Deploying Active Directory

The scenario provides an example of how to deploy Active Directory in Yandex Cloud.

To deploy the Active Directory infrastructure:

1. Before you start.
2. Create a cloud network and subnets.
3. Create a script to manage a local administrator account.
4. Create a VM for Active Directory.
5. Create a VM for a bastion host.
6. Install and configure Active Directory.
7. Configure the second domain controller.
8. Test Active Directory.

If you no longer need the infrastructure, delete all the resources it uses.

Before you start

Before working, you need to register in Yandex Cloud and create a billing account:

1. Go to the management console. Then log in to Yandex Cloud or sign up if don't already have an account.
2. On the billing page, make sure you linked a billing account, and it has the ACTIVE or TRIAL_ACTIVE status. If you don't have a billing account, create one.

If you have an active billing account, you can create or select a folder to run your VM in from the Yandex Cloud page.

Learn more about clouds and folders.

Required paid resources

The cost of an Active Directory installation includes:

• A fee for continuously running virtual machines (see Yandex Compute Cloud pricing).
• A fee for using dynamic or static public IP addresses (see Yandex Virtual Private Cloud pricing).
• The cost of outgoing traffic from Yandex Cloud to the internet (see Yandex Compute Cloud pricing).

Create a cloud network and subnets

Create a cloud network named ad-network with subnets in all the availability zones where your VMs will be located.

1. Create a cloud network:

   Management console

   CLI

   To create a cloud network:

   1. Open the Virtual Private Cloud section in the folder where you want to create the cloud network.
   2. Click Create network.
   3. Enter the network name ad-network.
   4. Click Create network.

   If you don't have the Yandex Cloud command line interface yet, install and initialize it.

   The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

   To create a cloud network, run the command:

   yc vpc network create --name ad-network
   

2. Create three ad-network subnets:

   Management console

   CLI

   To create a subnet:

   1. Open the Virtual Private Cloud section in the folder where you want to create the subnet.
   2. Click on the name of the cloud network.
   3. Click Add subnet.
   4. Fill out the form: set the subnet name to ad-subnet-a and select the ru-central1-a availability zone from the drop-down list.
   5. Enter the subnet CIDR, which is its IP address and mask: 10.1.0.0/16. For more information about subnet IP address ranges, see Cloud networks and subnets.
   6. Click Create subnet.

   Repeat the steps for two more subnets:

   • Name: ad-subnet-b. Availability zone: ru-central1-b. CIDR: 10.2.0.0/16.
   • Name: ad-subnet-c. Availability zone: ru-central1-c. CIDR: 10.3.0.0/16.

   To create subnets, run the following commands:

   yc vpc subnet create \
     --name ad-subnet-a \
     --zone ru-central1-a \
     --network-name ad-network \
     --range 10.1.0.0/16
   
   yc vpc subnet create \
     --name ad-subnet-b \
     --zone ru-central1-b \
     --network-name ad-network \
     --range 10.2.0.0/16
   
   yc vpc subnet create \
     --name ad-subnet-c \
     --zone ru-central1-c \
     --network-name ad-network \
     --range 10.3.0.0/16
   

Create a script to manage a local administrator account

When creating a virtual machine via the CLI, you need to set a password for a local administrator account.

To do this, in the root folder of the command line, create a file named setpass without an extension. Copy the script to the file and set your password:

#ps1
Get-LocalUser | Where-Object SID -like *-500 | Set-LocalUser -Password (ConvertTo-SecureString "<your password>" -AsPlainText -Force)

The password must meet the complexity requirements.

Read more about the best practices for securing Active Directory on the official website.

Create a VM for Active Directory

Create two VMs for Active Directory domain controllers. These VMs don't have internet access.

yc compute instance create \
  --name ad-vm-a \
  --hostname ad-vm-a \
  --memory 8 \
  --cores 4 \
  --zone ru-central1-a \
  --network-interface subnet-name=ad-subnet-a,ipv4-address=10.1.0.3 \
  --create-boot-disk image-folder-id=standard-images,image-family=windows-2019-dc-gvlk \
  --metadata-from-file user-data=setpass

yc compute instance create \
  --name ad-vm-b \
  --hostname ad-vm-b \
  --memory 8 \
  --cores 4 \
  --zone ru-central1-b \
  --network-interface subnet-name=ad-subnet-b,ipv4-address=10.2.0.3 \
  --create-boot-disk image-folder-id=standard-images,image-family=windows-2019-dc-gvlk \
  --metadata-from-file user-data=setpass

Create a VM for a bastion host

A file server with internet access is used to configure VMs with Active Directory.

yc compute instance create \
  --name jump-server-vm \
  --hostname jump-server-vm \
  --memory 4 \
  --cores 2 \
  --zone ru-central1-c \
  --network-interface subnet-name=ad-subnet-c,nat-ip-version=ipv4 \
  --create-boot-disk image-folder-id=standard-images,image-family=windows-2019-dc-gvlk \
  --metadata-from-file user-data=setpass

Install and configure Active Directory

VMs with Active Directory don't have internet access, so they should be configured from the jump-server-vm VM using RDP.

