Lab Objective:
Learn how to join a client machine to the Domain we just created.
Lab Purpose:
You will learn to join a client machine to the Domain “lab.local” we just created before.
Lab Tool:
Windows Server 2012 R2 + Windows 10
Lab Topology:
Use two machines either on your home network or on the same virtual network in VMware.
A domain controller is a server that responds to authentication requests and verifies users on computer networks. Domains are a hierarchical way of organizing users and computers that work together on the same network. The domain controller keeps all of that data organized and secured.
Benefits of a Domain Controller:
Centralized user management
Enables resource sharing for files and printers
Federated configuration for redundancy (FSMO)
Can be distributed and replicated across large networks
Encryption of user data
Can be hardened and locked-down for improved security
Lab Walkthrough:
Task 1:
Join a client into the DC Active Directory
When a new employee joins a company, the IT department assigns them a new related computer together with their username and password. When the employee arrives, they log in for the first time at their client machine and change their first login password. All this was previously prepared by a Domain Administrator who created the user and password. Along with this process, the Administrator also entered (joined) the user’s client into Active Directory. When the user logs on for the first time, the Domain Controller will check for the presence of the client and the user in Active Directory. If the user is found, then they will be granted access to the Domain, otherwise, they will be denied.
At the moment, since we have just created our domain, we have no client inserted (joined) inside.
Note:
Only a user with Domain Administrator Rights can join a new client to the Domain and no one else.
The Domain Administrator will prepare the Domain to reflect the company policies.
Some of these policies are, for example:
- Creates a login script for each user
- Connect the user machine to network printers
- Mapping the user Network Folder Shares
- Apply Group Policies to the whole Domain for each OU – Group and User in the Active Directory
- Allow or Deny Internet Access
- Set up an email for the employee
- and much more…!
Before we can proceed to join new clients’ machines at our DC, we must make sure that our DC is reachable through its DNS name and/or IP Address.
Since we created a new DNS server, we need to setup this before we can proceed further.
Please open the Network Setting at the DC and setup the IP Address for the DNS server as follows:
Select ➜ Internet Protocol Version 4 (TCP/IPv4) ➜ click on ➜ Properties.
Our DNS server is the DC itself since it serves the DNS Role. For this reason, we need to change the Preferred DNS server IP Address: ➜ from 127.0.0.1 to 192.168.112.136 .
As an Alternate DNS server, we can insert the Google DNS server so that we will be sure our DC will reach out to the Internet.
Please fill-in the form as shown above and click on ➜ OK to Validate the settings.
Disable and then Enable again the Ethernet0 device to apply the settings.
Next, from our client machine, we need to make sure we can ping the Domain Controller. You will need to add an IP address in the same subnet such as 192.168.112.131. You already learned how to do this.
From your Windows Client machine start ➜ then type cmd ➜ and execute a ping.
As you can see, we were able to ping our DC from our Windows 10 client machine.
Now, we will proceed with the join of our first client machine inside our Domain.
Power on your Windows 10 client machine and login as Administrator.
Click on ➜ Start ➜ type: Panel.
To open the Control Panel:
Select ➜ Category ➜ Small icons.
Select ➜ System.
If this is a brand-new client machine the Windows installation assigned already a random name.
We need to change this Computer name so that we can identify the machine later at our DC server and Active Directory.
The machine right now is not part of a Domain and is in a Workgroup name Workgroup.
First, we change the machine name:
Click on ➜ Change settings.
Click on ➜ Change…
Now, we will change the computer name here. I put above a capture from a default machine name just in case this is what you have.
This machine will be prepared for Ray Charles with the username: rcharles and machine name: PC1.
So, first, we rename the client machine in: PC1. Note that I left the original workgroup name in from an earlier lab, but this will be changing.
Then click on ‘OK’.
To apply the changes, we need to restart our machine.
So please click on ‘OK’ and close all other windows and restart the machine.
The machine restarts and will become a new computer name: PC1.
Before we can proceed with the joining, we need to setup the DNS server IP Address at our client machine.
Please open the Network Settings at your Windows machine.
Select ➜ Internet Protocol Version 4 (TCP/IPv4) then click on ➜ Properties.
Insert the DNS server IP Address as shown above.
Close the window ➜ Disable and Enable the Ethernet Device to apply the changes.
Now we can join this machine to our DC Active Directory.
Please click on ➜ Change settings again.
Click on ➜ Change…
Select ➜ Domain: ➜ type the Domain Name we created before: lab.local ➜ then click on More…
In this window, we insert: Primary DNS suffix of this computer: lab.local ➜ then click on ➜ OK.
Our Domain Controller was found; we need now to insert the Administrator username and password.
After a few seconds, the Domain Controller verifies the Rights of the user and joins the machine to the Domain: lab.local .
Please click on ➜ OK to close the window.
Another message appears which invites the user to restart the machine to apply the changes. Click on ‘OK’.
Click on ➜ Restart Now.
While the Windows client machine restarts, we can observe at our DC server if the computer has been joined.
Select ➜ Tools ➜ Active Directory Users and Computer.
Under the folder: Computers in Active Directory, we can now find our new client machine: PC1 joined.
Next, we will login with the username: rcharles and password: Changeme! to the client machine and start using our Domain name which will be:
Username: rcharles.lab.local
Password: Ichanged_it123!
Select now ➜ Other user.
Please note now the login shown:
Sign in to: LAB.
The user rcharles inserted the password Changeme! that the Domain Administrator set up before.
He is forced to change his first password since the Administrator, while creating his account at the Active Directory for security and privacy reasons, decided that way.
Password: Ichanged_it123!
Now when the user tries to navigate the Network and Sharing Center, they will get a warning and has to insert an administrator username and a password.
This happens because the Administrator still hasn’t setup folder sharing and other policies for that user.
The only thing the user can does right now is navigate to the Internet and browsing their own files.
In this lab, you have learned how to join a client machine to a Domain.
