Preparing Active Directory Domain Services

Active Directory Preparation Prerequisites

You must run Active Directory preparation steps on a computer running Windows Server 2008 R2 (64-bit) or Windows Server 2008 with SP2 (64-bit). Active Directory preparation requires Lync Server Management Shell and OCSCore, which are not supported on Windows Server 2003.

The following components are required to run Active Directory preparation tasks:

• Lync Server Core components (OCScore.msi)

  Note

  If you plan to use Lync Server Management Shell for Active Directory preparation, you must run the Lync Server Deployment Wizard first to install Core components.

• Microsoft .NET Framework 3.5 with Service Pack 1 (SP1) (64-bit)

  Note

  For Windows Server 2008 R2, .NET Framework 3.5 with Service Pack 1 (SP1) (64-bit) is installed as part of Server Manager. For Windows Server 2008, the file dotnetfx35.exe is supplied for you in the \Setup\AMD64 directory of the installation media or download.

• Remote Server Administration Tools (RSAT)

  Note

  Some RSAT tools are required if you run Active Directory preparation steps on a member server rather than on a domain controller. For Windows Server 2008 R2 and Windows Server 2008, install the AD DS snap-ins and command-line tools and the Active Directory Module for Windows PowerShell from the AD DS and AD LDS Tools node.

• Microsoft Visual C++ 2008 Redistributable package (64-bit)

  Note

  Setup prompts you to install this prerequisite if it is not already installed on the computer. The package is supplied for you, and you will not have to acquire it separately.

• Windows PowerShell V2 (64-bit)

Administrator Rights and Roles

The following table shows the administrative rights and roles required for each Active Directory preparation task.

User Rights Required for Active Directory Preparation

Active Directory Preparation Cmdlets

The following table compares the Lync Server Management Shell cmdlets used to prepare AD DS to the LcsCmd commands used to prepare AD DS in Microsoft Office Communications Server 2007 R2.

Cmdlets Compared to LcsCmd

Locked Down Active Directory Requirements

If permissions inheritance is disabled or authenticated user permissions must be disabled in your organization, you must perform additional steps during domain preparation. For details, see Preparing a Locked-Down Active Directory Domain Services.

Custom Container Permissions

If your organization uses custom containers instead of the three built-in containers (that is, Users, Computers, and Domain Controllers), you must grant read access to the custom containers for the Authenticated Users group. Read access to the containers is required for domain preparation. For details, see Running Domain Preparation.

Using Cmdlets and Ldifde.exe

The Prepare Schema step in the Lync Server Deployment Wizard and the Install-CsAdServerSchema cmdlet extend the Active Directory schema on domain controllers running a 64-bit operating system. If you need to extend the Active Directory schema on a domain controller running a 32-bit operating system, you can run the Install-CsAdServerSchema cmdlet remotely from a member server (recommended approach). If you need to run schema preparation directly on the domain controller, however, you can use the Ldifde.exe tool to import the schema files. The Ldifde.exe tool comes with most versions of the Windows operating system.

If you use Ldifde.exe to import the schema files, you must import all four files, regardless of whether you are migrating from a previous version or performing a clean installation. You must import them in the following sequence:

1. ExternalSchema.ldf

2. ServerSchema.ldf

3. BackCompatSchema.ldf

4. VersionSchema.ldf

To use Ldifde.exe to import the four schema files on a domain controller that is the schema master, use the following format:

ldifde -i -v -k -s <DCName> -f <Schema filename> -c DC=X <defaultNamingContext> -j logFilePath -b <administrator account> <logon domain> <password>

For example:

ldifde -i -v -k -s DC1 -f ServerSchema.ldf -c DC=X "DC=contoso,DC=com" -j C:\BatchImportLogFile -b Administrator contoso password

To use Ldifde.exe to import the four schema files on a domain controller that is not the schema master, use the following format:

ldifde -i -v -k -s <SchemaMasterFQDN> -f <Schema filename> -c DC=X <rootDomainNamingContext> -j logFilePath -b <administrator account> <domain> <password>

For details about using Ldifde, see Microsoft Knowledge Base article 237677, "Using LDIFDE to import and export directory objects to Active Directory," at https://go.microsoft.com/fwlink/p/?linkid=3052&kbid=237677.

In This Section

• Running Schema Preparation

• Running Forest Preparation

• Running Domain Preparation