📌 Project Overview
🖥️ Deploying an Active Directory Domain: Configuring a Windows Server Domain Controller and Client Integration on Azure Virtual Machines
This project demonstrates the setup and configuration of an Active Directory (AD) domain environment using Microsoft Azure Virtual Machines (VMs) to simulate a real-world enterprise IT infrastructure. The goal is to showcase how a Windows Server Domain Controller (DC) is deployed and configured to manage users, groups, and policies, while a Windows 10 Client VM is joined to the domain for centralized authentication and resource access.
🏗️ Key Components of the Project:
🔹 ☁️ Azure Virtual Machines (VMs) Setup – Deploy and configure two VMs:
- 🖥️ VM 1 (Server – Domain Controller): Hosts Active Directory Domain Services (AD DS), manages authentication, enforces Group Policies, and provides network services.
- 💻 VM 2 (Client – Workstation): Joins the domain, authenticates against AD, and accesses shared company resources.
🔹 📂 Active Directory & Domain Services (AD DS) Configuration
- 👤 Create and Manage Users & Groups within Active Directory.
- 🔒 Enforce Security Policies using Group Policy Objects (GPOs).
- 🏢 Centralized Authentication & Access Control to streamline user management.
🔹 🌐 Custom Network Configuration & DNS Setup
- 🛠️ Manually Assign DNS Settings: Configure the client VM to use the domain controller’s IP as its DNS server for proper domain resolution.
- 🏠 Domain Name System (DNS) Configuration: Ensure smooth communication between the client and the server.
- 🔄 Domain Joining Process: Connect the client VM to the Active Directory domain and validate authentication.
🔹 🔗 Remote Management & Access
- 🖥️ Use Remote Desktop Connection (RDP) to manage both VMs from a single interface.
- ✅ Verify Client Domain Connectivity: Test user authentication and ensure proper domain access.
🎯 Project Goal
This project demonstrates core IT administration skills, including Active Directory setup, domain joining, group policy configuration, and network management within an Azure cloud environment. It serves as a foundation for understanding enterprise IT infrastructure, making it highly relevant for IT professionals working in systems administration, help desk, and network management. 🚀
🛠️ Tools & Technologies Used
🔹 ☁️ Microsoft Azure
- Hosts the virtual machines (VMs) and network infrastructure.
🔹 💻 Azure Virtual Machines (VMs)
- 🖥️ VM 1 (Windows Server – Domain Controller): Runs Active Directory Domain Services (AD DS) to manage users and policies.
- 💻 VM 2 (Windows 10 Client): Simulates an end-user workstation that joins the domain.
🔹 📂 Active Directory Domain Services (AD DS)
- Manages users, groups, and authentication within the network.
🔹 🌐 Domain Name System (DNS) Configuration
- Ensures proper name resolution and domain connectivity.
🔹 🔒 Group Policy Objects (GPOs)
- Enforces security policies and user access controls.
🔹 🔗 Remote Desktop Connection (RDC) using RDP Protocol
- Provides secure remote access to manage VMs.
🔹 ⚙️ Windows PowerShell & Command Prompt
- Used for Active Directory administration, domain joining, and network configurations.
🛠️ Step 1: Create a Resource Group in Azure
📌 Purpose: The resource group acts as a container for all related resources in this project, ensuring organization and simplified management. This will house the two Virtual Machines (VMs), Virtual Network (VNet), and other necessary components.
✅ Step-by-Step Instructions
🔹 1️⃣ Sign in to Azure Portal
- 🌐 Navigate to Azure Portal
- 🔑 Log in using your Microsoft Azure account
🔹 2️⃣ Navigate to Resource Groups
- 🔍 In the search bar, type “Resource Groups” and select it.
- ➕ Click “Create” to set up a new resource group.
🔹 3️⃣ Configure the Resource Group
- 📌 Subscription → Select your Azure Subscription
- 📂 Resource Group Name → Enter
Active-Directory-Lab - 🌍 Region → Select
East US 2(for better performance based on your choice).
🔹 4️⃣ Review & Create
- 🔄 Click “Review + Create” to validate your settings.
- 🚀 Click “Create” to deploy the resource group.
