Acknowledgments Windows Server 2016: Domain Infrastructure represents a dramatic shift—an additional direction—for my writing as the fourth book in the Tech Artisans series. While many of my previous books have focused primarily on administration techniques, this latest endeavor focuses on providing technology solutions for a wide range of IT professionals. This new direction required a great deal of thought to plan and a lot of hard work to implement. Still, I think the hard work paid off and the result is a good book that will help any technologist learn Windows Server 2016 and related technologies. Once again, I was fortunate enough to team up with a great group of individuals from around the industry including at Microsoft and Intel. I must say that the editorial team was very patient with me, even as I revised the outline and structure for the umpteenth time, which is great news for readers as the book is much clearer in focus and more detailed in coverage. Indeed, one of the goals was to provide concise yet thorough coverage of Windows Server 2016 and related technologies. (You'll be the judge as to whether this goal was achieved.) As always, it is gratifying to see techniques I’ve used time and again to solve problems put into a printed book so that others may benefit from them. But no man is an island, and this book couldn’t have been written without help from some very special people throughout the industry, including Liz, Mac, Jeff, Kelly, Mike, Shawn, John, Amy, Paula, Owen, and Carol. Unfortunately for the writer (but fortunately for readers), writing is only one part of the publishing process. Next came editing and author review. I owe huge Thank Yous to the team at Andover as well as to L & L for their wild enthusiasm and careful work. Good copy editors and proofreaders are hard to find! Special thanks to my son Will for his extensive contributions to this book, from concept development to completion. He’s made many contributions previously, has been the final technical reviewer of my books for many years, and now I can finally give him the cover credit he’s earned and deserved for so long. As a strong, talented writer and technologist, his technical skills are top-notch and he’s put them to good use in this work as well with essential contributions that helped ensure the accuracy and thoroughness of coverage. Before closing, I want to say a huge thank you to my wife of 27 years. She’s been there with me through many books, many millions of words, and many thousands of pages, providing support and encouragement and making every place we've lived a home. She’s the foundation of all my work, the rock upon which my words are written. Without her care day in and day out, this work and the others before it would not have been possible. Hopefully, I haven’t forgotten anyone, but if I have, it was an oversight. Honest. ;-) —William R. Stanek Windows Server 2016: Domain Infrastructure Tech Artisans William R. Stanek Author & Series Editor William R. Stanek, Jr. Contributor Windows Server 2016: Domain Infrastructure Tech Artisans Published by Stanek & Associates PO Box 362, East Olympia, WA, 98540-0362 www.williamrstanek.com. Copyright © 2016 William R. Stanek. Seattle, Washington. All rights reserved. No part of this book may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted by Sections 107 or 108 of the 1976 United States Copyright Act, without the prior written permission of the publisher Requests to the publisher for permission should be sent to the address listed previously. Stanek & Associates is a trademark of Stanek & Associates and/or its affiliates. All other marks are the property of their respective owners. No association with any real company, organization, person or other named element is intended or should be inferred through use of company names, web site addresses or screens. This book expresses the views and opinions of the author. The information contained in this book is provided without any express, statutory or implied warranties. LIMIT OF LIABILITY/DISCLAIMER OF WARRANTY: THE PUBLISHER AND THE AUTHOR MAKE NO REPRESENTATIONS OR WARRANTIES WITH RESPECT TO THE ACCURACY OR COMPLETENESS OF THE CONTENTS OF THIS WORK AND SPECIFICALLY DISCLAIM ALL WARRANTIES, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR PURPOSE. NO WARRANTY MAY BE CREATED OR EXTENDD BY SALES OR PROMOTIONAL MATERIALS. THE ADVICE AND DISCUSSION IN THIS BOOK MAY NOT BE SUITABLE FOR EVERY SITUATION. THIS WORK IS SOLD WITH THE UNDERSTANDING THTAT THE PUBLISHER IS NOT ENGAGED IN