Install a new Active Directory forest using Azure CLI

AD DS can run on an Azure virtual machine (VM) in the same way it runs in many on-premises instances. This article walks you through deploying a new AD DS Forest, on two new domain controllers, in an Azure availability set using the Azure portal and Azure CLI. Many customers find this guidance helpful when creating a lab or preparing to deploy domain controllers in Azure.

Components

• A resource group to put everything in.
• An Azure Virtual Network, subnet, network security group, and rule to allow RDP access to VMs.
• An Azure virtual machine availability set to put two Active Directory Domain Services (AD DS) domain controllers in.
• Two Azure virtual machines to run AD DS and DNS.

Items that are not covered

• Creating a site-to-site VPN connection from an on-premises location
• Securing network traffic in Azure
• Designing the site topology
• Planning operations master role placement
• Deploying Microsoft Entra Connect to synchronize identities to Microsoft Entra ID

Build the test environment

We use the Azure portal and Azure CLI for creating the environment.

The Azure CLI is used to create and manage Azure resources from the command line or in scripts. This tutorial details using the Azure CLI to deploy virtual machines running Windows Server 2019. Once deployment is complete, we connect to the servers and install AD DS.

If you don't have an Azure subscription, create a free account before you begin.

Using Azure CLI

The following script automates the process of building two Windows Server 2019 VMs, for the purpose of building domain controllers for a new Active Directory Forest in Azure. An administrator can modify the variables below to suit their needs, then complete, as one operation. The script creates the necessary resource group, network security group with a traffic rule for Remote Desktop, virtual network and subnet, and availability group. The VMs are each then built with a 20 GB data disk with caching disabled for AD DS to be installed to.

The script below can be run directly from the Azure portal. If you choose to install and use the CLI locally, this quickstart requires that you are running the Azure CLI version 2.0.4 or later. Run az --version to find the version. If you need to install or upgrade, see Install Azure CLI 2.0.

#Update based on your organizational requirements
Location=westus2
ResourceGroupName=ADonAzureVMs
NetworkSecurityGroup=NSG-DomainControllers
VNetName=VNet-AzureVMsWestUS2
VNetAddress=10.10.0.0/16
SubnetName=Subnet-AzureDCsWestUS2
SubnetAddress=10.10.10.0/24
AvailabilitySet=DomainControllers
VMSize=Standard_DS1_v2
DataDiskSize=20
AdminUsername=azureuser
AdminPassword=ChangeMe123456
DomainController1=AZDC01
DC1IP=10.10.10.11
DomainController2=AZDC02
DC2IP=10.10.10.12

# Create a resource group.
az group create --name $ResourceGroupName \
                --location $Location

# Create a network security group
az network nsg create --name $NetworkSecurityGroup \
                      --resource-group $ResourceGroupName \
                      --location $Location

# Create a network security group rule for port 3389.
az network nsg rule create --name PermitRDP \
                           --nsg-name $NetworkSecurityGroup \
                           --priority 1000 \
                           --resource-group $ResourceGroupName \
                           --access Allow \
                           --source-address-prefixes "*" \
                           --source-port-ranges "*" \
                           --direction Inbound \
                           --destination-port-ranges 3389

# Create a virtual network.
az network vnet create --name $VNetName \
                       --resource-group $ResourceGroupName \
                       --address-prefixes $VNetAddress \
                       --location $Location \

# Create a subnet
az network vnet subnet create --address-prefix $SubnetAddress \
                              --name $SubnetName \
                              --resource-group $ResourceGroupName \
                              --vnet-name $VNetName \
                              --network-security-group $NetworkSecurityGroup

# Create an availability set.
az vm availability-set create --name $AvailabilitySet \
                              --resource-group $ResourceGroupName \
                              --location $Location

# Create two virtual machines.
az vm create \
    --resource-group $ResourceGroupName \
    --availability-set $AvailabilitySet \
    --name $DomainController1 \
    --size $VMSize \
    --image Win2019Datacenter \
    --admin-username $AdminUsername \
    --admin-password $AdminPassword \
    --data-disk-sizes-gb $DataDiskSize \
    --data-disk-caching None \
    --nsg $NetworkSecurityGroup \
    --private-ip-address $DC1IP \
    --no-wait

az vm create \
    --resource-group $ResourceGroupName \
    --availability-set $AvailabilitySet \
    --name $DomainController2 \
    --size $VMSize \
    --image Win2019Datacenter \
    --admin-username $AdminUsername \
    --admin-password $AdminPassword \
    --data-disk-sizes-gb $DataDiskSize \
    --data-disk-caching None \
    --nsg $NetworkSecurityGroup \
    --private-ip-address $DC2IP

DNS and Active Directory

If the Azure virtual machines created as part of this process will be an extension of an existing on-premises Active Directory infrastructure, the DNS settings on the virtual network must be changed to include your on-premises DNS servers before deployment. This step is important to allow the newly created Domain Controllers in Azure to resolve on-premises resources and allow for replication to occur. More information about DNS, Azure, and how to configure settings can be found in the section Name resolution that uses your own DNS server.

