The domain controller is the most important server inside your network. It ensures that users can log in, and handles permissions, policies, etc. But what if your domain controller goes offline? Having a second domain controller in your network increases the reliability of your whole network. So how do we add a domain controller to an existing domain?
5- Windows Server 2022 Adding Additional Domain Controller To Existing Domain Or Forest
After the installation of AD DS is completed, you can click on Close. We can now promote the server to a domain controller. During these steps, we will add the new domain controller to the existing domain.
You should note that Install-ADDSForest is only used when you are installing the first domain controller in a new AD forest. Install-ADDSDomain and Install-ADDSDomainController are used respectively to create a new domain in an existing forest and install a new DC in an existing AD domain.
When the Active Directory Installation Wizard (Dcpromo.exe) creates the first domain in a new forest, the wizard adds five FSMO roles. A forest with one domain has five roles. The Active Directory Installation Wizard adds three domain-wide roles on the first domain controller in each additional domain in the forest. Additionally, infrastructure master roles exist for each application partition. It includes the default domain and the forest-wide DNS application partitions that are created on Windows Server 2003 and later domain controllers. The operations masters and their scope are shown in the following table.
The addition or removal of domains should be a tightly controlled operation. Place this role on the forest root PDC. Certain operations that use the domain naming master fail if the domain naming master isn't available. These operations include creating or removing domains and application partitions. On a domain controller that runs Microsoft Windows 2000, the domain naming master must also be hosted on a global catalog server. On domain controllers that run Windows Server 2003 or later versions, the domain naming master doesn't have to be a global catalog server.
If you do not run adprep.exe command separately and you are installing the first domain controller that runs Windows Server 2012 in an existing domain or forest, you will be prompted to supply credentials to run Adprep commands. The credential requirements are as follows:
If no value is specified, the value of the credential argument is used.AllowDomainControllerReinstallSpecifies whether to continue installing this writable domain controller, although another writable domain controller account with the same name is detected.Use $True only if you are sure that the account is not currently used by another writable domain controller.The default is $False.This argument is not valid for an RODC.AllowDomainReinstallSpecifies whether an existing domain is recreated.The default is $False.AllowPasswordReplicationAccountName Specifies the names of user accounts, group accounts, and computer accounts whose passwords can be replicated to this RODC. Use an empty string "" if you want to keep the value empty. By default, only the Allowed RODC Password Replication Group is allowed, and it is originally created empty.Supply values as a string array. For example:Code -AllowPasswordReplicationAccountName "JSmith","JSmithPC","Branch Users"ApplicationPartitionsToReplicate Note: There is no equivalent option in the UI. If you install using the UI, or using IFM, then all application partitions will be replicated.Specifies the application directory partitions to replicate. This argument is applied only when you specify the -InstallationMediaPath argument to install from media (IFM). By default, all application partitions will replicate based on their own scopes.Supply values as a string array. For example:Code --ApplicationPartitionsToReplicate "partition1","partition2","partition3"ConfirmPrompts you for confirmation before running the cmdlet.CreateDnsDelegation Note: You cannot specify this argument when you run the Add-ADDSReadOnlyDomainController cmdlet.Indicates whether to create a DNS delegation that references the new DNS server that you are installing along with the domain controller. Valid for Active Directory"integrated DNS only. Delegation records can be created only on Microsoft DNS servers that are online and accessible. Delegation records cannot be created for domains that are immediately subordinate to top-level domains such as .com, .gov, .biz, .edu or two-letter country code domains such as .nz and .au.The default is computed automatically based on the environment.Credential Note: Required only if the credentials of the current user are insufficient to perform the operation.Specifies the domain account that can logon to the domain, according to the rules of Get-Credential and a PSCredential object.If no value is specified, the credentials of the current user are used.CriticalReplicationOnlySpecifies whether the AD DS installation operation performs only critical replication before reboot and then continues. The noncritical replication