Install Domain Controller VM in Azure For Existing Active Directory

This post is to summarize the steps to install additional Domain controller in an Azure Virtual machine for your existing on-prem Active directory.

Diagram

Draw.io diagram:

Prerequisites

1. An Azure AD tenant with an active subscription.
2. A Virtual Network in Azure that doesn’t overlap with your on-premises network.
3. A continuous line of sight between your on-premises domain controller and Microsoft Azure (Azure VPN Gateway, ExpressRoute or an NVA). For Site-2-Site VPN between On-Prem VPN Gateway and Azure VPN Gateway, here are some documents using ZyWALL devices

• Multiple On-premises ZyWALL connect IPSec VPN to Azure 

• How to Configure Route-based IPsec VPN to Azure

   (VTI over IKEv2/IPSec)
•  

  How to Configure Route-based IPsec VPN to Azure 

  (BGP over IKEv2/IPSec)

Test Your On-Premises Domain Controller

Before deploying an extra domain controller it’s wise to test the health of the current situation. Below are some checks you can do (don’t forget about DNS!). Existing problems must be fixed before continuing.

• Analyse your Active Directory and DNS Logs.

• Test your domain controller health with dcdiag /s:dcName

• Test DNS with dcdiag /s:dcName /test:dns

Deploy A Virtual Machine

1. Navigate to https://portal.azure.com and sign-in with a user that has sufficient permissions.
2. Create a new Windows Server resource. I Recommend using Windows Server 2022 if possible.
3. Enter al basic information and don’t forget about the availability options. Don’t use a spot VM to save costs – a domain controller should be always online.

When deploying multiple domain controllers in Azure, each of them should be in a different availability zone or in the same availability set.

By default, allow selected ports is enabled to alow RDP (3389). For safety reasons, you should set this option to none. If required, a network security group can be attached to the subnet or vm afterwards to block certain ports. I Recommend attaching NSG’s to subnets.

4. Click Next to configure vm disks.

A Single VM without premium SSD’s has an SLA of 99.95%. A Single VM with premium SSD’s (all disks) has an SLA of 99.99%. I Recommend using premium disks for your domain controller.

Add a second (premium ssd) disk with host caching set to none. This disk will contain the database, logs and sysvol folders. A Disk with a size of 8GB is sufficient.

5. Click Next to configure networking. Attach the VM to your existing vNet that’s connected with your on-premises domain. Don’t assign a public IP address to your virtual machine as recommended by Microsoft – use a VPN or Azure Bastion to connect to the machine. Again, I’ll apply NSG’s to my subnet if required.

6. Finish all steps to create the virtual machine. Don’t enable ‘Login with AAD credentials‘ or ‘Auto-shutdown’.

Configure IP Settings

The virtual machine must have a static IP address and the primary DNS server must point to the on-premises domain controller.

Static IP Address

1. Click on the network interface of your new virtual machine.

2. Select IP configurations and click on the IP config to change the IP settings.

3. Select Static and configure the IP address. Don’t forget to click save – a reboot may be required. You should never configure the static IP address on the VM itself as you do on-premises.

4. Test if you can ping the VM from your on-premises domain controller and the other way around. If this isn’t working you can try the Network Watcher for troubleshooting.

DNS Servers

DNS servers can be configured on the virtual network or on the virtual machine itself. If configured on the vNet, everything that’s connected to this network will inherit these settings (you probably want this).

1. Click on your virtual network to edit it’s settings.
2. Select DNS and confire a custom DNS server (your on-premises domain controller).
3. Don’t forget to click save and reboot the virtual machine.

After adding AD DC roles to the new VM we’ll come back to this page to change the DNS settings once more.

Active Directory Sites & Services

It’s important to create a new site with a corresponding subnet that whill contain your new domain controller. Clients will try to contact the domain controller in their subnet first so a misconfiguration can cause slow logons or other problems. If your on-premises subnet isn’t visible here you should create this one too!

1. Open Active Directory Sites & Services on your on-premises domain controller.
2. Right click Sites and select New Site.

3. Name your new site and link it to the DEFAULTIPSITELINK. Click OK to complete.

4. Right click Subnets and select New Subnet.
5. Enter to correct prefix (your azure subnet that contains your virtual machine) and link it to the new site.

6. Click OK to complete. You should end up with two (or more) subnets and two (or more) sites.

Install Active Directory Domain Services

1. Start Add Roles and Features on the Azure VM.
2. Add the Active Directory Domain Services role and all necessary features.
3. Promote this server to a domain controller.
4. 
   
   
   
   
5. Select Add a domain controller to an existing domain.

5. Enter your domain name and click Select. Provide credentials with sufficient permissions. If you get an error that the wizard can’t find your domain, your DNS settings are probably incorrect.
6. Select the correct site name and enter a DSRM password.

You might get an warning message about a delegation for this DNS server cannot be created. 

7. Replicate from any domain controller.
8. 
   
   
   
   
9. Change all paths to the 8GB partition (without caching).

I put them into c drive as default. I am having D drive as temporary storage which is 8G. 

9. Leave all other options default or configure as required.
10. There are some warning messages, but you can feel free to do installation.
    
    
    
    
11. Reboot the virtual machine.

Validate DNS Settings

DC on Azure

When the virtual machine is back online, it probably has static DNS servers configured – this happened because of the AD DC roles. Change this back to Obtain DNS server address automatically. Do this for both IPv4 and IPv6. you probably loose connection to the virtual machine.

DC on-premises

The preferred DNS server of your on-premises domain controller should be the domain controller on Azure. The alternate DNS server should point to itself. All other on-premises servers or clients should have the on-premises dc as preferred DNS server.

Virtual Network DNS Settings

The first DNS server should be the DC on Azure and the second DNS server should be the DC on-premises.

DNS Settings DC on Azure

The first DNS server should be the on-premises DC and the second DNS server should be the DC on Azure. Reboot your VM after changing this.

Validate this change on the VM itself by using ipconfig /all.

References

• How to deploy a Domain Controller on Microsoft Azure
• DEPLOY A NEW ACTIVE DIRECTORY DOMAIN CONTROLLER SERVER AT AZURE