🎯 Outcome:
✅ Active-Directory-Lab resource group is successfully created, serving as the foundation for all Virtual Machines, Networking, and Active Directory components in this project.
🏗️ Step 2: Create a Virtual Network (VNet) in Azure
Now that we have our Resource Group (Active-Directory-Lab), we will create a Virtual Network (VNet) to allow communication between our Domain Controller (Server VM) and Client (Workstation VM).
✅ Steps to Create the Virtual Network (VNet)
1️⃣ Navigate to Virtual Networks in Azure
- From the Azure Portal, click on the search bar at the top.
- Type Virtual Network and select Virtual Networks from the results.
- Click on + Create to begin setting up a new virtual network.
2️⃣ Configure the Virtual Network (VNet)
- Resource Group: Select Active-Directory-Lab (the one we created earlier).
- Virtual Network Name: Enter Active-Directory-Vnet.
- Region: Choose East US 2 (same as the resource group).
3️⃣ Review & Create
- Skip the IP Addresses, Security, and Tags tabs for now.
- Click Review + Create to finalize the VNet.
- Once validation passes, click Create.
🎯 Why This Step is Important?
🔹 Provides a private network for our Virtual Machines to communicate securely.
🔹 Ensures seamless connectivity between the Domain Controller VM and the Client VM.
🔹 Lays the foundation for setting up Active Directory and domain joining in later steps.
🏗️ Step 3: Create the Domain Controller (DC-1) Virtual Machine
Now that our Resource Group (Active-Directory-Lab) and Virtual Network (Active-Directory-Vnet) are set up, we will create the Domain Controller Virtual Machine (DC-1), which will run Windows Server 2022 Datacenter. This VM will later host Active Directory Domain Services (AD DS) to manage users, authentication, and policies.
✅ Steps to Create the Domain Controller (DC-1) VM
1️⃣ Navigate to Virtual Machines in Azure
- In the Azure Portal, click the search bar at the top.
- Type Virtual Machines and select Virtual Machines from the results.
- Click + Create and select Azure Virtual Machine.
2️⃣ Configure the Basics Tab
- Subscription: Azure subscription 1
- Resource Group: Active-Directory-Lab
- Virtual Machine Name: DC-1
- Region: East US 2
- Availability Options: Availability Zone
- Zone: Zone 1
- Security Type: Trusted launch virtual machines
- Image: Windows Server 2022 Datacenter: Azure Edition – x64 Gen2
- VM Size: Standard_D2s_v3 (2 vCPUs, 8GB RAM)
- Administrator Account:
- Username: Domainserver
- Password: Domainserver123
- Confirm Password: Domainserver123
3️⃣ Configure Inbound Port Rules
- Public Inbound Ports: Allow Selected Ports
- Selected Inbound Ports: RDP (3389) (For remote access using Remote Desktop Connection – RDP)
4️⃣ Licensing (Optional)
- If you have an existing Windows Server license, check the box for Azure Hybrid Benefit to save costs.
🏗️ Step 4: Configure Additional VM Settings for DC-1
Now that we have completed the Basics tab for our Domain Controller VM (DC-1), we will move on to Disks, Networking, and Final Review before deployment.
5️⃣ Configure the Disks Tab
- Leave all settings as default.
- Click Next: Networking > to proceed.
6️⃣ Configure the Networking Tab
In this step, we will associate DC-1 with our previously created Virtual Network (Active-Directory-Vnet) to ensure proper domain communication.
- Virtual Network: Select
Active-Directory-Vnet(this is the virtual network we created earlier). - Leave all other networking settings as default.
- Click Next: Management >
7️⃣ Review and Create
Now, we are ready to finalize our Domain Controller VM.
- Click Review + Create.
- Wait for validation to pass.
- Click Create to begin the deployment process.
- Once deployment is complete, note down the Public and Private IP addresses of the VM for future use.
🎯 Why This Step is Important?
🔹 Disks are left as default to optimize storage and performance.
🔹 Networking is configured to use our custom VNet, ensuring that all domain services operate within a controlled environment.
🔹 Reviewing ensures all configurations are correct before deploying the VM.
