Windows Server 2016 and 2012 R2 – Setup Secure Load Balancing RODC Video Tutorial

Windows Server 2016 and 2012 R2 - Setup Secure Load Balancing RODC

  In a corporate setting it is often desirable to separate sections of our network based on departments or region or duties etc. Using a Read Only Domain Controller (RODC) is ideal as it gives us the ability to on cache certain groups of users and computers and also enable load balancing as there will be additional load balancing Active Directory servers with their own DNS servers. This video shows us how to setup an RODC on Windows Server 2016 and 2012 R2.

Please watch the video to see the above (to translate, click the Subtitle box in the YouTube video and then click Settings and language, as in this picture):

subtitles

 
Transcript (machine generated so it contains errors)
 
1. 00:00:00:00 / 00:00:05:94 - hello and welcome to this video what
2. 00:00:04:01 / 00:00:10:32 - we're doing in this video is setting up
3. 00:00:05:94 / 00:00:14:07 - basically read only domain controller in
4. 00:00:10:32 / 00:00:17:67 - a remote office or for remote users
5. 00:00:14:07 / 00:00:20:89 - okay now the benefits of this for
6. 00:00:17:67 / 00:00:24:75 - security reasons it's only read-only so
7. 00:00:20:89 / 00:00:28:55 - it's only unique directional caching so
8. 00:00:24:75 / 00:00:32:34 - basically your main domain controller
9. 00:00:28:55 / 00:00:35:69 - will pass its information on to this
10. 00:00:32:34 / 00:00:38:39 - domain controller and only certain parts
11. 00:00:35:70 / 00:00:41:12 - of it that you can restrict okay to you
12. 00:00:38:39 / 00:00:43:28 - can limit it so if someone was to gain
13. 00:00:41:12 / 00:00:46:85 - access to this server this remote server
14. 00:00:43:28 / 00:00:51:53 - okay they'll only get certain parts of
15. 00:00:46:85 / 00:00:54:17 - your domain details and not to much also
16. 00:00:51:53 / 00:00:58:46 - passwords are not cached you'll also
17. 00:00:54:17 / 00:01:02:15 - have the benefits of basically them not
18. 00:00:58:46 / 00:01:06:68 - being able to write back to your main
19. 00:01:02:15 / 00:01:09:81 - Active Directory domain controller okay
20. 00:01:06:68 / 00:01:13:28 - so let's get on with it and show you how
21. 00:01:09:81 / 00:01:15:86 - to set this up and one more benefit is
22. 00:01:13:29 / 00:01:17:52 - also you can use it as load balancing
23. 00:01:15:86 / 00:01:19:29 - because you're having a DNS server over
24. 00:01:17:51 / 00:01:22:17 - here you're also having Active Directory
25. 00:01:19:29 / 00:01:24:03 - over here for the users that are coming
26. 00:01:22:17 / 00:01:27:68 - through this channel they're not gonna
27. 00:01:24:03 / 00:01:31:68 - be taking up shall we say too much usage
28. 00:01:27:68 / 00:01:35:03 - on your other domain controllers so just
29. 00:01:31:68 / 00:01:38:54 - also having that benefit so let's crack
30. 00:01:35:04 / 00:01:42:03 - on with it okay basically what we need
31. 00:01:38:54 / 00:01:45:45 - to do is just open up server manager go
32. 00:01:42:03 / 00:01:47:39 - there then add roles and features and
33. 00:01:45:45 / 00:01:49:95 - click Next Next Next until you get there
34. 00:01:47:39 / 00:01:55:34 - and in roles click Active Directory
35. 00:01:49:95 / 00:01:59:60 - domain services click Next click Next
36. 00:01:55:34 / 00:02:03:71 - well we'll just give DNS as well might
37. 00:01:59:60 / 00:02:09:84 - as well give DNS yeah ok
38. 00:02:03:71 / 00:02:13:06 - so that also reduces load of our main
39. 00:02:09:84 / 00:02:22:62 - DNS server so there we go
40. 00:02:13:06 / 00:02:24:40 - next and then install okay and once it's
41. 00:02:22:62 / 00:02:28:47 - installed you basically need to promote
42. 00:02:24:40 / 00:02:32:68 - it to a domain controller it'll do a
43. 00:02:28:47 / 00:02:35:34 - quick little check and what we're doing
44. 00:02:32:68 / 00:02:36:96 - is liking the first option so adding a
45. 00:02:35:34 / 00:02:39:39 - domain controller to an existing domain
46. 00:02:36:96 / 00:02:41:19 - if you are setting up your main first
47. 00:02:39:40 / 00:02:43:98 - domain controller it would be a new
48. 00:02:41:19 / 00:02:51:28 - forest but we're already using our to
49. 00:02:43:98 / 00:02:55:98 - make so click Next and then it's a read
50. 00:02:51:28 / 00:02:58:00 - only domain controller okay yeah we can
51. 00:02:55:98 / 00:03:04:95 - stick with that we need to give the
52. 00:02:58:00 / 00:03:08:21 - password that is used for restoring it
53. 00:03:04:94 / 00:03:08:21 - there we go
54. 00:03:10:76 / 00:03:24:04 - just for simplicity sake okay
55. 00:03:19:56 / 00:03:30:81 - now this group ok would literally push
56. 00:03:24:03 / 00:03:34:71 - most of your main active directories
57. 00:03:30:81 / 00:03:37:00 - users computers all that data over here
58. 00:03:34:71 / 00:03:40:53 - if you want to do that then you keep
59. 00:03:37:00 / 00:03:44:10 - this but for security reasons we want to
60. 00:03:40:53 / 00:03:48:28 - restrict it to only certain group or
61. 00:03:44:10 / 00:03:54:42 - groups so we're gonna add we've created
62. 00:03:48:28 / 00:03:54:41 - one okay on our main server
63. 00:03:57:47 / 00:04:05:04 - remote user group sorry my mistake there
64. 00:04:00:48 / 00:04:07:50 - we go alright so we have that and we're
65. 00:04:05:04 / 00:04:09:63 - gonna get rid of this one so now we've
66. 00:04:07:50 / 00:04:11:97 - restricted it only to this so that's
67. 00:04:09:63 / 00:04:14:65 - making us a little bit more secure well
68. 00:04:11:97 / 00:04:20:58 - actually a lot more secure so we go
69. 00:04:14:65 / 00:04:23:28 - forward ok and if for example this
70. 00:04:20:58 / 00:04:26:52 - office was in our location where they
71. 00:04:23:28 / 00:04:29:05 - had very slow internet access
72. 00:04:26:52 / 00:04:31:35 - and you had a huge active directory that
73. 00:04:29:05 / 00:04:34:36 - needed to be kinda like moved over to
74. 00:04:31:36 / 00:04:36:75 - this one when this is set up okay what
75. 00:04:34:36 / 00:04:39:97 - you could have done was written and
76. 00:04:36:75 / 00:04:43:06 - installed media on your main server and
77. 00:04:39:97 / 00:04:45:43 - then I don't know posted courier the
78. 00:04:43:06 / 00:04:49:18 - flash drive whatever to this office okay
79. 00:04:45:43 / 00:04:51:57 - but we're pretty good with our
80. 00:04:49:18 / 00:04:52:00 - networking over here so everything's
81. 00:04:51:57 / 00:04:53:52 - good
82. 00:04:52:00 / 00:04:56:82 - okay replicate from any domain
83. 00:04:53:52 / 00:04:58:91 - controller and we're gonna choose a
84. 00:04:56:82 / 00:05:05:07 - specific domain controller that we want
85. 00:04:58:91 / 00:05:10:94 - let's go next click Next and then this
86. 00:05:05:07 / 00:05:13:52 - will just verify everything's good II oh
87. 00:05:10:94 / 00:05:16:41 - happy okay
88. 00:05:13:52 / 00:05:18:47 - let's just go don't worry about these
89. 00:05:16:41 / 00:05:18:47 - things
90. 00:05:18:68 / 00:05:31:08 - let's go next and once that's done it's
91. 00:05:28:02 / 00:05:33:72 - basically gonna restart okay and after
92. 00:05:31:08 / 00:05:37:37 - the restart basically you have Active
93. 00:05:33:72 / 00:05:39:84 - Directory with DNS and you have this
94. 00:05:37:37 / 00:05:42:93 - system which is actually quite nice now
95. 00:05:39:85 / 00:05:44:86 - so our remote users will basically our
96. 00:05:42:93 / 00:05:46:75 - group and all the users within that
97. 00:05:44:86 / 00:05:48:97 - remote users group that we had set up
98. 00:05:46:75 / 00:05:51:63 - will basically be coming through on this
99. 00:05:48:97 / 00:05:55:00 - machine using this machine's DNS server
100. 00:05:51:63 / 00:05:59:11 - and for load balancing that's taking a
101. 00:05:55:00 / 00:06:03:85 - big load off our other server and there
102. 00:05:59:11 / 00:06:08:12 - you go it's all set up thank you for
103. 00:06:03:85 / 00:06:08:12 - watching hopefully this video has helped
Visit our YouTube channel: https://www.youtube.com/channel/UCFj1BHYIUYfPWPb1Xn5qFIg