[Yandex Cloud documentation](../../index.md) > [Tutorials](../index.md) > [Microsoft products in Yandex Cloud](index.md) > Deploying Active Directory # Deploying Active Directory {% note warning %} In Yandex Cloud, you can only use Microsoft products with your own licenses and on dedicated hosts. For more information, see [Using personal licenses for Microsoft products](../../microsoft/byol.md). {% endnote %} The tutorial provides an example of how to deploy Active Directory in Yandex Cloud. To deploy the Active Directory infrastructure: 1. [Get your cloud ready](#before-you-begin). 1. [Create a cloud network and subnets](#create-network). 1. [Create a script to manage a local administrator account](#admin-script). 1. [Create a virtual machine for Active Directory](#ad-vm). 1. [Create a VM for a bastion host](#jump-server-vm). 1. [Install and configure Active Directory](#install-ad). 1. [Configure the second domain controller](#install-ad-2). 1. [Test Active Directory](#test-ad). If you no longer need the infrastructure, [delete all the resources it uses](#clear-out). ## Get your cloud ready {#before-you-begin} Sign up for Yandex Cloud and create a [billing account](../../billing/concepts/billing-account.md): 1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or create a new account. 1. On the **[Yandex Cloud Billing](https://center.yandex.cloud/billing/accounts)** page, make sure you have a billing account linked and it has the `ACTIVE` or `TRIAL_ACTIVE` [status](../../billing/concepts/billing-account-statuses.md). If you do not have a billing account, [create one](../../billing/quickstart/index.md) and [link](../../billing/operations/pin-cloud.md) a cloud to it. If you have an active billing account, you can create or select a [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) for your infrastructure on the [cloud page](https://console.yandex.cloud/cloud). [Learn more about clouds and folders here](../../resource-manager/concepts/resources-hierarchy.md). {% note info %} Make sure that the billing account contains user details [required to meet the Microsoft licensing policy requirements](../../microsoft/check-user-data.md). You can launch the product only if you have these details. {% endnote %} ### Required paid resources {#paid-resources} The Active Directory installation cost includes: * Fee for continuously running [VMs](../../compute/concepts/vm.md) (see [Yandex Compute Cloud pricing](../../compute/pricing.md)). * Fee for using dynamic or static [public IP addresses](../../vpc/concepts/address.md#public-addresses) (see [Yandex Virtual Private Cloud pricing](../../vpc/pricing.md)). * Fee for outbound traffic from Yandex Cloud to the internet (see [Compute Cloud pricing](../../compute/pricing.md)). ## Create a cloud network and subnets {#create-network} Create a [cloud network](../../vpc/concepts/network.md#network) named `ad-network` with [subnets](../../vpc/concepts/network.md#subnet) in all [availability zones](../../overview/concepts/geo-scope.md) where your VMs will be located. 1. Create a cloud network: {% list tabs group=instructions %} - Management console {#console} To create a cloud network: 1. Open the **Virtual Private Cloud** section of the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) where you want to create a cloud network. 1. Click **Create network**. 1. Specify `ad-network` as the network name. 1. Click **Create network**. - CLI {#cli} If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install). The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id ` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions. To create a cloud network, run this command: ```bash yc vpc network create --name ad-network ``` {% endlist %} 1. Create three subnets in `ad-network`: {% list tabs group=instructions %} - Management console {#console} To create a subnet: 1. Open the **Virtual Private Cloud** section in the folder where you want to create a subnet. 1. Click the name of your cloud network. 1. Click **Add subnet**. 