Lab: Implementing and managing AD DS

Exercise 1: Cloning a domain controller

Task 1: Prepare a source domain controller to be cloned

1.	On LON-DC1, in Server Manager, click Tools, and then click Active Directory Administrative Center.
2.	In Active Directory Administrative Center, double-click Adatum (local), and then in the list, double-click the Domain Controllers organizational unit (OU).
3.	In the list, select LON-DC1 if it is not already selected, and then in the Tasks pane, in the LON-DC1 section, click Add to group.
4.	In the Select Groups dialog box, in the Enter the object names to select text box, type Cloneable, and then click Check Names.
5.	Ensure that the group name is expanded to Cloneable Domain Controllers, and then click OK.
6.	Click Start, and then click Windows PowerShell.
7.	At the command prompt in the Windows PowerShell command-line interface, type the following command, and then press Enter: `Get-ADDCCloningExcludedApplicationList`
8.	Verify the list of critical apps. In production, you need to verify each app or use a domain controller that has fewer apps installed by default. Type the following command, and then press Enter: `Get-ADDCCloningExcludedApplicationList –GenerateXML`
9.	Run the following command to create the DCCloneConfig.xml file: `New-ADDCCloneConfigFile -CloneComputerName “LON-DC3”`
10.	Type the following command to shut down LON-DC1, and then press Enter: `Stop-Computer`
11.	Wait for the machine to shut down. You might be asked to confirm the shutdown.

Task 2: Export the source virtual machine

1.	On the host computer, in Hyper-V Manager, in the details pane, select the 20743C-LON-DC1 virtual machine.
2.	In the Actions pane, in the 20743C-LON-DC1 section, click Export.
3.	In the Export Virtual Machine dialog box, navigate to D:\Program Files\Microsoft Learning\20743, and then click Export. Wait until the export finishes. This can take from 10 to 15 minutes.
4.	Start and connect to 20743C-LON-DC1 and sign in as Adatum\Administrator with the password Pa55w.rd.

Task 3: Create and start the cloned domain controller

1.	On the host computer, in Hyper-V Manager, in the Actions pane, in the section that is named for the host computer, click Import Virtual Machine.
2.	In the Import Virtual Machine Wizard, on the Before You Begin page, click Next.
3.	On the Locate Folder page, click Browse, go to D:\Program Files\Microsoft Learning\20743\20743C-LON-DC1, click Select Folder, and then click Next.
4.	On the Select Virtual Machine page, select 20743C-LON-DC1 if it is not already selected, and then click Next.
5.	On the Choose Import Type page, select Copy the virtual machine (create a new unique ID), and then click Next.
6.	On the Choose Folders for Virtual Machine Files page, select the Store the virtual machine in a different location check box. For each folder location, specify D:\Program Files\Microsoft Learning\20743\ as the path, and then click Next.
7.	On the Choose Folders to Store Virtual Hard Disks page, specify the D:\Program Files\Microsoft Learning\20743\ path, and then click Next.
8.	On the Completing Import Wizard page, click Finish. The machine imports. This can take from 10 to 15 minutes or longer. Note: You can continue with the next exercise while the import proceeds.
9.	After the import completes, in the Virtual Machines list, identify and select the newly imported 20743C-LON-DC1 virtual machine, which has the State value as Off. In the lower section of the Actions pane, click Rename.
10.	Type 20743C-LON-DC3 as the name, and then press Enter.
11.	In the Actions pane, in the 20743C-LON-DC3 section, click Start, and then click Connect to see the virtual machine starting.
12.	While the server is starting, a “Domain Controller cloning is at x% completion” message displays.

Result: After completing this exercise, you should have successfully cloned a domain controller.

Exercise 2: Implementing service accounts

Task 1: Create and associate a managed service account

1.	On LON-DC1, click Start, and then click Windows PowerShell.
2.	In the Windows PowerShell window, at the command prompt, type the following command, and then press Enter: `Add-KdsRootKey –EffectiveTime ((get-date).addhours(-10))`
3.	At the Windows PowerShell command prompt, type the following command, and then press Enter: `New-ADServiceAccount –Name Webservice –DNSHostName LON-DC1 –PrincipalsAllowedToRetrieveManagedPassword LON-DC1$`
4.	Type the following command, and then press Enter:`Add-ADComputerServiceAccount –identity LON-DC1 –ServiceAccount Webservice`
5.	Type the following command, and then press Enter:`Get-ADServiceAccount -Filter *`
6.	Note the output of the command.
7.	Type the following command, and then press Enter:`Install-ADServiceAccount –Identity Webservice`
8.	Minimize the Windows PowerShell window.

Task 2: Configure the Web server application pool to use the group managed service account

1.	On LON-DC1, in Server Manager, click the Tools menu, and then click Internet Information Services (IIS) Manager.
2.	In the Internet Information Services (IIS) Manager console, expand LON-DC1 (Adatum\Administrator). Click Application Pools.
3.	In the details pane, right-click the DefaultAppPool, and then click Advanced Settings.
4.	In the Advanced Settings dialog box, click Identity, and then click the ellipsis (…).
5.	In the Application Pool Identity dialog box, click Custom Account, and then click Set.
6.	In the Set Credentials dialog box, in the User name text box, type Adatum\Webservice$, and then click OK three times.
7.	In the Actions pane, click Stop to stop the application pool.
8.	To start the application pool, click Start.
9.	Verify that the identity of the DefaultAppPool is set to adatum\webservice$.
10.	Close the Internet Information Services (IIS) Manager.

Note: If you did not complete Exercise 1, “Cloning a domain controller,” do so before reverting the virtual machines.

Task 3: Prepare for the next module

When you have finished the lab, revert the virtual machines to their initial state:

1.	On the host computer, start Hyper-V Manager.
2.	In the Virtual Machines list, right-click 20743C-LON-DC1, and then click Revert.
3.	In the Revert Virtual Machine dialog box, click Revert.
4.	In the Virtual Machines list, right-click 20743C-LON-DC3, and then click Shut Down.
5.	In the Shut Down Machine dialog box, click Shut Down.

Result: After completing this exercise, you should have successfully implemented service accounts.

Upgrading Your Skills to MCSA Windows Server 2016