After promoting the new domain controllers in Azure, they will need to be set to the primary and secondary DNS Servers for the virtual network, and any on-premises DNS Servers would be demoted to tertiary and beyond. VMs continue to use their current DNS settings until they are restarted. More information on changing DNS Servers can be found in the article Create, change, or delete a virtual network.

Information about extending an on-premises network to Azure can be found in the article Creating a site-to-site VPN connection.

Configure the VMs and install Active Directory Domain Services

After the script completes, browse to the Azure portal, then Virtual machines.

Configure the first Domain Controller

Connect to AZDC01 using the credentials you provided in the script.

• Initialize and format the data disk as F:
  • Open the Start menu and browse to Computer Management
  • Browse to Storage > Disk Management
  • Initialize the disk as MBR
  • Create a New Simple Volume and Assign the drive letter F: you can provide a Volume label if you wish
• Install Active Directory Domain Services using Server Manager
• Promote the domain controller as the first in a new forest
  • Leave Domain Name System (DNS) server and Global Catalog (GC) checked on the Domain Controller Options page
  • Specify a Directory Services Restore Mode password based on your organizational requirements
  • Change the paths from C: to point to the F: drive we created when prompted for their location
  • Review the selections made in the wizard and choose Next

• Choose Install

When the wizard completes the install process, the VM reboots.

When the VM has completed rebooting, log back in with the credentials used before, but this time as a member of the domain you created.

Azure virtual networks do now support IPv6 , but in case you want to set your VMs to prefer IPv4 over IPv6, information on how to complete this task can be found in the KB article Guidance for configuring IPv6 in Windows for advanced users.

Configure DNS

After promoting the first server in Azure, the servers will need to be set to the primary and secondary DNS Servers for the virtual network, and any on-premises DNS Servers would be demoted to tertiary and beyond. More information on changing DNS Servers can be found in the article Create, change, or delete a virtual network.

Configure the second Domain Controller

Connect to AZDC02 using the credentials you provided in the script.

• Initialize and format the data disk as F:
  • Open the Start menu and browse to Computer Management
  • Browse to Storage > Disk Management
  • Initialize the disk as MBR
  • Create a New Simple Volume and Assign the drive letter F: (you can provide a Volume label if you wish)
• Install Active Directory Domain Services using Server Manager
• Promote the domain controller
  • Add a domain controller to an existing domain - CONTOSO.com
  • Supply credentials to perform the operation
  • Change the paths from C: to point to the F: drive we created when prompted for their location
  • Ensure Domain Name System (DNS) server and Global Catalog (GC) are checked on the Domain Controller Options page
  • Specify a Directory Services Restore Mode password based on your organizational requirements
  • Review the selections made in the wizard and choose Next

• Choose Install

When the wizard completes the install process, the VM reboots.

When the VM has completed rebooting, log back in with the credentials used before, but this time as a member of the CONTOSO.com domain

Azure virtual networks do now support IPv6, but in case you want to set your VMs to prefer IPv4 over IPv6, information on how to complete this task can be found in the KB article Guidance for configuring IPv6 in Windows for advanced users.

Wrap up

At this point, the environment has a pair of domain controllers, and we have configured the Azure virtual network so that additional servers may be added to the environment. Post-install tasks for Active Directory Domain Services, like configuring sites and services, auditing, backup, and securing the built-in administrator account, should be completed at this point.

Removing the environment

To remove the environment, when you have completed testing, the resource group we created above can be deleted. This step removes all of the components that are part of that resource group.

Remove using the Azure portal

From the Azure portal, browse to Resource groups and choose the resource group we created (in this example ADonAzureVMs), then select Delete resource group. The process asks for confirmation before deleting all the resources contained inside of the resource group.

Remove using the Azure CLI

From Azure CLI run the following command:

az group delete --name ADonAzureVMs

Next steps

• Safely virtualizing Active Directory Domain Services (AD DS)
• Microsoft Entra Connect
• Backup and recovery
• Site to site VPN connectivity
• Monitoring
• Security and policy
• Maintenance and updates