1. Specify `ad-subnet-a` as the name and select the `ru-central1-a` availability zone from the drop-down list. 1. Enter the subnet CIDR: IP address and subnet mask `10.1.0.0/16`. 1. Click **Create subnet**. Repeat these steps for two more subnets: * Name: `ad-subnet-b`: Availability zone: `ru-central1-b`. CIDR: `10.2.0.0/16`. * Name: `ad-subnet-d`. Availability zone: `ru-central1-d`. CIDR: `10.3.0.0/16`. - CLI {#cli} To create subnets, run these commands: ```bash yc vpc subnet create \ --name ad-subnet-a \ --zone ru-central1-a \ --network-name ad-network \ --range 10.1.0.0/16 yc vpc subnet create \ --name ad-subnet-b \ --zone ru-central1-b \ --network-name ad-network \ --range 10.2.0.0/16 yc vpc subnet create \ --name ad-subnet-d \ --zone ru-central1-d \ --network-name ad-network \ --range 10.3.0.0/16 ``` {% endlist %} ## Create a script to manage a local administrator account {#admin-script} When creating a VM via the CLI, you need to set a password for a local administrator account. To do this, in the root folder of the command line, create a file named `setpass` without an extension. Copy the script to the file and set your password: ```powershell #ps1 Get-LocalUser | Where-Object SID -like *-500 | Set-LocalUser -Password (ConvertTo-SecureString "" -AsPlainText -Force) ``` The password must meet the [complexity requirements](https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements#reference). You can read more about the best practices for securing Active Directory on the [MS official website](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory). ## Create a VM for Active Directory {#ad-vm} Create two VMs for Active Directory domain controllers. These VMs will not have internet access. {% list tabs group=instructions %} - Management console {#console} 1. On the folder dashboard in the [management console](https://console.yandex.cloud), click **Create resource** and select `Virtual machine instance`. 1. Under **Boot disk image**: * Navigate to the **Custom** tab. * Click **Select** and select **Create** in the window that opens. * In the **Contents** field, select `Image` and then select the **Windows Server 2022 Datacenter** image from the list below. For more information on how to upload your own image for Microsoft products, see [Importing a custom image](../../microsoft/byol.md#how-to-import). * Optionally, enable **Additional** in the **Delete along with the virtual machine** field if you need this disk automatically deleted when deleting the VM. * Click **Add disk**. 1. Under **Location**, select the `ru-central1-a` availability zone. 1. Under **Disks and file storages**, enter `50 GB` as your boot [disk](../../compute/concepts/disk.md) size. 1. Under **Computing resources**, navigate to the `Custom` tab and specify the [platform](../../compute/concepts/vm-platforms.md), number of vCPUs, and RAM size: * **Platform**: `Intel Ice Lake`. * **vCPU**: `4`. * **Guaranteed vCPU performance**: `100%`. * **RAM**: `8 GB`. 1. Under **Network settings**, specify: * **Subnet**: `ad-subnet-a`. * **Public IP address**: `No address`. * Expand the **Additional** section; in the **Internal IPv4 address** field, select `Manual`. * In the input field that appears, enter `10.1.0.3`. 1. Under **General information**, specify the VM name: `ad-vm-a`. 1. Click **Create VM**. Wait for the VM status to change to `Running` and reset the password: 1. Select the VM. 1. Click **Reset password**. 1. Specify the **Username** to reset the password for. If there is no user with that name on the VM, this user will be created with administrator access. 1. Click **Generate password**. 