Automating Active Directory Setup - Install a Child Domain

In previous posts over the past few weeks I've explained how I've installed the Active Directory Domain Services role and provisioned the first domain controller in a root domain using Configuration Manager OSD task sequences and some Windows PowerShell code. The next thing I need to do is install the first domain controller in a subordinate child domain in the new forest. The child domain will hold all my computing resources and users.

The following script:

• Installs a new domain controller in a child domain, creating that new domain.
• Gets the variables you will see in the script from Configuration Manager.
• Creates the new domain within the previously created forest
• Ensures DNS delegations are created

#-------------------------------------------------------------------
# | File : NewChildDomain.ps1                                           
# |                                            
# | Purpose : Installs the first Domain Controller in a child domain, 
# |           thus creating the new domain
# |           - Designed to be run from a Configuration Manager OSD 
# |             task sequence
# |           - Designed for Windows Server 2012 environments
# |           - Reboot handled by task sequence
# |
# | Usage : PowerShell.exe -FILE .\NewChildDomain.ps1 
#-------------------------------------------------------------------
# |                                         
# | Author:          JustAnotherTechnicalBlog
# | Creation Date:   23 April 2013
# |
# |
# | Maintenance History                                            
# | ------------------- 
# | 
# | Version:  1.00  2013-04-23  Initial Version  JustAnotherTechnicalBlog
# |
# |
#-------------------------------------------------------------------


# Clear the error variable
#-------------------------------------------------------------------
$error.clear()


# Import the ActiveDirectory PowerShell Module if required
#-------------------------------------------------------------------
if (-not (Get-Module ActiveDirectory))
  {
   Import-Module ActiveDirectory
  }


# Here we get access to the Task Sequence variables
#-------------------------------------------------------------------
$objTSenv = New-Object -COMObject Microsoft.SMS.TSEnvironment


# Grab the data we need from the task sequence variables
#-------------------------------------------------------------------
$strTSNetBIOSName =  $objTSenv.Value("RoleVariable1")
$strTSDomainName  =  $objTSenv.Value("RoleVariable2")
$strTSPrntNBName  =  $objTSenv.Value("RoleVariable3")
$strTSPrntDmnName =  $objTSenv.Value("RoleVariable4")
$strTSPrntDmnAcct = "$strTSPrntNBName\" + $objTSenv.Value("RoleAccount2")
$strTSDNSAccount  = "$strTSPrntNBName\" + $objTSenv.Value("RoleAccount3")


# Convert our password to the data type required by Install-ADDSDomain
#-------------------------------------------------------------------
$secstrSafeModePassword = $objTSenv.Value("RoleAccountPassword1") | `
      ConvertTo-SecureString -asPlainText -Force


# Convert our accounts and passwords strings to the data type required
# by Install-ADDSDomain
#-------------------------------------------------------------------
$secstrDomainPassword = $objTSenv.Value("RoleAccountPassword2") | `
     ConvertTo-SecureString -asPlainText -Force
$DomainCreds = New-Object `
     System.Management.Automation.PSCredential("$strTSPrntDmnAcct",$secstrDomainPassword)

$secstrDNSPassword = $objTSenv.Value("RoleAccountPassword3") | `
     ConvertTo-SecureString -asPlainText -Force
$DNSCreds = New-Object `
     System.Management.Automation.PSCredential("$strTSDNSAccount",$secstrDNSPassword)



# Install our first forest Domain Controller, creating a new forest
#-------------------------------------------------------------------
Install-ADDSDomain `
  -Force `
  -NoRebootOnCompletion `
  -CreateDNSDelegation `
  -DomainType Child `
  -DomainMode Win2012 `
  -ParentDomainName "$strTSPrntDmnName" `
  -NewDomainNetBIOSName "$strTSNetBIOSName" `
  -NewDomainName "$strTSDomainName" `
  -SafeModeAdministratorPassword $secstrSafeModePassword `
  -DNSDelegationCredential $DNSCreds `
  -Credential $DomainCreds



# Basic error handling
#-------------------------------------------------------------------
If ($error)
  {
   Write-Host "Child domain creation failed"
   Exit 1001
  }
Else
  {
   Write-Host "Child domain created successfully"

Task Sequence Snippet:  Active Directory Installation

Installing an Active Directory Child Domain with Windows PowerShell

Automating Active Directory Setup - Installing the Active Directory Domain Services Role

I've been working on a OSD task sequence to deploy Active Directory in a Windows 2012 environment for my current customer.  They have many environments in production, and many more in the development, testing and quality assurance environments, so this is something they need to be automated and repeatable.

