PowerShell 3.0 and Active Directory

Windows Server 2012 can also be managed in PowerShell. Microsoft has integrated some new commandlets for this, which can be seen in Windows Server 2012 after the appropriate module has been loaded in PowerShell 3.0 with Import-Module ADDSDeployment. The commands can then be called up with

get-command *adds*

The Install-ADDSDomainController commandlet installs a new domain controller in an existing domain (Figure 3). Install-ADDSDomain installs a new domain and Install-ADDSForest a new forest. The commandlet Uninstall-ADDSDomainController can demote a domain controller. The commandlets ask for all necessary options and restart the server. Further configurations (e.g., for DNS or global catalog servers) then follow without the wizard. New commandlets for Active Directory include:

Test-ADDSDomainControllerInstallation
Test-ADDSDomainControllerUnInstallation
Test-ADDSDomainInstallation
Test-ADDSForestInstallation
Test-ADDSReadOnlyDomainControllerUnInstallation

Figure 3: Active Directory can be installed in Windows Server 2012 via the PowerShell.

Migration

If you want to update a domain controller to Windows Server 2012, you must first extend the schema of the forest. For this, execute the

adprep /forestprep

command on a domain controller. The tool is found in the support\adprep directory on the Windows Server 2012 DVD. To extend the schema, you must first confirm the extension with c . However, these measures should not be performed in production environments because the changes cannot be undone. After the schema has been updated, typing

adprep /domainprep

updates the individual domains.

Newly installed domain controllers can be added easily to the Active Directory. Member servers with Windows Server 2012 can also be added to existing domains, if domain controllers with Windows Server 2003/2003 R2/2008/2008 R2 are present. The operations master roles from migrations of previous versions can be transferred to the new domain controller with Windows Server 2012.

New DNS System

Because the servers are so closely dovetailed with each other, an improvement of the DNS system is also necessary (e.g., for security aspects). Microsoft had already introduced DNSSEC with Windows Server 2008 R2 to protect zones and entries. The grouping of DNS servers in the Server Manager of Windows Server 2012 makes managing them much more efficient.

In Windows Server 2012, zones can be signed digitally online. DNSSEC can be integrated completely into the Active Directory in the new version and includes the ability to activate dynamic updates for secured zones. Windows Server 2012 supports official standards, such as NSEC3 and RSA/SHA-2.

Support for DNSSEC on read-only domain controllers (RODCs) is also new. If an RODC with Windows Server 2012 finds a signed DNS zone, it automatically makes a secondary copy of the zone and transmits the data of the DNSSEC-secured zone. The advantage is that offices with RODCs can resolve secured data, but the signature and data of the zone are not endangered.

DNSSEC can be set up via the context menu of a zone. It is no longer necessary to complete a complicated configuration at the command line or take zones offline. Zone signing is done with the help of a wizard that allows manual signing, signature updates, and signature creation on the basis of automatic settings.

Windows Server 2012 also makes it possible to replicate signed zones on other DNS servers on the network. A further innovation is the IP Address Management (IPAM) server, which monitors and centrally manages the DHCP and DNS services. Installation is done as a server role.