In today's digital landscape, establishing a robust network infrastructure is essential for organizations to ensure seamless operations and effective resource management. One critical component of such infrastructure is an Active Directory (AD) environment, which provides centralized authentication, authorization, and network management capabilities.
For this project, VMware was utilized to create an integrated environment that consisted of a Windows Server 2019 Virtual Machine (VM) serving as the Domain Controller (DC) with Active Directory (AD) service. A custom PowerShell script was then executed to populate AD with approximately 1000 fictional users. I then created two VMs to act as clients on the AD server, one with Windows 10 Pro and the other with Linux Ubuntu 22.04.4 LTS, which where integrated into the AD internal network as CLIENT1 and CLIENT2 respectively.
- Active Directory
- AD Domain Service
- NAT
- DNS
- Networking
- PowerShell
- VMware
- Windows Server 2019
- Windows 10 Pro
- Linux Ubuntu 22.04.4 LTS
First, I downloaded VMware and an ISO for both Windows Server 2019 and Windows 10. The first virtual machine I created was with Windows Server 2019, which will be my Active Directory Domain Controllers. The DC houses 2 network adaptors, the first is to connect to the outside internet, and the second is to connect to the VirtualBox private network. You must make sure to assign 2 adaptors to the DC virtual machine in settings, the first using NAT, and the second dedicated to the internal network.
-
Two network adapters were used to separate traffic between external and internal.
Next, I set up IP Addressing for the internal network. After that, I set up Active Directory Domain Services and assign the Server 2019 machine as the DC using the domain: mydomain.com. Once the domain is created, I create an Organizational Unit named _ADMINS to add myself as a domain administrator.
The third step is to install RAS/NAT to allow the Windows 10 client (second VM) to be on the private virtual network, but still be able to access the internet via the DC. To do this, go to add roles & features > remote access > routing > install. Once completed, go to routing and remote access from server manager to install NAT (this allows internal clients to access internet using one public IP address).
Once RAS/NAT is set up, we will set up a DHCP server on the DC with the scope information pictured at the top. To do this, we go to add roles & features > DHCP Server > install. We can now go to tools > DHCP in order to set up the scope to give IP addresses in the range with the correct subnet mask. In DHCP settings we will use the DC IP address as the default gateway.
- The following roles and services were configured.
Next, we will use a PowerShell script to add 1000 users to Active Directory. To make it easier, we used a random name generator script to add the 1000 names to a .txt file. This way we can easily call on that text file in the PowerShell script.
-
PowerShell script used to generate approximately 1000 fictional users.
-
After the configurations were completed, I then took time to explore AD by performing tasks such as: creating groups, organizational units, modifying user permissions, disabling users, deleting users, and so on.
The final step is to create the second virtual machine running Windows 10. During the installation I placed the VM on the internal network and created a local account. I named it CLIENT1 for simplicity. I then updated the system's name and joined it to my domain. Once this is complete, go to the command prompt and type: ipconfig, then: ping www.google.com. This is to make sure the DNS server is working and the DC is properly NATing and forwarding traffic to the internet, and then returning the ping back to the client machine.
-
Configuring system name and connecting it to our Active Directory domain: mydomain.com
-
From there I verified the VM was connected to AD by logging into several of the random users I had created.
I wanted to expand the lab to include a second client machine other than Windows, so I decided to connect Linux Ubuntu to Active Directory. This was a little bit more tricky to configure, as straight out of the box, Ubuntu LTS version doesn't automatically connect to Windows AD. During installation, you are presented with the option to enter your domain details, but during the installation this error message appears:
This is a common issue with Ubuntu LTS version, and requires manual configuration of the integration into Active Directory. The steps are as follows:
Computer Name: CLIENT2
Domain Name: mydomain.com
Host Name: CLIENT2.mydomain.com
Administrator Account: user
- Create your Ubuntu VM, update everything, and take a snapshot so you can easily go back if something goes wrong. Network settings will be the same as your Windows 10 Pro VM.
- Open up the command line interface.
- Verify you can ping the DC and that the DC can ping back.
- Set the host name for the machine:
sudo hostnamectl set-hostname LINUX.mydomain.com - Verify the host name:
hostnamectl - Install the following:
sudo apt install sssd-ad sssd-tools realmd adcli - Discover the DC:
sudo realm -v discover mydomain.com - Install the kerberos default config file:
sudo apt-get install -y krb5.conf - Edit the krb5.conf file. (Capilization matters, verify default_realm is your DC and add rdns = false):
sudo nano /etc/krb5.conf
- Install this package:
sudo apt install krb5-user - Obtain Kerberous ticket with an account that has admin priviledges:
kinit username - Connect the system to the DC:
realm join -v -U username mydomain.com - Verify you have can see random users in your AD:
id user@mydomain.com
- Now log off your primary account and pick a random user in AD: user@mydomain.com
- Finally, once Ubuntu does the initial setup, open the command line interface and verify:
who
In this project, VMware was used to create an integrated AD environment. The first VM was a Windows Server 2019 that served as the DC, DHCP, and Active Directory populated with approximately 1000 users. Once the networking configurations were complete for the server, I then created two more VMs and connected them to an internal network using Active Directory.
Setting up a Windows Active Directory environment is a process that requires careful planning and execution. By leveraging virtualization technology and following best practices in configuration and policy settings, organizations can establish a robust foundation for their IT infrastructure.
It's important to note that specific configurations may vary based on software versions, network requirements, and security policies. Always refer to official documentation and consult with IT professionals when implementing complex network architectures. With proper implementation, an efficient and secure AD environment can be tailored to meet the unique needs of any organization.