The screen sot below shows the snippet of a larger task sequence that installs many different roles, features, and applications all in one task sequence.  Variables assigned to the computer object when we provision the computer object in Configuration Manager drive what roles, features and applications get installed.  I'm not going to show how that works here, but it may be something I explain in separate posts at some stage.

The first step to install Active Directory is to install the Active Directory Domain Services role.  The screen shots below show how that is done in the task sequence.  I just use Windows PowerShell to do this with the following command:

#-----------
PowerShell.exe -COMMAND Install-WindowsFeature -Name AD-Domain-Services `
   -IncludeManagementTools

The code above does not create an domain controller. It just installs the Active Directory Domain Services role.  Other steps in the task sequence see the server promoted to be a domain controller.

Including the 'IncludeManagementTools' option sees the appropriate management tools, and Windows PowerShell modules, get installed.  This works on both the standard and core installations of Windows, with the installer being intelligent enough to know what to install base on what edition of Windows Server is being installed.

Task Sequence Snippet:  Active Directory Installation

Installing the Active Directory Domain Services Role with Windows PowerShell

Automating Active Directory Setup - Installing the First Domain Controller in a Forest

I'm building a new Active Directory environment based on Windows Server 2012. This is a green-fields site, and the builds are automated using the OSD task sequences available in System Center Configuration Manager 2012. The first server I build in the domain is a domain controller in a place-holder root domain. The following script promotes a server to this be a domain controller and creates the new forest and domain. A previous post explains how I install the Active Directory Domain Services role.


The script below:

• Installs a new domain controller in a forest root domain, creating that domain.
• Gets the variables you will see in the script from Configuration Manager.

I will explain how to populate variables in Configuration Manager in a separate post in due course.

#------------------------------------------------------------------------------------
# | File : NewForest.ps1                                           
# |                                            
# | Purpose : Installs the first Domain Controller in a forest, thus creating 
# |           a new forest
# |           - Designed to be run from a Configuration Manager OSD task sequence
# |           - Designed for Windows Server 2012 environments
# |           - Reboot handled by task sequence
# |
# | Usage : PowerShell.exe -FILE .\NewForest.ps1 
#------------------------------------------------------------------------------------
# |                                         
# | Author:          JustAnotherTechnicalBlog
# | Creation Date:   11 April 2013
# |
# |
# | Maintenance History                                            
# | ------------------- 
# | 
# | Version: 1.00 2013-04-12      Initial Version      JustAnotherTechnicalBlog
# |
# |
#------------------------------------------------------------------------------------


# Clear the error variable
#------------------------------------------------------------------------------------

$error.clear()



# Import the ActiveDirectory PowerShell Module if required
#------------------------------------------------------------------------------------

if (-not (Get-Module ActiveDirectory))
  {
   Import-Module ActiveDirectory
  }



# Here we get access to the Task Sequence variables
#------------------------------------------------------------------------------------

$objTSenv = New-Object -COMObject Microsoft.SMS.TSEnvironment



# Grab the data we need from the task sequence variables
#------------------------------------------------------------------------------------

$strTSNetBIOSName         = $objTSenv.Value("RoleVariable1")
$strTSDomainName          = $objTSenv.Value("RoleVariable2")



# Convert our password to the data type required
# by Install-ADDSForest
#------------------------------------------------------------------------------------

$secstrSafeModePassword = $objTSenv.Value("RolePassword1") | `
   ConvertTo-SecureString -asPlainText -Force



# Install our first forest Domain Controller, creating a new forest
#------------------------------------------------------------------------------------

Install-ADDSForest `
  -Force `
  -NoRebootOnCompletion `
  -DomainNetBIOSName "$strTSNetBIOSName" `
  -DomainName "$strTSDomainName" `
  -ForestMode Win2012 `
  -DomainMode Win2012 `
  -SafeModeAdministratorPassword `
        $secstrSafeModePassword



# Very basic error handling ...
#------------------------------------------------------------------------------------

If ($error)
  {
   Write-Host "Forest creation failed"
   Exit 1000
  }
Else
  {
   Write-Host "Forest created successfully"
  }

Task Sequence Snippet:  Active Directory Installation

Installing a new forest with a PowerShell script