Managing Domain Controllers

Active Directory domain controllers are your network's castles of identity. They offer services, such as LDAP, Kerberos, and NTLM, to people using devices, appliances, and servers. The previous chapter introduced the concepts of forests, trees, and domains. In this chapter, we are going to provide some more tangible things, such as server machines. But please don't take that literally; domain controllers these days are found to be virtual machines, more than physical machines.

I'll walk through creating new domain controllers and show you which type of domain controller to implement. I'll also show you how to create domain controllers quickly, even when there's only a slow connection between the location with existing domain controllers and the location where you want to implement a new domain controller. We'll also look at creating hundreds of domain controllers quickly. 

The following recipes will be covered in this chapter:

• Promoting a server to a domain controller
• Promoting a server to a read-only domain controller
• Using Install From Media 
• Using domain controller cloning
• Determining whether a virtual domain controller has a VM-GenerationID
• Demoting a domain controller
• Demoting a domain controller forcefully
• Inventory domain controllers
• Decommissioning a compromised read-only domain controller