happens after the installation finishes and the computer reboots.Using this argument is not recommended.There is no equivalent for this option in the user interface (UI).DatabasePath Specifies the fully qualified, non"Universal Naming Convention (UNC) path to a directory on a fixed disk of the local computer that contains the domain database, for example, C:\Windows\NTDS.The default is %SYSTEMROOT%\NTDS. Important: While you can store the AD DS database and log files on volume formatted with Resilient File System (ReFS), there are no specific benefits for hosting AD DS on ReFS, other than the normal benefits of resiliency you get for hosting any data on ReFS.DelegatedAdministratorAccountName Specifies the name of the user or group that can install and administer the RODC.By default, only members of the Domain Admins group can administer an RODC.DenyPasswordReplicationAccountName Specifies the names of user accounts, group accounts, and computer accounts whose passwords are not to be replicated to this RODC. Use an empty string "" if you do not want to deny the replication of credentials of any users or computers. By default, Administrators, Server Operators, Backup Operators, Account Operators, and the Denied RODC Password Replication Group are denied. By default, the Denied RODC Password Replication Group includes Cert Publishers, Domain Admins, Enterprise Admins, Enterprise Domain Controllers, Enterprise Read-Only Domain Controllers, Group Policy Creator Owners, the krbtgt account, and Schema Admins.Supply values as a string array. For example:Code --DenyPasswordReplicationAccountName "RegionalAdmins","AdminPCs"DnsDelegationCredential Note: You cannot specify this argument when you run the Add-ADDSReadOnlyDomainController cmdlet.Specifies the user name and password for creating DNS delegation, according to the rules of Get-Credential and a PSCredential object.DomainMode Win2008R2 OrDomainMode 4 Specifies the domain functional level during the creation of a new domain.The domain functional level cannot be lower than the forest functional level, but it can be higher.The default value is automatically computed and set to the existing forest functional level or the value that is set for -ForestMode.DomainNameRequired for Install-ADDSForest and Install-ADDSDomainController cmdlets.Specifies the FQDN of the domain in which you want to install an additional domain controller.DomainNetbiosName Required for Install-ADDSForest if FQDN prefix name is longer than 15 characters.Use with Install-ADDSForest. Assigns a NetBIOS name to the new forest root domain.DomainType TreeDomain or child Indicates the type of domain that you want to create: a new domain tree in an existing forest, a child of an existing domain, or a new forest.The default for DomainType is ChildDomain.ForceWhen this parameter is specified any warnings that might normally appear during the installation and addition of the domain controller will be suppressed to allow the cmdlet to complete its execution. This parameter can be useful to include when scripting installation.ForestMode Win2003 OrForestMode 5 Specifies the forest functional level when you create a new forest.The default value is Win2012.InstallationMediaPathIndicates the location of the installation media that will be used to install a new domain controller.InstallDnsSpecifies whether the DNS Server service should be installed and configured on the domain controller.For a new forest, the default is $True and DNS Server is installed.For a new child domain or domain tree, if the parent domain (or forest root domain for a domain tree) already hosts and stores the DNS names for the domain, then the default for this parameter is $True.For a domain controller installation in an existing domain, if this parameter is left unspecified and the current domain already hosts and stores the DNS names for the domain, then the default for this parameter is $True. Otherwise, if DNS domain names are hosted outside of Active Directory, the default is $False and no DNS Server is installed.LogPath Specifies the fully qualified, non-UNC path to a directory on a fixed disk of the local computer that contains the domain log files, for example, C:\Windows\Logs.The default is %SYSTEMROOT%\NTDS. Important: Do not store the Active Directory log files on a data volume formatted with Resilient File System (ReFS).MoveInfrastructureOperationMasterRoleIfNecessarySpecifies whether to transfer the infrastructure master operations master role (also known as flexible single master operations or FSMO) to the domain controller that you are creating "in case it is currently hosted on a global catalog server" and you do not plan to make the domain controller that you are creating a global catalog server. Specify this parameter to transfer the infrastructure master role to the domain controller that you are creating in case the transfer is needed; in this case, specify the NoGlobalCatalog option if you want the infrastructure master role to remain where it currently is.NewDomainName Note: Required only for Install-ADDSDomain.Specifies the