Skip to content

Step by Step : Implementing Child Domains (ADDS) in Windows Server 2012 R2

December 7, 2014

Some organizations need to deploy multiple domains or even multiple forests.

Deploying AD DS domain controllers in this scenario is not much more complicated than deploying domain controllers in a single domain environment, but there are some special factors that you need to consider.

In this post this time , i’ll show you how to deploy a complex ADDS environment, what i’m going to cover in my post this time?

1 – Implementing Child Domains in AD DS

2 – Trust configuration

3 – Implementing Forest Trusts

4 – forest trust authentication

For more information on the ADDS, please log in to : http://technet.microsoft.com/en-us/library/hh831484.aspx

Before we start, for this demo purposes, i’ll be using 3 domain server and 1 Member Server so that i can stimulate the child domain process & trust process…

My Domain Server consist of :

1 – TOR-DC1

2 – LON-DC1

3 – TREY-DC1

4 – LON-SVR2 (Member Server)

Lets get started…

1st – Installing Active Directory Domain Services on Child Domain

1 – on the TOR-DC1 domain server, make sure you install Active Directory Domain Services (i skip this step, i pretty sure that most of you know how to complete this step)..

2 – On the the Deployment Configuration interface, click Add a new domain to an existing forest…

** Verify that Select domain type is set to Child Domain, and that Parent domain name is set to Adatum.com.

** In the New domain name text box, type na.

** set credentials to ADATUM\administrator (Current user), and then click Next…

1

3 – In the Domain Controller Options interface, verify that Domain functional level is set to Windows Server 2012 R2.

** verify that both the Domain Name system (DNS) server and Global Catalog (GC) check boxes are selected.

** Confirm that Site name: is set to Default-First-Site-Name.

** Complete the password and proceed with next…

2

4 – On the DNS Options interface, click Next…

3

5 – On the Additional Options interface, click Next…

4

6 – On the Paths interface, click Next…

5

7 – On the Review Options interface, click Next…

6

8 – On the Prerequisites Check interface, confirm that there are no issues, and then click Install…

7

9 – N0w lets verify the the default trust configuration, once the TOR-DC1 restarted, log in NA\Administrator…

** i do recommend that you check your network connection is connected to adatum.com, if not please right-click Ethernet, and then click Disable. Right-click Ethernet, and then click Enable, then verify that Local Area Connection should now show Adatum.com…

8

10 – Next, open Active Directory Domains and Trusts…

9

11 – In the Active Directory Domains and Trusts console, expand Adatum.com, right-click na.adatum.com, and then click Properties…

10

12 – In the na.adatum.com Properties box, click the Trusts tab, and in the Domain trusted by this domain (outgoing trusts) box, click Adatum.com, and then click Properties…

11

13 – In the Adatum.com Properties box, click Validate, and then click Yes, validate the incoming trust…

12

14 – In the User name text box, type administrator, and in the Password text box, type Pa$$w0rd, and then click OK…

13

15 – When the message The trust has been validated. It is in place and active displays, click OK..

** Click OK twice to close the Adatum.com Properties box.

14

 

As at this step, we have successfully implemented child domains in ADDS.

 

2nd – Implementing Forest Trusts

1 – Switch to LON-DC1 Domain Server, and open DNS…

2 – In the DNS tree pane, expand LON-DC1, right-click Forward Lookup Zones, and then click New Zone…

15

3 – In the New Zone Wizard interface, click Next…

16

4 – On the Zone Type interface, click Stub zone, and then click Next…

17

5 – On the Active Directory Zone Replication Scope interface, click To all DNS servers running on domain controllers in this forest: adatum.com, and then click Next…

18

6 – In the Zone name: text box, type treyresearch.net, and then click Next…

19

6 – On the Master DNS Servers inetrface, click <Click here to add an IP Address or DNS Name>, type 172.16.10.10, click on the free space, and then click Next…

** 172.16.10.10 – TREY-DC1

20

7 – On the Completing the New Zone Wizard interface, click Next, and then click Finish…

21

8 – Next, right-click the new stub zone treyresearch.net, and then click Transfer from Master and then refresh…

** Confirm that the treyresearch.net stub zone contains records…

22

 