1. Save the **New password**. It will become unavailable once you close the window. Repeat the steps for the `ad-vm-b` VM in the `ru-central1-b` availability zone, connect it to the `ad-subnet-b` subnet, and manually specify the internal IP address: `10.2.0.3`. - CLI {#cli} ```bash yc compute instance create \ --name ad-vm-a \ --hostname ad-vm-a \ --memory 8 \ --cores 4 \ --zone ru-central1-a \ --network-interface subnet-name=ad-subnet-a,ipv4-address=10.1.0.3 \ --create-boot-disk image-folder-id=standard-images,image-family=windows-2022-dc-gvlk \ --metadata-from-file user-data=setpass yc compute instance create \ --name ad-vm-b \ --hostname ad-vm-b \ --memory 8 \ --cores 4 \ --zone ru-central1-b \ --network-interface subnet-name=ad-subnet-b,ipv4-address=10.2.0.3 \ --create-boot-disk image-folder-id=standard-images,image-family=windows-2022-dc-gvlk \ --metadata-from-file user-data=setpass ``` {% note info %} The commands [`yc compute instance create`](../../cli/cli-ref/compute/cli-ref/instance/create.md) | [`create-with-container`](../../cli/cli-ref/compute/cli-ref/instance/create-with-container.md) | [`update`](../../cli/cli-ref/compute/cli-ref/instance/update.md) | [`add-metadata`](../../cli/cli-ref/compute/cli-ref/instance/add-metadata.md) support substitution of environment variable values into VM metadata. When you execute a Yandex Cloud CLI command, these values, specified in the `user-data` key in `$` format, will be substituted into the VM metadata from the environment variables of the environment the command is executed in. To change such behavior, i.e. to provide a variable name to the VM metadata in `$` format rather than take the variable value from the CLI command runtime environment, use the two-dollar syntax, e.g., `$$`. For more information, see [Specifics of providing environment variables in metadata via the CLI](../../compute/concepts/metadata/sending-metadata.md#environment-variables). {% endnote %} {% endlist %} ## Create a VM for a bastion host {#jump-server-vm} A file server with internet access is used to configure VMs with Active Directory. {% list tabs group=instructions %} - Management console {#console} 1. On the folder dashboard in the [management console](https://console.yandex.cloud), click **Create resource** and select `Virtual machine instance`. 1. Under **Boot disk image**: * Navigate to the **Custom** tab. * Click **Select** and select **Create** in the window that opens. * In the **Contents** field, select `Image` and then select the **Windows Server 2022 Datacenter** image from the list below. For more information on how to upload your own image for Microsoft products, see [Importing a custom image](../../microsoft/byol.md#how-to-import). * Optionally, enable **Additional** in the **Delete along with the virtual machine** field if you need this disk automatically deleted when deleting the VM. * Click **Add disk**. 1. Under **Location**, select the `ru-central1-d` availability zone. 1. Under **Disks and file storages**, enter `50 GB` as your boot disk size. 1. Under **Computing resources**, navigate to the `Custom` tab and specify the required platform, number of vCPUs, and amount of RAM: * **Platform**: `Intel Ice Lake`. * **vCPU**: `2`. * **Guaranteed vCPU performance**: `100%`. * **RAM**: `4 GB`. 1. Under **Network settings**: * In the **Subnet** field, select `ad-subnet-d`. * In the **Public IP address** field, leave `Auto`. 1. Under **General information**, specify the VM name: `jump-server-vm`. 1. Click **Create VM**. Wait for the VM status to change to `Running` and reset the password: 1. Select the VM. 1. Click **Reset password**. 1. Specify the **Username** to reset the password for. If there is no user with that name on the VM, this user will be created with administrator access. 1. Click **Generate password**. 1. Save the **New password**. It will become unavailable once you close the window. - CLI {#cli} ```bash yc compute instance create \ --name jump-server-vm \ --hostname jump-server-vm \ --memory 4 \ --cores 2 \ --zone ru-central1-d \ --network-interface subnet-name=ad-subnet-d,nat-ip-version=ipv4 \ --create-boot-disk image-folder-id=standard-images,image-family=windows-2022-dc-gvlk \ --metadata-from-file user-data=setpass ``` {% endlist %} ## Install and configure Active Directory {#install-ad} Active Directory VMs do not have internet access. To configure them, use `jump-server-vm` through [RDP](https://en.wikipedia.org/wiki/Remote_Desktop_Protocol). 