1. Connect to jump-server-vm using RDP. Enter Administrator as the username and then your password.

2. Launch RDP and connect to ad-vm-a, using its local IP address, Administrator username and your password.

3. Run PowerShell and set a static address:

   netsh interface ip set address "eth0" static 10.1.0.3 255.255.255.0 10.1.0.1
   

4. Assign Active Directory roles:

   Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
   

   Output:

   Success Restart Needed Exit Code      Feature Result
   ------- -------------- ---------      --------------
   True    No             Success        {Active Directory Domain Services, Group P...
   

5. Create an Active Directory forest:

   Install-ADDSForest -DomainName 'yantoso.net' -Force:$true
   

   Then enter the password and confirm it.

   Windows restarts automatically. Reconnect to ad-vm-a and launch PowerShell.

6. Rename the default site ru-central1-a:

   Get-ADReplicationSite 'Default-First-Site-Name' | Rename-ADObject -NewName 'ru-central1-a'
   

7. Create two more sites for the other availability zones:

   New-ADReplicationSite 'ru-central1-b'
   New-ADReplicationSite 'ru-central1-c'
   

8. Create subnets and link them to the sites:

   New-ADReplicationSubnet -Name '10.1.0.0/16' -Site 'ru-central1-a'
   New-ADReplicationSubnet -Name '10.2.0.0/16' -Site 'ru-central1-b'
   New-ADReplicationSubnet -Name '10.3.0.0/16' -Site 'ru-central1-c'
   

9. Rename the site link and configure replication:

   Get-ADReplicationSiteLink 'DEFAULTIPSITELINK' | `
       Set-ADReplicationSiteLink -SitesIncluded @{Add='ru-central1-b'} -ReplicationFrequencyInMinutes 15 -PassThru | `
       Set-ADObject -Replace @{options = $($_.options -bor 1)} -PassThru | `
       Rename-ADObject -NewName 'ru-central1'
   

10. Set the DNS redirect server:

    Set-DnsServerForwarder '10.1.0.2'
    

11. Configure the DNS client:

    Get-NetAdapter | Set-DnsClientServerAddress -ServerAddresses "10.2.0.3,127.0.0.1"
    

Configure the second domain controller

1. Connect to jump-server-vm using RDP.

2. Using RDP, connect to ad-vm-b, using its local IP address, the Administrator username and your password.

3. Assign Active Directory roles:

   Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
   

   Output:

   Success Restart Needed Exit Code      Feature Result
   ------- -------------- ---------      --------------
   True    No             NoChangeNeeded {}
   

4. Configure the DNS client:

   Get-NetAdapter | Set-DnsClientServerAddress -ServerAddresses "10.1.0.3,127.0.0.1"
   

5. Configure a static IP address:

   netsh interface ip set address "eth0" static 10.2.0.3 255.255.255.0 10.2.0.1
   

6. Add the controller to the domain:

   Install-ADDSDomainController `
       -Credential (Get-Credential "yantoso\Administrator") `
       -DomainName 'yantoso.net' `
       -Force:$true
   

   Then enter the password and confirm it.

   Windows restarts automatically. Reconnect to ad-vm-a and launch PowerShell.

7. Set the DNS redirect server:

   Set-DnsServerForwarder '10.2.0.2'
   

Test Active Directory

1. Connect to jump-server-vm using RDP.

2. Using RDP, connect to ad-vm-b, using its local IP address, the Administrator username and your password. Launch PowerShell.

3. Create a test user:

   New-ADUser testUser
   

4. Make sure the user is present on both servers:

   Get-ADUser testUser -Server 10.1.0.3
   Get-ADUser testUser -Server 10.2.0.3
   

   Output:

   DistinguishedName : CN=testUser,CN=Users,DC=yantoso,DC=net
   Enabled           : False
   GivenName         :
   Name              : testUser
   ObjectClass       : user
   ObjectGUID        : 7202f41a-(...)-2d168ecd5271
   SamAccountName    : testUser
   SID               : S-1-5-21-(...)-1105
   Surname           :
   UserPrincipalName :
   
   DistinguishedName : CN=testUser,CN=Users,DC=yantoso,DC=net
   Enabled           : False
   GivenName         :
   Name              : testUser
   ObjectClass       : user
   ObjectGUID        : 7202f41a-(...)-2d168ecd5271
   SamAccountName    : testUser
   SID               : S-1-5-21-(...)-1105
   Surname           :
   UserPrincipalName :
   

How to delete created resources

To stop paying for deployed servers, delete all the VMs.