Deploying Active Directory

The scenario provides an example of how to deploy Active Directory in Yandex Cloud.

To deploy the Active Directory infrastructure:

1. Before you start.
2. Required paid resources.
3. Create a cloud network and subnets.
4. Create a script to manage a local administrator account.
5. Create a VM for Active Directory.
6. Create a VM for a bastion host.
7. Install and configure Active Directory.
8. Configure the second domain controller.
9. Test Active Directory.
10. Delete the created resources.

Before you start

Before deploying servers, you need to sign up for Yandex Cloud and create a billing account:

1. Go to the management console. Then log in to Yandex Cloud or sign up if don't already have an account.
2. On the billing page, make sure you linked a billing account, and it has the ACTIVE or TRIAL_ACTIVE status. If you don't have a billing account, create one.

If you have an active billing account, you can create or select a folder to run your VM in from the Yandex Cloud page.

Learn more about clouds and folders.

Required paid resources

The cost of an Active Directory installation includes:

• A fee for continuously running VMs (see pricingYandex Compute Cloud).
• A fee for using dynamic or static public IP addresses (see pricingYandex Virtual Private Cloud).
• The cost of outgoing traffic from Yandex Cloud to the internet (see Yandex Compute Cloud pricing).

Create a cloud network and subnets

Create a cloud network named ad-network with subnets in all the availability zones where your VMs will be located.

1. Create a cloud network:

   Management console

   CLI

   To create a cloud network:

   1. Open the Virtual Private Cloud section in the folder where you want to create the cloud network.
   2. Click Create network.
   3. Enter the network name ad-network.
   4. Click Create network.

   To create a cloud network, run the command:

   $ yc vpc network create --name ad-network
   

2. Create three ad-network subnets:

   Management console

   CLI

   To create a subnet:

   1. Open the Virtual Private Cloud section in the folder where you want to create the subnet.
   2. Click on the name of the cloud network.
   3. Click Add subnet.
   4. Fill out the form: set the subnet name to ad-subnet-a and select the ru-central1-a availability zone from the drop-down list.
   5. Enter the subnet CIDR, which is its IP address and mask: 10.1.0.0/16. For more information about subnet IP ranges, see Cloud networks and subnets.
   6. Click Create subnet.

   Repeat these steps for two more subnets, ad-subnet-b and ad-subnet-c, in the ru-central1-b and ru-central1-c availability zones with the 10.2.0.0/16 and 10.3.0.0/16 CIDR, respectively.

   To create subnets, run the following commands:

   yc vpc subnet create \
     --name ad-subnet-a \
     --zone ru-central1-a \
     --network-name ad-network \
     --range 10.1.0.0/16
   
   yc vpc subnet create \
     --name ad-subnet-b \
     --zone ru-central1-b \
     --network-name ad-network \
     --range 10.2.0.0/16
   
   yc vpc subnet create \
     --name ad-subnet-c \
     --zone ru-central1-c \
     --network-name ad-network \
     --range 10.3.0.0/16
   

Create a script to manage a local administrator account

Create a file named setpass with a script that sets a password for the local administrator account when creating VMs via the CLI:

#ps1
Get-LocalUser | Where-Object SID -like *-500 | Set-LocalUser -Password (ConvertTo-SecureString "<your password>" -AsPlainText -Force)

The password must meet the complexity requirements.

Read more about the best practices for securing Active Directory on the official website.

Create a VM for Active Directory

Create two VMs for Active Directory domain controllers. These VMs don't have internet access.

$ yc compute instance create \
    --name ad-vm-a \
    --hostname ad-vm-a \
    --memory 8 \
    --cores 4 \
    --zone ru-central1-a \
    --network-interface subnet-name=exchange-subnet-a,ipv4-address=10.1.0.3 \
    --create-boot-disk image-folder-id=standard-images,image-family=windows-2016-gvlk \
    --metadata-from-file user-data=setpass

$ yc compute instance create \
    --name ad-vm-b \
    --hostname ad-vm-b \
    --memory 8 \
    --cores 4 \
    --zone ru-central1-b \
    --network-interface subnet-name=exchange-subnet-b,ipv4-address=10.2.0.3 \
    --create-boot-disk image-folder-id=standard-images,image-family=windows-2016-gvlk \
    --metadata-from-file user-data=setpass

Create a VM for a bastion host

A file server with internet access is used to configure VMs with Active Directory.