9 – Now lets switch to TREY-DC1, open DNS,

** In the tree pane, expand TREY-DC1, select and then right-click Forward Lookup Zones, and then click New Zone.

23

10 – In the New Zone Wizard interface, click Next…

24

11 – On the Zone Type interface, click Stub zone, and then click Next…

25

12 – In the Active Directory Zone Replication Scope interface, click To all DNS servers running on domain controllers in this forest: Treyresearch.net, and then click Next…

26

13 – In the Zone name: text box, type adatum.com, and then click Next…

27

14 – On the Master DNS Servers interface, click <Click here to add an IP Address or DNS Name>, type 172.16.0.10, click on the free space, and then click Next…

** 172.16.0.10 – LON-DC01

28

15 – On the Completing the New Zone Wizard interface, click Next, and then click Finish…

29

16 – Select and then right-click the new stub zone adatum.com, and then click Transfer from Master…

30

17 – Right-click adatum.com, and then click Refresh and then confirm that the adatum.com stub zone contains records…

31

3rd – Next step is to configure a forest trust with authentication…

1 – Switch to LON-DC1, and open Active Directory Domain and Trusts…

2 – In the Active Directory Domains and Trusts management console, right-click Adatum.com, and then click Properties…

32

3 – In the Adatum.com Properties dialog box, click the Trusts tab, and then click New Trust…

33

4 – On the New Trust Wizard interface, click Next…

34

5 – In the Name text box, type treyresearch.net, and then click Next…

35

6 – On the Trust Type interface, click Forest trust, and then click Next…

36

7 – On the Direction of Trust interface, click One-way: outgoing, and then click Next…

37

8 – On the Sides of Trust interface, click Both this domain and the specified domain, and then click Next…

38

9 – On the User Name and Password interface, type Administrator as the user name and Pa$$w0rd as the password in the appropriate boxes, and then click Next…

39

10 – On the Outgoing Trust Authentication Level–Local Forest interface, click Selective authentication, and then click Next…

40

11 – On the Trust Selections Complete interface, click Next…

41

12 – On the Trust Creation Complete interface, click Next…

42

13 – On the Confirm Outgoing Trust interface, click Next…

43

14 – Click Finish…

44

15 – In the Adatum.com Properties dialog box, click the Trusts tab…

** On the Trusts tab, under Domains trusted by this domain (outgoing trusts), click TreyResearch.net, and then click Properties…

45

16 – In the treyresearch.net Properties dialog box, click Validate…

46

17 – Review the message that displays: The trust has been validated. It is in place and active, and then click OK…

47

18 – Click Yes and close all the interface…

48

4th – Configure a member server for selective authentication…

1 – On LON-DC1 server, open Active Directory Users and Computers, click View menu, click Advanced Features…

 

49

 

2 – Expand Adatum.com, and then click Computers, right-click LON-SVR2, and then click Properties…

50

3 – In the LON-SVR2 Properties box, click the Security tab, and then click Add…

51

4 – On the Select Users, Computers, Service Accounts, or Groups page, click Locations…

52

5 – Click TreyResearch.net, and then click OK…

53

6 – In the Enter Network Credentials box, type treyresearch\administrator with the password Pa$$w0rd, and then click OK…

54

7 – In the Enter the object name to select (examples:) text box, type IT then click OK…

55

8 – In the LON-SVR2 Properties interface, verify that IT (TreyResearch\IT) is highlighted, select the Allow check box that is in line with Allowed to authenticate, and then click OK…

56

9 – Now lets switch to LON-SVR2 member server, create a folder in the C:, then Right-click the folder that you just created, point to Share with, and then click Specific People…

57

10 – In the File Sharing dialog box, type TreyResearch\IT, and then click Add…

58

11 – Click Read, and then click Read/Write. Click Share… and then click Done….

59

12 – Sign in to TREY-DC1 as TreyResearch\Alice or any domain user that you have in IT OU…

60

13 – open Run and type \\LON-SVR2\IT-Technical-Data, and then click OK…

61

14 – Verify that you have access to that IT-Technical-Data folder that located in LON-SVR2…

62

finally, we have successfully implemented forest trusts….

 

 

Leave a Comment

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: