This guide will show you how to deploy two headless Windows Server 2016 domain controllers in a new environment. This guide (first of the series) assumes you are standing up a hybrid Microsoft environment within a VMware homelab.

First we need to get a few things out of the way:

• 2 Windows 2016 virtual machines with 2 vCPUs and 4-8GB RAM
• Make sure you are using VMXNET3 network adapters
• Install latest VMware Tools
• Apply latest OS updates
• Change the HOSTNAME of the VMs (XXX-DC01 and XXX-DC02)
• Change the host to use static TCP/IP and DNS

If you are deploying domain controllers from a base Windows 2016 VM template, do not forget to generate a new SID using: C:\Windows\System32\Sysprep\sysprep.exe

We are going to deploy two domain controllers at a bare minimum, the domain name is going to be called corp.fixmytech.ca and our network will be 192.168.1.1/25.

The domain name you choose should be resolvable from the internet, so choose a domain that you have registered with a domain registrar and that of which you have full control of.

Some common candidates for xxx.fixmytech.ca are:

• internal.fixmytech.ca
• ad.fixmytech.ca
• corp.fixmytech.ca

One common 3 letter server prefix used for the internal server names is the IATA 3-Letter Codes of the closest airport.

To do most of the basic first steps you can use sconfig (shell GUI) or issue the following:

Set a static DNS and TCP/IP:

Get-NetAdapter | Get-Member
Set-NetIPInterface -InterfaceAlias "PROD Network" -DHCP Disabled -PassThru

New-NetIPAddress ` 
     -AddressFamily IPv4 ` 
     -InterfaceAlias "PROD Network" ` 
     -IPAddress 192.168.1.2 ` 
     -PrefixLength 25 ` 
     -DefaultGateway 192.168.1.1

Set-DnsClientServerAddress -InterfaceAlias "10 Network" -ServerAddresses 192.168.10.2

Rename the computer and reboot:

Rename-Computer -NewName FMT-DC01 -Restart -Force -PassThru

Create the forest:

Add-WindowsFeature AD-Domain-Services
Import-Module ADDSDeployment 
Install-ADDSForest ` 
  -DomainName corp.fixmytech.ca `
  -DomainNetbiosName CORP `
  -DomainMode 7 `
  -ForestMode 7 `
  -InstallDns:$true `
  -LogPath "C:\Windows\NTDS" `
  -SysvolPath "C:\Windows\SYSVOL" `
  -DatabasePath "C:\Windows\NTDS"`
  -NoRebootOnCompletion:$false `
  -CreateDnsDelegation = $false `
  -Force:$true `
  -Verbose

Deploy your second domain controller using:

Add-WindowsFeature AD-Domain-Services 
Import-Module ADDSDeployment
Install-ADDSDomainController `
  -NoGlobalCatalog:$false `
  -CreateDnsDelegation:$false `
  -Credential (Get-Credential) `
  -CriticalReplicationOnly:$false `
  -DatabasePath "C:\Windows\NTDS" `
  -DomainName "corp.fixmytech.ca" `
  -InstallDns:$true `
  -LogPath "C:\Windows\NTDS" `
  -NoRebootOnCompletion:$false `
  -SiteName "Default-First-Site-Name" `
  -SysvolPath "C:\Windows\SYSVOL" `
  -Force:$true

Do not forget to stand up a Windows 10 jump server with RSAT tools installed so that you still have GUI access to most AD MMC snap-ins.

Next logical steps are to deploy DHCP, basic Group Policy Objects, Internal PKI and ADFS.