Windows Services Index | Overview | Getting Started | How To | Forest Design | Resources | Troubleshooting | Policies | Contact Info

How To: Installing an additional Domain Controller in a child domain

Prerequisites:

1. You have contacted the Win-AD team to inform them that you are adding a DC (without notification, your new DC will not be able to communicate correctly with the ACCESS DCs).
2. You have a server that meets Microsoft's minimum requirements.
3. You have the administrative account and password provided by an ACCESS administrator.
4. You have an existing Child Domain.

Step 1: Patch the machine and setup the machine name.

Patching the Machine

It is extremely important to have an updated machine prior to installing the machine into Active Directory. You can use the Windows® Software Update Service to patch and update the machine, or another method of your choice.

Setting Up the Machine Name:

1. Right-click My Computer and choose Properties.
2. Choose Computer Name.
3. Click <Change>.
4. Ensure that the Computer name text box has the correct machine name and that the machine name is correctly prefix with your organization's designated two- or three-letter prefix.



5. Click <More>.
6. Click the Change primary DNS suffix when domain membership changes check box to disable this option.
7. Enter the DNS suffix of the machine where YourDNSsuffix.psu.edu is the the DNS suffix of the Fully Qualified Domain Name (FQDN) for the machine.



8. Click <OK> for the next four windows.
9. Click <Yes> to restart the computer.
10. After rebooting, right-click My Network Places and choose Properties. Choose the connection used to access the network.
11. Right-click and choose Properties.
12. Double-click Internet Protocol (TCP/IP).
13. Click Advanced.
14. Choose the DNS Tab.
15. Ensure that the DNS servers listed are the DNS servers you generally use to resolve DNS names; you may use the two listed or DNS servers run by your organization.
16. In the Append, these DNS suffixes (in order) text box replace your DNSsuffix.psu.edu with your organization's DNS suffix and be sure to include aset.psu.edu as well.
17. Click the Register the connection's addresses in DNS check box to disable this option.



18. You can also set a WINS server. (optional)
19. Under Advanced TCP/IP Settings, select the WINS tab.
20. Click <Add>.
21. You may use the WINS server provided by us or a WINS server of your choice.
22. Click <Add>.



23. Click <OK>.
24. Click <OK>.
25. Click <OK>.

Step 2: Start the DC Promotion.

1. Choose Start –>Run.
2. Enter dcpromo and click <Enter>.
3. Click <Next> and click <Next> again.
4. Click the Additional Domain Controller for a new domain radio button.
5. Click <Next>.



6. Using the administrator account or an administrative account in your child domain, enter the appropriate account information in the fields provided.
7. Click <Next>.



8. Enter the name of your child domain.



9. Click <Next>.
10. Choose the location for the Active Directory® database (choosing a drive or a partitioned drive is recommended).



11. Click <Next>.
12. Choose a location for the SYSVOL.



13. Click <Next>.
14. Choose a restore mode password.



15. Click <Next>. This may take time to process. Please be patient.
16. Review the information.
17. Click <Next>. This may take time to process. Please be patient.
18. Click <Finish>.
19. Click <Restart Now>.

Setting Up the Registry Entries for the K5 KDCs

1. Visit https://downloads.its.psu.edu/. Upon successful authentication, click "File Transfer". Then, click the "Windows" link for the Registry key for PASS Access. Once it has been downloaded simply run the file and it will handle the addition of information into your registry.
2. Test the configuration by using your Penn State Access Account userid and password to log on. In this case, you will enter (for example) xyz123@dce.psu.edu and the password, where xyz123 represents your Access Account userid.
3. If the message, local policy of this system does not permit you to log on interactively, appears or the machine allows you to log in, then the trust works.