🖥️ Deploying the Client Virtual Machine (CLIENT-1)
Now that we have our Domain Controller (DC-1) deployed, we will set up a Windows 10 Client VM (CLIENT-1) that will eventually join the Active Directory domain for centralized authentication.
1️⃣ Configure the Basics Tab
🔹 Resource Group: Active-Directory-Lab (Same as DC-1)
🔹 Virtual Machine Name: client-1
🔹 Region: (US) East US 2
🔹 Availability Zone: Zone 1
🔹 Security Type: Trusted Launch Virtual Machines
🔹 Image: Windows 10 Pro, version 22H2 - x64 Gen2
🔹 VM Size: Standard_E2s_v3 (2 vCPUs, 16 GiB memory)
🔹 Administrator Credentials:
- Username:
client-1 - Password:
Client123456
🔹 Inbound Port Rules:
- Allow RDP (3389) for remote access
🔹 Licensing:
- ✅ Confirm multi-tenant hosting rights for Windows 10/11 compliance
Click Next: Disks >
2️⃣ Configure the Disks Tab
🔹 Leave all settings as default.
Click Next: Networking >
3️⃣ Configure the Networking Tab
🔹 Virtual Network: Select Active-Directory-Vnet (same VNet as DC-1).
🔹 Leave all other settings as default.
Click Next: Management >
4️⃣ Review & Create
🔹 Click Review + Create.
🔹 Wait for validation to pass.
🔹 Click Create to deploy the VM.
🔹 Once deployment is complete, note down the Public and Private IP addresses of CLIENT-1 for future use.
🎯 Why This Step is Important?
✅ The Client VM (CLIENT-1) is needed to test domain authentication and simulate a user logging into a corporate environment.
✅ The Networking setup ensures that both DC-1 and CLIENT-1 are in the same virtual network, enabling Active Directory communication.
✅ RDP is enabled to allow remote access for administration and troubleshooting.
🔧 Configuring a Static Private IP for DC-1 & Disabling Firewall for Testing
Now that DC-1 (Domain Controller VM) is created, we need to set its Private IP address to static and disable the Windows Firewall temporarily for testing.
1️⃣ Set DC-1’s Private IP to Static
🔹 Why is this necessary?
By default, Azure assigns Dynamic Private IPs to virtual machines. This means that if DC-1 is restarted or another VM is created, the private IP address could change. Since CLIENT-1 will need to manually configure its DNS settings to point to DC-1, a changing IP would cause connection failures when trying to join the domain.
✅ Setting the IP to Static ensures:
- The DC-1 private IP remains constant, preventing DNS misconfigurations.
- CLIENT-1 can reliably locate and connect to the domain controller.
🔹 Steps to Configure a Static Private IP:
1️⃣ Go to the Azure Portal and navigate to Virtual Machines.
2️⃣ Select DC-1 → Networking → Click on the Network Interface (NIC).
3️⃣ Under Settings, click IP Configurations.
4️⃣ Click on IP Configuration 1 (or whatever the primary network interface is named).
5️⃣ Change Assignment from Dynamic to Static.
6️⃣ Click Save to apply the changes.
2️⃣ Disable Windows Firewall (Temporarily for Testing)
🔹 Why is this necessary?
The Windows Firewall can block network traffic needed for Active Directory communication and client connections. Since this is a lab environment, we will temporarily disable it for testing to ensure there are no connectivity issues.
🔹 Steps to Disable Windows Firewall:
1️⃣ Press Win + R to open the Run Dialog Box.
2️⃣ Type wf.msc and press Enter to open Windows Defender Firewall.
3️⃣ Click Turn Windows Defender Firewall on or off (on the left sidebar).
4️⃣ Under Domain Network, Private Network, and Public Network, select Turn off Windows Defender Firewall.
5️⃣ Click OK to apply changes.
🛑 Important Note:
✅ This is only for testing connectivity—re-enable it later and configure proper firewall rules as needed.
🎯 Why This Step is Important?
✅ Ensures DNS resolution for CLIENT-1 by maintaining a fixed IP address for DC-1.
✅ Prevents network disruptions if DC-1 is restarted.
✅ Disabling the firewall temporarily allows unrestricted communication between DC-1 and CLIENT-1 for domain joining and authentication tests.
