel Cascade Lake.
    • Specify the number of vCPUs and amount of RAM:
      • vCPU: 4.
      • Guaranteed vCPU share: 100%.
      • RAM: 8 GB.

  7. Under Network settings, click Add network and select exchange-network. Select exchange-subnet-a. Under Public address, select No address.

  8. In the Access section, specify the data required to access the VM:

    • In the Password field, enter your password.

  9. Click Create VM.

Repeat this operation for the VM ad-vm-b in the ru-central1-a availability zone and connect it to the subnet exchange-subnet-b

$ yc compute instance create \
    --name ad-vm-a \
    --hostname ad-vm-a \
    --memory 8 \
    --cores 4 \
    --zone ru-central1-a \
    --network-interface subnet-name=exchange-subnet-a,ipv4-address=10.1.0.3 \
    --create-boot-disk image-folder-id=standard-images,image-family=windows-2016-gvlk \
    --metadata-from-file user-data=setpass

$ yc compute instance create \
    --name ad-vm-b \
    --hostname ad-vm-b \
    --memory 8 \
    --cores 4 \
    --zone ru-central1-b \
    --network-interface subnet-name=exchange-subnet-b,ipv4-address=10.2.0.3 \
    --create-boot-disk image-folder-id=standard-images,image-family=windows-2016-gvlk \
    --metadata-from-file user-data=setpass

Create a VM for a bastion host

A file server with internet access is used to configure VMs with Active Directory.

  1. On the folder page in the management console, click Create resource and select Virtual machine.

  2. In the Name field, enter the VM name jump-server-vm.

  3. Select availability zone ru-central1-c.

  4. Under Images from Cloud Marketplace, click Select. In the window that opens, select the 2016 Datacenter image.

  5. Under Disks, enter 35 GB for the size of the boot disk.

  6. Under Computing resources:

    • Choose the platform: Intel Cascade Lake.
    • Specify the number of vCPUs and amount of RAM:
      • vCPU: 2.
      • Guaranteed vCPU share: 100%.
      • RAM: 4 GB.

  7. Under Network settings, click Add network and select exchange-network. Select exchange-subnet-c. Under Public address, select No address.

  8. In the Access section, specify the data required to access the VM:

    • In the Password field, enter your password.

  9. Click Create VM.

$ yc compute instance create \
    --name jump-server-vm \
    --hostname jump-server-vm \
    --memory 4 \
    --cores 2 \
    --zone ru-central1-c \
    --network-interface subnet-name=exchange-subnet-c,nat-ip-version=ipv4 \
    --create-boot-disk image-folder-id=standard-images,image-family=windows-2016-gvlk \
    --metadata-from-file user-data=setpass

Install and configure Active Directory

VMs with Active Directory don't have internet access, so they should be configured from the jump-server-vm VM using RDP.

  1. Connect to jump-server-vm using RDP. Enter Administrator as the username and your password.

  2. Start the RDP client and connect to ad-vm-a.

  3. Run PowerShell and set a static address:

    netsh interface ip set address "Ethernet 2" static 10.1.0.3 255.255.255.0 10.1.0.1

  4. Create a temporary folder:

    mkdir C:\Windows\temp

  5. Assign Active Directory roles:

    Install-WindowsFeature AD-Domain-Services -IncludeManagementTools

Success Restart Needed Exit Code      Feature Result
------- -------------- ---------      --------------
True    No             Success        {Active Directory Domain Services, Group P...

  6. Create an Active Directory forest:

    Install-ADDSForest -DomainName 'yantoso.net' -Force:$true

    Windows restarts automatically. Relaunch PowerShell.

  7. Rename the default site to ru-central1-a:

    Get-ADReplicationSite 'Default-First-Site-Name' | Rename-ADObject -NewName 'ru-central1-a'

  8. Create two more sites for the other availability zones:

    New-ADReplicationSite 'ru-central1-b'
New-ADReplicationSite 'ru-central1-c'

  9. Create subnets and link them to the sites:

    New-ADReplicationSubnet -Name '10.1.0.0/16' -Site 'ru-central1-a'
New-ADReplicationSubnet -Name '10.2.0.0/16' -Site 'ru-central1-b'
New-ADReplicationSubnet -Name '10.3.0.0/16' -Site 'ru-central1-c'

  10. Rename the site link and configure replication:

    Get-ADReplicationSiteLink 'DEFAULTIPSITELINK' | `
    Set-ADReplicationSiteLink -SitesIncluded @{Add='ru-central1-b'} -ReplicationFrequencyInMinutes 15 -PassThru | `
    Set-ADObject -Replace @{options = $($_.options -bor 1)} -PassThru | `
    Rename-ADObject -NewName 'ru-central1'

  11. Set the DNS redirect server:

    Set-DnsServerForwarder '10.1.0.2'

  12. Configure the DNS client:

    Get-NetAdapter | Set-DnsClientServerAddress -ServerAddresses "10.2.0.3,127.0.0.1"

Configure the second domain controller

  1. Connect to jump-server-vm using RDP.

  2. Connect to ad-vm-b using RDP. Enter Administrator as the username and your password.

  3. Create a temporary folder:

    mkdir C:\Windows\temp

  4. Assign Active Directory roles:

    Install-WindowsFeature AD-Domain-Services -IncludeManagementTools

Success Restart Needed Exit Code      Feature Result
------- -------------- ---------      --------------
True    No             Success        {Active Directory Domain Services, Group P...

  5. Configure the DNS client:

    Get-NetAdapter | Set-DnsClientServerAddress -ServerAddresses "10.1.0.3,127.0.0.1"

  6. Configure a static IP address:

    netsh interface ip set address "Ethernet 2" static 10.2.0.3 255.255.255.0 10.2.0.1

  7. Add the controller to the domain:

    Install-ADDSDomainController `
    -Credential (Get-Credential "yantoso\Administrator") `
    -DomainName 'yantoso.net' `
    -Force:$true

    Windows restarts automatically. Relaunch PowerShell.

  8. Set the DNS redirect server:

    Set-DnsServerForwarder '10.2.0.2'

Test Active Directory

  1. Connect to jump-server-vm using RDP.

  2. Connect to ad-vm-b using RDP. Enter Administrator as the username and your password as the password. Launch PowerShell.

  3. Create a test user:

    New-ADUser testUser

  4. Make sure the user is present on both servers:

    Get-ADUser testUser -Server yadc-b
Get-ADUser testUser -Server yadc-a

Delete the created resources

To stop paying for deployed servers, delete all the VMs you created.