$ yc compute instance create \
    --name jump-server-vm \
    --hostname jump-server-vm \
    --memory 4 \
    --cores 2 \
    --zone ru-central1-c \
    --network-interface subnet-name=exchange-subnet-c,nat-ip-version=ipv4 \
    --create-boot-disk image-folder-id=standard-images,image-family=windows-2016-gvlk \
    --metadata-from-file user-data=setpass

Install and configure Active Directory

VMs with Active Directory don't have internet access, so they should be configured from the jump-server-vm VM using RDP.

1. Connect to jump-server-vm using RDP. Enter Administrator as the username and then your password.

2. Start the RDP client and connect to ad-vm-a.

3. Run the PowerShell and set a static address:

   netsh interface ip set address "Ethernet 2" static 10.1.0.3 255.255.255.0 10.1.0.1
   

4. Create a temporary folder:

   mkdir C:\Windows\temp
   

5. Assign Active Directory roles:

   Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
   
   Success Restart Needed Exit Code      Feature Result
   ------- -------------- ---------      --------------
   True    No             Success        {Active Directory Domain Services, Group P...
   

6. Create an Active Directory forest:

   Install-ADDSForest -DomainName 'yantoso.net' -Force:$true
   

   Windows restarts automatically. Relaunch PowerShell.

7. Rename the default site to ru-central1-a:

   Get-ADReplicationSite 'Default-First-Site-Name' | Rename-ADObject -NewName 'ru-central1-a'
   

8. Create two more sites for the other availability zones:

   New-ADReplicationSite 'ru-central1-b'
   New-ADReplicationSite 'ru-central1-c'
   

9. Create subnets and link them to the sites:

   New-ADReplicationSubnet -Name '10.1.0.0/16' -Site 'ru-central1-a'
   New-ADReplicationSubnet -Name '10.2.0.0/16' -Site 'ru-central1-b'
   New-ADReplicationSubnet -Name '10.3.0.0/16' -Site 'ru-central1-c'
   

10. Rename the site link and configure replication:

    Get-ADReplicationSiteLink 'DEFAULTIPSITELINK' | `
        Set-ADReplicationSiteLink -SitesIncluded @{Add='ru-central1-b'} -ReplicationFrequencyInMinutes 15 -PassThru | `
        Set-ADObject -Replace @{options = $($_.options -bor 1)} -PassThru | `
        Rename-ADObject -NewName 'ru-central1'
    

11. Set the DNS redirect server:

    Set-DnsServerForwarder '10.1.0.2'
    

12. Configure the DNS client:

    Get-NetAdapter | Set-DnsClientServerAddress -ServerAddresses "10.2.0.3,127.0.0.1"
    

Configure the second domain controller

1. Connect to jump-server-vm using RDP.

2. Connect to ad-vm-b using RDP. Specify Administrator as the username and enter your password.

3. Create a temporary folder:

   mkdir C:\Windows\temp
   

4. Assign Active Directory roles:

   Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
   
   Success Restart Needed Exit Code      Feature Result
   ------- -------------- ---------      --------------
   True    No             Success        {Active Directory Domain Services, Group P...
   

5. Configure the DNS client:

   Get-NetAdapter | Set-DnsClientServerAddress -ServerAddresses "10.1.0.3,127.0.0.1"
   

6. Configure a static IP address:

   netsh interface ip set address "Ethernet 2" static 10.2.0.3 255.255.255.0 10.2.0.1
   

7. Add the controller to the domain:

   Install-ADDSDomainController `
       -Credential (Get-Credential "yantoso\Administrator") `
       -DomainName 'yantoso.net' `
       -Force:$true
   

   Windows restarts automatically. Relaunch PowerShell.

8. Set the DNS redirect server:

   Set-DnsServerForwarder '10.2.0.2'
   

Test Active Directory

1. Connect to jump-server-vm using RDP.

2. Connect to ad-vm-b using RDP. Specify Administrator as the username and enter your password. Launch PowerShell.

3. Create a test user:

   New-ADUser testUser
   

4. Make sure the user is present on both servers:

   Get-ADUser testUser -Server yadc-b
   Get-ADUser testUser -Server yadc-a
   

Delete the created resources

To stop paying for deployed servers, delete all the VMs you created.