🔗 Joining CLIENT-1 to the Domain: Configuring DNS & Verifying Connectivity
Now that DC-1 has a static private IP address (10.0.0.4), we need to configure CLIENT-1 to point to DC-1’s IP as its DNS server. This is crucial because Active Directory requires proper DNS resolution for the domain-joining process to work.
1️⃣ Configure CLIENT-1’s DNS Settings
🔹 Why is this necessary?
By default, Azure assigns a Dynamic DNS to virtual machines. Since CLIENT-1 needs to locate DC-1 to join the domain, we must manually set its DNS to DC-1’s Private IP (10.0.0.4).
🔹 Steps to Configure DNS on CLIENT-1:
1️⃣ Go to the Azure Portal → Navigate to Virtual Machines.
2️⃣ Select CLIENT-1 → Networking → Click on the Network Interface (NIC).
3️⃣ Under Settings, click DNS Servers.
4️⃣ Change DNS Configuration from Default (Azure-provided) to Custom.
5️⃣ In the Primary DNS field, enter 10.0.0.4 (DC-1’s Private IP).
6️⃣ Click Save to apply the changes.
2️⃣ Restart CLIENT-1 & Verify Connectivity
Now that CLIENT-1 is pointing to DC-1 for DNS resolution, we will restart the VM and perform a connectivity test.
🔹 Steps:
1️⃣ From the Azure Portal, select CLIENT-1 → Click Restart.
2️⃣ Once restarted, log in to CLIENT-1 using the local administrator account.
3️⃣ Open Command Prompt (Win + R → type cmd → press Enter).
4️⃣ Ping DC-1’s Private IP Address (10.0.0.4):
ping 10.0.0.4
5️⃣ Ensure the ping succeeds (Reply from 10.0.0.4…).
6️⃣ Open PowerShell and verify DNS settings by running:
ipconfig /all
7️⃣ Look for the DNS Server entry—it should now show 10.0.0.4 (DC-1’s IP).
🎯 Why This Step is Important?
✅ Ensures CLIENT-1 can resolve DC-1 for domain joining.
✅ Verifies network connectivity between CLIENT-1 and DC-1.
✅ Confirms that CLIENT-1 is correctly using DC-1 for DNS resolution.
🏗️ Promote DC-1 as a Domain Controller
1️⃣ Once AD DS installation completes, click Promote this server to a domain controller (appears in the wizard).
2️⃣ Deployment Configuration:
- Select Add a new forest.
- Enter Root domain name:
mydomain.com(or any custom domain you prefer). - Click Next.
3️⃣ Domain Controller Options:
- ✅ Ensure Domain Name System (DNS) and Global Catalog (GC) are checked.
- Set Directory Services Restore Mode (DSRM) password (use something secure, but remember it).
- Click Next.
4️⃣ DNS Options: Ignore the warning about delegation and click Next.
5️⃣ Additional Options: Verify NetBIOS Name (MYDOMAIN), then click Next.
6️⃣ Paths: Leave as default and click Next.
7️⃣ Review the configuration, then click Install.
8️⃣ DC-1 will restart automatically after installation.
👤 Create a Domain Admin User in Active Directory
Now, we will create a domain administrator account within the _ADMINS Organizational Unit (OU). This user will have Domain Admin privileges to manage the domain.
🛠️ Steps to Create a Domain Admin User in Active Directory
1️⃣ Open Active Directory Users and Computers (ADUC)
1️⃣ Log into DC-1 as mydomain.com\Domainserver.
2️⃣ Open Run (Win + R) → Type dsa.msc → Press Enter.
3️⃣ Active Directory Users and Computers (ADUC) will open.
2️⃣ Create Organizational Units (OUs)
1️⃣ In the left panel, expand your domain mydomain.com.
2️⃣ Right-click your domain → Select New → Organizational Unit.
3️⃣ Name the first OU _EMPLOYEES → Click OK.
4️⃣ Repeat the process to create another OU _ADMINS → Click OK.
3️⃣ Create a New Admin User (Jane Doe) in _ADMINS OU
1️⃣ Navigate to the _ADMINS OU in ADUC.