single domain name for the new domain.For example, if you want to create a new child domain named emea.corp.fabrikam.com, you should specify emea as the value of this argument.NewDomainNetbiosName Required for Install-ADDSDomain if FQDN prefix name is longer than 15 characters.Use with Install-ADDSDomain. Assigns a NetBIOS name to the new domain. The default value is derived from the value of "NewDomainName.NoDnsOnNetworkSpecifies that DNS service is not available on the network. This parameter is used only when the IP setting of the network adapter for this computer is not configured with the name of a DNS server for name resolution. It indicates that a DNS server will be installed on this computer for name resolution. Otherwise, the IP settings of the network adapter must first be configured with the address of a DNS server.Omitting this parameter (the default) indicates that the TCP/IP client settings of the network adapter on this server computer will be used to contact a DNS server. Therefore, if you are not specifying this parameter, ensure that TCP/IP client settings are first configured with a preferred DNS server address.NoGlobalCatalogSpecifies that you do not want the domain controller to be a global catalog server.Domain controllers that run Windows Server 2012 are installed with the global catalog by default. In other words, this runs automatically without computation, unless you specify:Code --NoGlobalCatalogNoRebootOnCompletionSpecifies whether to restart the computer upon completion of the command, regardless of success. By default, the computer will restart. To prevent the server from restarting, specify:Code --NoRebootOnCompletion:$TrueThere is no equivalent for this option in the user interface (UI).ParentDomainName Note: Required for Install-ADDSDomain cmdletSpecifies the FQDN of an existing parent domain. You use this argument when you install a child domain or new domain tree.For example, if you want to create a new child domain named emea.corp.fabrikam.com, you should specify corp.fabrikam.com as the value of this argument.ReadOnlyReplicaSpecifies whether to install a read-only domain controller (RODC).ReplicationSourceDC Indicates the FQDN of the partner domain controller from which you replicate the domain information. The default is automatically computed.SafeModeAdministratorPassword Supplies the password for the administrator account when the computer is started in Safe Mode or a variant of Safe Mode, such as Directory Services Restore Mode.The default is an empty password. You must supply a password. The password must be supplied in a System.Security.SecureString format, such as that provided by read-host -assecurestring or ConvertTo-SecureString.The SafeModeAdministratorPassword argument's operation is special:If not specified as an argument, the cmdlet prompts you to enter and confirm a masked password. This is the preferred usage when running the cmdlet interactively. If specified without a value, and there are no other arguments specified to the cmdlet, the cmdlet prompts you to enter a masked password without confirmation. This is not the preferred usage when running the cmdlet interactively. If specified with a value, the value must be a secure string. This is not the preferred usage when running the cmdlet interactively. For example, you can manually prompt for a password by using the Read-Host cmdlet to prompt the user for a secure string:-safemodeadministratorpassword (read-host -prompt "Password:" -assecurestring). You can also provide a secure string as a converted clear-text variable, although this is highly discouraged. -safemodeadministratorpassword (convertto-securestring "Password1" -asplaintext -force)SiteName Required for the Add-addsreadonlydomaincontrolleraccount cmdletSpecifies the site where the domain controller will be installed. There is no sitename argument when you run Install-ADDSForest because the first site created is Default-First-Site-Name.The site name must already exist when provided as an argument to -sitename. The cmdlet will not create the site.SkipAutoConfigureDNSSkips automatic configuration of DNS client settings, forwarders, and root hints. This argument is in effect only if the DNS Server service is already installed or automatically installed with -InstallDNS.SystemKey Specifies the system key for the media from which you replicate the data.The default is none.Data must be in format provided by read-host -assecurestring or ConvertTo-SecureString.SysvolPath Specifies the fully qualified, non-UNC path to a directory on a fixed disk of the local computer, for example, C:\Windows\SYSVOL.The default is %SYSTEMROOT%\SYSVOL. Important: SYSVOL cannot be stored on a data volume formatted with Resilient File System (ReFS).SkipPreChecksDoes not run the prerequisite checks before starting installation. It is not advisable to use this setting.WhatIfShows what would happen if the cmdlet runs. The cmdlet is not run.Specifying Windows PowerShell CredentialsYou can specify credentials without revealing them in plain text on screen by using Get-credential.
38c6e68cf9