RENDERING PROFESSIONAL SERVICES AND THAT SHOULD PROFESSIONAL ASSISTANCE BE REQUIRED THE SERVICES OF A COMPETENT PROFESSIONAL SHOULD BE SOUGHT. NEITHER THE PUBLISHERS, AUTHORS, RESELLERS NOR DISTRIBUTORS SHALL BE HELD LIABLE FOR ANY DAMAGES CAUSED OR ALLEGED TO BE CAUSE EITHER DIRECTLY OR INDIRECTLY HEREFROM. THE REFERENCE OF AN ORGANIZATION OR WEBSITE AS A SOURCE OF FURTHER INFORMATION DOES NOT MEAN THAT THE PUBLISHER OR THE AUTHOR ENDORSES THE INFORMATION THE ORGANIZATION OR WEBSITE MAY PROVIDE OR THE RECOMMENDATIONS IT MAY MAKE. FURTHER, READERS SHOULD BE AWARE THAT WEBSITES LISTED IN THIS BOOK MAY NOT BE AVAILABLE OR MAY HAVE CHANGED SINCE THIS WORK WAS WRITTEN. Stanek & Associates publishes in a variety of formats, including print, electronic and by print-on-demand. Some materials included with standard print editions may not be included in electronic or print-on-demand editions or vice versa. Country of First Publication: United States of America. Cover Design: Creative Designs Ltd. Editorial Development: Andover Publishing Solutions Technical Review: L & L Technical Content Services You can provide feedback related to this book by emailing the author at williamstanek @ aol.com. Please use the name of the book as the subject line. Version: 1.0.1.6c NOTE I may periodically update this text and the version number shown above will let you know which version you are working with. If there’s a specific feature you’d like me to write about in an update, message me on Facebook (http://facebook.com/williamstanekauthor). Please keep in mind readership of this book determines how much time I can dedicate to it. Table of Contents Introduction Who Is This Book For? How Is This Book Organized? How to Stay in Touch? Chapter 1. Working with Domain User Accounts Establishing Account Policies Enforcing Password Policy Configuring Account Lockout Policy Setting Kerberos Policy Using Authentication Policies Creating Password Settings Objects Granting Capabilities, Privileges, and Rights Assigning User Rights Assigning User Rights for a Domain or OU Assigning User Rights on a Specific Computer Chapter 2. Managing User and Service Accounts Creating and Configuring Domain User Accounts Configuring Account Options Configuring Profile Options Determining Effective Access Troubleshooting User Accounts Working with Managed Service Accounts Managed Service Account Fundamentals Creating Group Managed Service Accounts Step 1: Create a Hosting Group Step 2: Create a KMS Root Key Step 3: Create the gMSA Step 4: Install the Account Step 5: Configure Service to use gMSA Deleting Managed Service Accounts Resetting the Account Password Moving Managed Service Accounts Using Virtual Accounts Maintaining User Accounts Resetting Passwords Disabling and Enabling User Accounts Unlocking User Accounts Renaming User Accounts Moving User Accounts Deleting User Accounts Recovering Deleted Accounts Enabling Active Directory Recycle Bin Recovering Accounts from the Recycle Bin Chapter 3. Managing Groups and Computers Working with Groups Creating Groups Modifying Groups Adding Members to Groups Searching for Groups in the Directory Deleting Groups Managing Computer Accounts Creating Computer Accounts in Active Directory Joining Computers to a Domain Performing an Offline Domain Join Moving Computer Accounts Disabling Computer Accounts Resetting Computer Accounts Deleting Computer Accounts Troubleshooting Computer Accounts Chapter 4. Active Directory Architecture: The Fundamentals Active Directory Physical Architecture A Top-Level View A View within the Local Security Authority Decoding the Directory Service Architecture Navigating Protocols and Client Interfaces Understanding the Directory Service Component Understanding the Extensible Storage Engine Deletion without Recycle Bin Deletion with Recycle Bin Data Store Architecture Active Directory Logical Architecture Understanding Objects Navigating Domains, Trees, and Forests Introducing Trusts Introducing Namespaces and Partitions Understanding Replication Chapter 5. Creating and Updating Active Directory Designs Planning for Replication Planning for Search and Global Catalogs Searching the Directory Accessing the Global Catalog Designating Global Catalog Servers Designating Replication Attributes Planning for Compatibility Understanding Domain Functional Levels Understanding Forest Functional Levels Managing Functional Levels Chapter 6. Understanding Authentication and Trusts Authentication Essentials for Groups Security Tokens and Membership Caching User Principal Names