2️⃣ Right-click _ADMINS → Select New → User.
3️⃣ Fill in user details:
- First Name: Jane
- Last Name: Doe
- Full Name: Jane Doe
- User logon name: jane_admin
4️⃣ Click Next.
5️⃣ Set Password:Domainserver123!
6️⃣ Uncheck User must change password at next logon.
7️⃣ Check ✅ Password never expires (optional for labs).
8️⃣ Click Next → Finish.
4️⃣ Assign Admin Privileges to Jane Doe
1️⃣ Navigate to Active Directory Users and Computers.
2️⃣ Find jane_admin under _ADMINS.
3️⃣ Right-click jane_admin → Click Properties.
4️⃣ Go to the Member Of tab → Click Add….
5️⃣ In the “Enter the object names” box, type: Domain Admins
6️⃣ Click Check Names → Click OK.
7️⃣ Click Apply → OK.
5️⃣ Log Out and Log In as the New Admin
1️⃣ Close ADUC and log out of DC-1.
2️⃣ Log back in using the new admin account:
- Username:
mydomain.com\jane_admin - Password:
Domainserver123!
3️⃣ From now on, use jane_admin as the admin account. ✅
🎯 Summary
✅ Created Jane Doe under the _ADMINS Organizational Unit.
✅ Assigned jane_admin to the Domain Admins security group.
✅ Logged in as jane_admin for all future administrative tasks.
Got it! We’ll skip the manual DNS configuration for CLIENT-1. Since it’s already within the same Azure Virtual Network (VNet) as DC-1, it should automatically resolve the domain without needing a manual DNS setup.
🛠️ Steps to Join CLIENT-1 to the Domain (mydomain.com)
1️⃣ Log into CLIENT-1 as the Local Administrator
1️⃣ Open Remote Desktop Connection (RDP) and connect to CLIENT-1.
2️⃣ Log in using the local admin account:
- Username:
client-1 - Password:
Client123456
2️⃣ Join CLIENT-1 to the Domain (mydomain.com)
1️⃣ Open Run (Win + R) → Type sysdm.cpl → Press Enter.
2️⃣ Click the Computer Name tab → Click Change.
3️⃣ Under Member of, select Domain and enter:
mydomain.com
4️⃣ Click OK → A login prompt appears.
5️⃣ Enter Domain Admin credentials:- Username:
mydomain.com\jane_admin - Password:
Domainserver123
6️⃣ Click OK → If successful, you’ll see a “Welcome to the mydomain.com domain” message.
7️⃣ Click OK → Restart CLIENT-1 to apply changes.
3️⃣ Verify CLIENT-1 in Active Directory
📌 After rebooting CLIENT-1, verify it appears in Active Directory Users and Computers (ADUC).
1️⃣ Log into DC-1 as mydomain.com\jane_admin.
2️⃣ Open Run (Win + R) → Type dsa.msc → Press Enter.
3️⃣ In the Computers container, look for CLIENT-1.
4️⃣ If CLIENT-1 is listed, it has successfully joined the domain. ✅
4️⃣ Organize CLIENT-1 in the _CLIENTS Organizational Unit (OU)
📌 Now, we’ll create an Organizational Unit (OU) for domain-joined client devices and move CLIENT-1 into it.
1️⃣ In ADUC, right-click the domain (mydomain.com) → Click New → Organizational Unit.
2️⃣ Name it _CLIENTS → Click OK.
3️⃣ Navigate to the Computers container, find CLIENT-1.
4️⃣ Drag CLIENT-1 into the _CLIENTS OU.
🎯 Summary
✅ Successfully joined CLIENT-1 to the Active Directory domain (mydomain.com).
✅ Verified CLIENT-1’s presence in ADUC.
✅ Created _CLIENTS OU and moved CLIENT-1 into it for organization.
🎉 CLIENT-1 is now officially part of the domain!
🖥️ Setting Up Remote Desktop for Non-Admin Users on CLIENT-1
📌 By default, only administrators can access a system via Remote Desktop Protocol (RDP). To allow regular domain users to log in remotely, we need to modify Remote Desktop settings.
1️⃣ Enable Remote Desktop for Domain Users on CLIENT-1
1️⃣ Log into CLIENT-1 as mydomain.com\jane_admin.
