导航：首页 > 服务器 >

Active Directory Domain Service

发表于：2025-12-01 作者：千家信息网编辑

千家信息网最后更新 2025年12月01日，AD DS DesignSingle forest single domain is preferredTime is important (PDC)Implement multiple/backup

千家信息网最后更新 2025年12月01日Active Directory Domain Service

AD DS Design

Single forest single domain is preferred
Time is important (PDC)
Implement multiple/backup domain controllers
2,150,000,000 objects per domain
FQDN less than 64 characters

FSMO (Flexible single master operation)

Schema master	Forest level	To make change into Schema in forest (such as implement Exchange, Lync)
Domain naming master	Forest level	To add/remove domain in forest
PDC	Domain level	Time root in forest (PC-DC-PDC) Group policy management centrally Handle password change specially (After change user password, the DC will sync to PDC immediately) Handle user account lock specially
RID Pool master	Domain level	Assign RIDs (500/time) to DC
Infrastucture master	Domain level	Objects reference in different domains

# To check the FSMO servers

netdom query fsmo

# To transfer / seize

netdom /?

Install Domain controllers in the first site

# Install AD DS on the first DC

Install-WindowsFeature AD-Domain-Services -IncludeAllSubFeature -IncludeManagementTools

## Windows PowerShell script for AD DS Deployment#Import-Module ADDSDeploymentInstall-ADDSForest `-CreateDnsDelegation:$false `-DatabasePath "C:\Windows\NTDS" `-DomainMode "Win2012R2" `-DomainName "vccware.com" `-DomainNetbiosName "VCCWARE" `-ForestMode "Win2012R2" `-InstallDns:$true `-LogPath "C:\Windows\NTDS" `-NoRebootOnCompletion:$false `-SysvolPath "C:\Windows\SYSVOL" `-SafeModeAdministratorPassword (ConvertTo-SecureString "123.com" -AsPlainText -Force) `-Force:$true

w32tm /config /computer:BJDC01.vccware.com /manualpeerlist:time.windows.com /syncfromflags:manual /update

Change the DNS from 127.0.0.1 back in the network adaptor configuration
# Install AD DS on the second DC

Install-WindowsFeature AD-Domain-Services -IncludeAllSubFeature -IncludeManagementTools

## Windows PowerShell script for AD DS Deployment#Import-Module ADDSDeploymentInstall-ADDSDomainController `-NoGlobalCatalog:$false `-CreateDnsDelegation:$false `-CriticalReplicationOnly:$false `-DatabasePath "C:\Windows\NTDS" `-DomainName "vccware.com" `-InstallDns:$true `-LogPath "C:\Windows\NTDS" `-NoRebootOnCompletion:$false `-ReplicationSourceDC "BJAD01.vccware.com" `-SiteName "Default-First-Site-Name" `-SysvolPath "C:\Windows\SYSVOL" `-SafeModeAdministratorPassword (ConvertTo-SecureString "123.com" -AsPlainText -Force) `-Force:$true

很赞哦！