Installing Windows 2008 Server Core Domain Controller

5:07 PM Technology Enthusiast 0 Comments

To save you some time, I'd like to outline the steps I recently used to add Server Core DC's to an already existing WS08 forest environment:

1. Install the default Server Core

   1. Insert the DVD, and follow defaults

2. Change server name

   1. Type netdom renamecomputer <old machine name> /newname:<new machine name>
   2. Type shutdown /r, and then press ENTER.

3. Change time zone & setup NTP synch

   1. Type control timedate.cpl and then press ENTER
   2. Open command prompt and type in: net time /setsntp:<PDC emulator FQDN>

4. Change language and keyboard settings

   1. Type control intl.cpl and then press ENTER

5. Configure IP details

   1. Type netsh interface ipv4 show interface, and then press ENTER
   2. Make a note of the number in the IDX column for the Local Area Connection. Make sure to use this number in steps below for the name="n" parameter
   3. Type netsh interface ipv4 set address name="n" source=static address=<server's IP address> mask=<subnet mask> gateway=<IP address>, and then press ENTER
   4. Type netsh interface ipv4 add dnsserver name="n" address=<Primary DNS Server> index=1, and then press ENTER
   5. Type netsh interface ipv4 add dnsserver name="n" address=<Secondary DNS Server> index=2, and then press ENTER

6. Enable firewall rules for remote management

   1. The following has to be executed on BOTH the Server Core & the server that you will manage it from, open command prompt and type:

      1. Netsh advfirewall firewall set rule group="Windows Firewall Remote Management" new enable=yes
      2. Netsh advfirewall firewall set rule group="Remote Services Management" new enable=yes
      3. Netsh advfirewall firewall set rule group="Remote Event Log Management" new enable=yes
      4. Netsh advfirewall firewall set rule group="Remote Volume Management" new enable=yes
      5. Netsh advfirewall firewall set rule group="Remote Scheduled Task Management" new enable=yes

7. Enable Windows Update

   1. Cscript c:\Windows\System32\SCregEdit.wsf /au 4 [Enter]
   2. Net stop wuauserv && net start wuauserv [Enter]
   3. Wuauclt /detecnow [Enter] – this starts the update process now, and does not wait till the default time of 3 am

8. Add DNS role

   1. Type start /w ocsetup DNS-Server-Core-Role

9. Add AD Replication components

   1. Remember that a pure WS08 AD environment by default uses DFS-R for replication, so this service needs to be added:

      1. Type start /w ocsetup DFRS-Infrastructure-ServerEdition

   2. For AD environments that are mixed (WS08 & W2K3) install the FRS replication component instead:

      1. Type start /w ocsetup FRS-Infrastructure

10. Add Backup feature

    1. Type start /w ocsetup WindowsServerBackup

11. Enable Terminal Services

    1. Type cscript c:\windows\system32\scregedit.wsf /ar 0, and then press ENTER

12. Install Active Directory

    1. Create the following UNATTEND.TXT file as follows:

       [Unattended]

       Unattendmode=fullunattended

       [DCINSTALL]

       UserName=<username>

       Password=<password>

       UserDomain=<FQDN domain name>

       DatabasePath=<path, e.g. d:\windows\ntds>

       LogPath=<path, e.g. d:\windows\ntds>

       SYSVOLPath=<path, e.g. d:\windows\sysvol>

       SafeModeAdminPassword=<password>

       CriticalReplicationOnly

       SiteName=<Site Name, e.g. Default-First-Site-Name>

       ReplicaOrNewDomain=Replica

       ReplicaDomainDNSName=<FQDN domain name>

       ReplicationSourceDC=<FQDN source DC>

       ConfirmGc=yes

       RebootOnSuccess=yes

    2. Type dcpromo /unattend:unattend.txt, and then press ENTER

13. Lastly, you may want to enable Bitlocker:

    1. manage-bde.wsf –on C: -RecoveryPassword –RecoveryKey F:\

       1. where C: is the volume to encrypt, and F:\ is a USB key or another volume where a copy of the recovery key will be stored (in binary format). You can also use a UNC path to store the recovery key on a network drive. A recovery password (in numeric text format) will also be generated and displayed. You might wish to add the –skiphardwaretest parameter if you are certain the hardware platform meets all BitLocker requirements.

And there you have it, a Server Core DC happy as a pig in ….