2️⃣ Open Run (Win + R) → Type sysdm.cpl → Press Enter.
3️⃣ Click the Remote tab → Under Remote Desktop, click Select Users.
4️⃣ Click Add → Type Domain Users → Click Check Names → Click OK.
5️⃣ Apply changes and close System Properties.
✅ Now, any domain user can log into CLIENT-1 via RDP.
📌 Best Practice: Normally, you’d configure this through Group Policy (GPO) for multiple systems at once—this could be a future lab!
👥 Bulk Create Active Directory Users via PowerShell
📌 Instead of manually creating users, we’ll automate user creation using a PowerShell script that generates random names and adds users to the _EMPLOYEES OU.
2️⃣ Run PowerShell Script to Generate Users
1️⃣ Log into DC-1 as mydomain.com\jane_admin.
2️⃣ Open Run (Win + R) → Type powershell_ise → Press Enter.
3️⃣ Verify User Accounts in Active Directory (ADUC)
1️⃣ Open Active Directory Users and Computers (ADUC) (dsa.msc).
2️⃣ Expand the _EMPLOYEES OU.
3️⃣ Observe the newly created user accounts.
✅ We now have multiple users in Active Directory!
4️⃣ Test Logging into CLIENT-1 with a Newly Created User
📌 Now, let’s simulate an end-user login using one of the newly created accounts.
1️⃣ Pick the user Carin Mev from the _EMPLOYEES OU.
2️⃣ Note the username & password (from the script output).
3️⃣ On CLIENT-1, log out of jane_admin.
4️⃣ Use Remote Desktop Connection (RDP) to log in as the new domain user:
- Username:
mydomain.com\carin.mev - Password: Password1
✅ Successful login confirms that CLIENT-1 is properly joined to the domain, and Active Directory authentication is working! 🎉
🎯 Conclusion: Deploying an Active Directory Domain on Azure Virtual Machines
This project successfully demonstrated the deployment, configuration, and administration of an Active Directory (AD) environment using Microsoft Azure Virtual Machines (VMs). By implementing Active Directory Domain Services (AD DS), we established centralized authentication, user management, and group policies, simulating a real-world enterprise IT infrastructure.
✅ Key Accomplishments:
🔹 🚀 Azure Virtual Machine Deployment:
- Provisioned and configured DC-1 (Windows Server 2022) as the Domain Controller.
- Deployed CLIENT-1 (Windows 10) as a domain-joined workstation.
🔹 🌐 Network & Domain Setup:
- Configured Azure Virtual Networks (VNet) to ensure seamless communication between VMs.
- Assigned static private IP to DC-1 for reliable DNS resolution.
- Verified CLIENT-1 successfully joined the domain (mydomain.com).
🔹 🔐 Active Directory & User Management:
- Created Organizational Units (OUs) _EMPLOYEES, _ADMINS, and _CLIENTS for structured user and device management.
- Created domain administrator account (jane_admin) and assigned Domain Admin privileges.
- Bulk-created multiple domain users using a PowerShell script.
🔹 🖥️ Remote Access & Security:
- Enabled Remote Desktop Protocol (RDP) for non-administrative users to simulate remote workforce scenarios.
- Verified Active Directory authentication by successfully logging in as a newly created user (
carin.mev).
🎯 Final Thoughts & Real-World Applications
This project serves as an excellent foundational exercise for IT professionals looking to strengthen their skills in systems administration, cloud infrastructure, and enterprise network management. The ability to deploy, configure, and manage Active Directory in an Azure environment is highly valuable for roles in:
✅ IT Support & Help Desk – Managing user authentication, domain access, and troubleshooting.
✅ System Administration – Implementing AD, enforcing Group Policies, and securing enterprise environments.
✅ Cloud & Network Engineering – Configuring network settings, virtual machines, and remote access solutions.
🚀 Next Steps: Future enhancements could include:
🔹 Implementing Group Policy Objects (GPOs) for advanced security policies.
🔹 Configuring File Sharing & Network Drives within Active Directory.
🔹 Deploying Multi-Factor Authentication (MFA) & Conditional Access Policies for enhanced security.