Sandbox Active Directory in VMware Workstation

This is to create a isolated sandbox where network, storage and patching can be isolated to the given sandbox. The idea is also to be able to create several independent sandboxes for different purposes. Also the idea is to be able to create sandboxes of different complexity like a single database installation to a full environment in a sandbox.
I am sure this could also be accomplished with Microsoft Hyper-V or another virtualisation platform. But I am currently using VMware and then also in this case.

This start as a very simple description of the process with some central configurations. Later I intent to expand this to a scripted installation. The final goal is to be able to provide a complete AD forrest automatic.

Clone Windows Server

I have a stand-alone Windows Server that I clone in the current state where it is shut down (cold) and the clone is a full clone opposite to a linked clone. The installation and configuration is described in the blog post "Sandbox Windows Server in VMware Workstation".

Generalize Windows with sysprep

Microsoft Docs: "Sysprep (System Preparation) Overview"

Prepare virtual network

• Custom network (VMnet13, host-only)
• DHCP disabled
• Subnet IP: 192.168.42.0
• Subnet mask: 255.255.255.0

Prepare server

Network profile:

• IP : 192.168.42.42
• Subnet : 255.255.255.0
• Preferred DNS : 192.168.42.42 (this host)
• Alternate DNS : 192.168.42.1 (the vmnet)
• Default gateway: None (host-only)

Steps to prepare the server:

1. Rename computer, e.g. "DC00".
• Start PowerShell as administrator.
  Rename-Computer -NewName 'DC00' -Restart
2. Danish keyboard - as a Dane I usually end up with a Danish keyboard.
3. Windows location: UK to set for UTC time. This is to avoid issues with daylight savings and other local tricks.
4. English UK ISO-8601'ish date time format.
5. Windows SmartScreen enabled.
6. Set password on Administrator user and rename user, e.g. "Ragnar". Password never expires.
7. Personal administrator user, e.g. "SuperNiels". Password never expires.
8. vmxnet3 Ethernet Adapter:
• Do not allow computer to turn off device to save power.
• See the post "vmxnet3 network adapter" about vmxnet paravirtualized network adapter.
• Remove Ethernet0 after vmxnet3 configuration.
• Rename adapter, e.g. to "Ethernet42".
9. Remove old network adapter. Show hidden devices in Device Manager and remove Intel Gigabit Network Connection.
10. Static network definition; IP and DNS. This should be done after changing the ethernet adapter as the configuration is assigned the adapter.
11. Print Spooler service stopped and disabled
• Start PowerShell as administrator.
  Stop-Service -Name 'spooler'
Set-Service -Name 'spooler' -StartupType 'Disabled'
12. Activate Windows Server. This can be done offline as described in the post "Activate Windows Server offline". Or you can temporary change virtual network to a network with NAT to the internet.

Also you might want to consider to disable the screensaver and keeping the screen on always.

Configure Domain Controller

Domain: sandbox.lan

1. Add Windows Server roles: Active Directory Domain Services (AD DS) and DNS Server. Both with all features and tools.
2. Promote server to Domain Controller (dcpromo) in a new forrest.
3. Specify domain controller capabilities; DNS server and Global Catalog on the domain "sandbox.lan".
4. Enter password for DSRM.
5. Do not delegate DNS.
6. Accept the NetBIOS name "SANDBOX".
7. Accept the default folders. If you are installing a DC in Production this is a configuration to consider.

The generated script can be viewd, but it is actually only one CmdLet call and because of the limited coverage I find the "script" rather incomplete.
Import-Module ADDSDeployment
Install-ADDSForest -CreateDnsDelegation:$false -DatabasePath "C:\Windows\NTDS" -DomainMode "WinThreshold" -DomainName "sandbox.lan" -DomainNetbiosName "SANDBOX" -ForestMode "WinThreshold" -InstallDns:$true -LogPath "C:\Windows\NTDS" -NoRebootOnCompletion:$false -SysvolPath "C:\Windows\SYSVOL" -Force:$true

Review the validation and start installation of AD DS.
When the installation of AD DS in complete you will be logged of and the server will be restarted.

Verify Domain Controller

The Server Manager now also shows the items "AD DS" and "DNS" in the menu to the left.
I the System window full computer name is now "DC00.sandbox.lan". Also the workgroup field is now a domain field where the domain name "sandbox.lan" is shown.

Patch Windows Server offline

1. Get latest cumulative from Microsoft Update
2. Copy installation set to the virtual server
3. Run installation on the virtual server as administrator

History

2023-09-21  Creation of VM migrated to SQLAdmin blog post.

2018-12-28  Post migrated to SQLAdmin blog.
2018-04-30  Post released on AzureAdmin blog.

Test-Computer

I am working on an automated SQL Server installation, where we use Managed Serviece Accounts (MSA) as SQL Server service account. To create and configure a MSA some PowerShell CmdLets are given by Microsoft, but there are several steps each with it own CmdLets.
We are creating MSAs for a given computer that is used as SQL Server server, and we want to absolutely sure that the computer exists by a given name in Active Directory (AD)and DNS. That also includes that the Fully Qualified Domain Name (FQDN) is correct.
To do this check I have created a function that checks both AD and DNS. The function is constructed to a specific script, and you should probably alter something to make it suit your needs.

function Test-Computer {
[CmdletBinding()]
Param(
  [Parameter(Mandatory=$true, HelpMessage='Enter name of server. Use Fully Qualified Name (FQN), e.g. "SANDBOX.sqladmin.lan"')]
  [String]$ServerName
)

[String]$ComputerName = $ServerName.Split('.')[0]

"{0:s}Z Testing if the computer '$ComputerName' exists in DNS..." -f $([System.DateTime]::UtcNow) | Write-Verbose
try {
  [System.Net.IPHostEntry]$IpHost = [System.Net.Dns]::GetHostByName($ComputerName)
}
catch [System.Management.Automation.MethodInvocationException] {
  "'$Computername' does not exist in DNS as FQDN!"
  return $false
}
"{0:s}Z Testing if the FQDN of '$ServerName'..." -f $([System.DateTime]::UtcNow) | Write-Verbose
if ($IpHost.HostName -ieq $ServerName) {
  "{0:s}Z FQDN '$ServerName' is OK." -f $([System.DateTime]::UtcNow) | Write-Verbose
}
else {
  "The computer name '$ServerName' does not match the FQDN '$($IpHost.HostName)'." | Write-Error
  return $false
}

"{0:s}Z Testing if the computer '$ComputerName' exists in Active Directory..." -f $([System.DateTime]::UtcNow) | Write-Verbose
try {
  [Microsoft.ActiveDirectory.Management.ADComputer]$Computer = $null
  $Computer = Get-ADComputer -Identity $ComputerName
}
catch [Microsoft.ActiveDirectory.Management.ADIdentityNotFoundException] {
  $ComputerError = $Error[0]
}
if ($Computer) {
  "{0:s}Z The computer '$ServerName' exists in Active Directory." -f $([System.DateTime]::UtcNow) | Write-Verbose
  return $true
}
else {
  "The computer '$ServerName' does not exist in Active Directory." | Write-Error
  return $false
}

} # Test-Computer()