1. [Connect](../../compute/operations/vm-connect/rdp.md) to `jump-server-vm` through RDP. Use `Administrator` as your username and your password. 1. Run RDP and connect to `ad-vm-a` using its local IP address, the `Administrator` username and your password. 1. Run PowerShell and set a static IP address: ```powershell netsh interface ip set address "eth0" static 10.1.0.3 255.255.255.0 10.1.0.1 ``` 1. Assign Active Directory roles: ```powershell Install-WindowsFeature AD-Domain-Services -IncludeManagementTools ``` Result: ```text Success Restart Needed Exit Code Feature Result ------- -------------- --------- -------------- True No Success {Active Directory Domain Services, Group P... ``` 1. Create an Active Directory forest: ```powershell Install-ADDSForest -DomainName 'yantoso.net' -Force:$true ``` Next, enter the password and confirm it. Windows will restart automatically. Reconnect to `ad-vm-a` and launch PowerShell. 1. Rename the default site to `ru-central1-a`: ```powershell Get-ADReplicationSite 'Default-First-Site-Name' | Rename-ADObject -NewName 'ru-central1-a' ``` 1. Create two more sites for the other availability zones: ```powershell New-ADReplicationSite 'ru-central1-b' New-ADReplicationSite 'ru-central1-d' ``` 1. Create subnets and link them to the sites: ```powershell New-ADReplicationSubnet -Name '10.1.0.0/16' -Site 'ru-central1-a' New-ADReplicationSubnet -Name '10.2.0.0/16' -Site 'ru-central1-b' New-ADReplicationSubnet -Name '10.3.0.0/16' -Site 'ru-central1-d' ``` 1. Rename the site link and configure replication: ```powershell Get-ADReplicationSiteLink 'DEFAULTIPSITELINK' | ` Set-ADReplicationSiteLink -SitesIncluded @{Add='ru-central1-b'} -ReplicationFrequencyInMinutes 15 -PassThru | ` Set-ADObject -Replace @{options = $($_.options -bor 1)} -PassThru | ` Rename-ADObject -NewName 'ru-central1' ``` 1. Set the DNS server forwarder: ```powershell Set-DnsServerForwarder '10.1.0.2' ``` 1. Configure the DNS client: ```powershell Get-NetAdapter | Set-DnsClientServerAddress -ServerAddresses "10.2.0.3,127.0.0.1" ``` ## Configure the second domain controller {#install-ad-2} 1. Connect to `jump-server-vm` through RDP. 1. Using RDP, connect to `ad-vm-b` using its local IP address, the `Administrator` username, and your password. 1. Assign Active Directory roles: ```powershell Install-WindowsFeature AD-Domain-Services -IncludeManagementTools ``` Result: ```text Success Restart Needed Exit Code Feature Result ------- -------------- --------- -------------- True No NoChangeNeeded {} ``` 1. Configure the DNS client: ```powershell Get-NetAdapter | Set-DnsClientServerAddress -ServerAddresses "10.1.0.3,127.0.0.1" ``` 1. Configure a static IP address: ```powershell netsh interface ip set address "eth0" static 10.2.0.3 255.255.255.0 10.2.0.1 ``` 1. Add the controller to the domain: ```powershell Install-ADDSDomainController ` -Credential (Get-Credential "yantoso\Administrator") ` -DomainName 'yantoso.net' ` -Force:$true ``` Next, enter the password and confirm it. Windows will restart automatically. Reconnect to `ad-vm-b` and launch PowerShell. 1. Set the DNS server forwarder: ```powershell Set-DnsServerForwarder '10.2.0.2' ``` ## Test Active Directory {#test-ad} 1. Connect to `jump-server-vm` through RDP. 1. Using RDP, connect to `ad-vm-b` using its local IP address, the `Administrator` username, and your password. Launch PowerShell. 1. Create a test user: ```powershell New-ADUser testUser ``` 1. Make sure the user is present on both servers: ```powershell Get-ADUser testUser -Server 10.1.0.3 Get-ADUser testUser -Server 10.2.0.3 ``` The results of both commands must be the same: ```text DistinguishedName : CN=testUser,CN=Users,DC=yantoso,DC=net Enabled : False GivenName : Name : testUser ObjectClass : user ObjectGUID : 7202f41a-(...)-2d168ecd5271 SamAccountName : testUser SID : S-1-5-21-(...)-1105 Surname : UserPrincipalName : ``` ## How to delete the resources you created {#clear-out} To stop paying for the deployed servers, delete all the [VMs](../../compute/operations/vm-control/vm-delete.md) you created.