Windows Server and Active Directory on AWS

This activity puts into practice the concepts from the Windows Server Administration lecture. You will deploy two Windows Server instances on AWS, promote one to a domain controller, join the other as a client, create users and organizational units, and apply a Group Policy Object. By the end, you will have built a working Active Directory domain from scratch.

What You Will Need

• Your AWS Academy Learner Lab session started
• A laptop with a Remote Desktop client installed:
  • Windows: Remote Desktop Connection (built-in, search “Remote Desktop” in the Start menu)
  • macOS: Windows App from the App Store
  • Linux: Remmina or another RDP client

Set Up the Network (VPC)

Before deploying any servers, you need a Virtual Private Cloud (VPC) with subnets in two Availability Zones. This mirrors a real deployment where domain controllers and clients may sit in different data center zones for resilience.

1. In the AWS Console, navigate to VPC dashboard.

2. Click Create VPC and select VPC and more to create the VPC along with its subnets and routing in one step.

3. Configure:

   • Name tag: cs312-ad
   • IPv4 CIDR block: 10.3.12.0/22
   • IPv6: None
   • Tenancy: Default
   • Availability Zones: 2
   • Public subnets: 2
   • Private subnets: 0
   • NAT gateways: None
   • VPC endpoints: None

4. Click Create VPC and wait for it to finish. Note the VPC ID.

5. Navigate to Security Groups (under the Security section in the VPC sidebar). Find the default security group associated with your new VPC (match the VPC ID).

6. Edit the Inbound Rules of that security group. Keep the existing rule (which allows traffic within the security group) and add a new rule:

   • Type: RDP
   • Source: Your current IP address (use “My IP” in the dropdown, or enter the campus/home CIDR, or just 0.0.0.0/0)

   This allows you to connect via Remote Desktop from your machine.

Why two Availability Zones?

In a production environment, you would place domain controllers in separate AZs so that a single data center failure does not take down authentication for the entire domain. We replicate that pattern here even though we are only deploying one DC.

Deploy the Domain Controller

1. Navigate to the EC2 Dashboard. Click Launch Instance.

2. Configure the instance:

   • Name: DomainController
   • AMI: Microsoft Windows Server 2025 Base
   • Instance type: t3.small
   • Key pair: Use your existing key pair or create a new one (you will need this to retrieve the Administrator password and connect via RDP)

3. Under Network settings, click Edit:

   • VPC: Select cs312-ad-vpc
   • Subnet: Select the one ending in a
   • Auto-assign public IP: Enable
   • Firewall: Select existing security group, choose the default group for your VPC

4. Launch the instance.

5. Retrieve the Administrator password. It takes a few minutes after launch before the password is available. Select the instance, click Connect, choose the RDP client tab, and click Get password. Upload your .pem key file and decrypt.

6. Connect via RDP. Open your Remote Desktop client, enter the instance’s Public IPv4 address, and log in as Administrator with the decrypted password.

Install Active Directory Domain Services

Once connected to the DomainController via RDP:

1. Open Server Manager (it should launch automatically; if not, find it in the Start menu).

2. Click Add roles and features (option 2 on the dashboard).

3. Walk through the wizard:

   • Installation type: Role-based or feature-based installation
   • Server selection: Select the current server
   • Server Roles: Check Active Directory Domain Services. Accept the prompt to add required features.
   • Click through the remaining pages and click Install. Wait for installation to complete.

4. After installation, a warning flag appears in Server Manager’s top menu. Click it and select Promote this server to a domain controller.

5. In the promotion wizard:

   • Select Add a new forest
   • Root domain name: cs312lab.local

6. Set a Directory Services Restore Mode (DSRM) password on the next page. This password is used for offline recovery of the AD database; in production, you would store it securely.

7. Ignore the DNS delegation warning and click Next.

8. Leave the NetBIOS name as the default: CS312LAB.

9. Accept the default directories for the database, log files, and SYSVOL. Continue through the wizard and click Install.

10. The server will reboot automatically. Wait a minute, then reconnect via RDP. The login will now show the domain: log in as CS312LAB\Administrator.

Be Patient After Promotion

The first login after promotion takes several minutes as Active Directory finishes initializing. This is normal. You can proceed to deploy the client machine while you wait.

Deploy a Client Machine

1. Return to the EC2 Dashboard and launch a second instance:

   • Name: WindowsClient
   • AMI: Microsoft Windows Server 2025 Base
   • Instance type: t3.small
   • Key pair: Use the same key pair you created earlier

2. Network settings:

   • VPC: cs312-ad-vpc
   • Subnet: Select the one ending in b (a different AZ from the DC)
   • Auto-assign public IP: Enable
   • Security group: Select the same default group

3. Launch the instance and retrieve the Administrator password using the same key pair.

4. Connect via RDP.

Why Windows Server for a Client?

You might wonder why we use Windows Server as a “client” instead of Windows 11. AWS only allows server OS images on EC2. For our purposes, this does not matter: domain joining, Group Policy, and user authentication work identically on both server and desktop editions.

Point the Client’s DNS to the Domain Controller

On the WindowsClient machine:

1. Open Advanced network settings (search “network” in the Start menu).

2. Click Edit under “More adapter options” under the Ethernet adapter.

3. Select Internet Protocol Version 4 (TCP/IPv4) and click Properties.

4. Change to Use the following DNS server addresses:

   • Preferred DNS server: Enter the private IP of your DomainController (find it in the EC2 console; it will be something like 10.3.12.x)
   • Leave the alternate DNS server blank

5. Click OK to save.

6. Verify DNS resolution by opening a Command Prompt and running:

   Ping Domain Name

   ping cs312lab.local

   You should see replies from your domain controller’s private IP.

Join the Client to the Domain

1. On the WindowsClient, search for “workgroup” in the Start menu and select Change workgroup name.

2. In the System Properties dialog, click Change.

3. Under “Member of”, select Domain and enter cs312lab.local. Click OK.

4. When prompted for credentials, enter the DomainController’s administrator credentials:

   • Username: Administrator
   • Password: the DC’s Administrator password

5. You should see a “Welcome to the cs312lab.local domain” message. Click OK, close the dialogs, and restart the client.

Think About It

What would happen if you pointed the client’s DNS back to 8.8.8.8 after joining the domain? Would the user still be able to log in? Why or why not?

Create an Organizational Unit, User, and Group

On the DomainController:

1. In Server Manager, click Tools > Group Policy Management.

2. In the left sidebar, expand Forest: cs312lab.local > Domains > cs312lab.local.

3. Right-click cs312lab.local and select New Organizational Unit. Name it Lab Computers. Click OK.

4. Right-click cs312lab.local again and select Active Directory Users and Computers.

5. In the AD Users and Computers window, find the Computers container in the left sidebar. You should see your WindowsClient machine (with an auto-generated name like EC2AMAZ-...). Drag it into the Lab Computers OU.

   AD will warn you about moving objects. Click OK. The computer is now in the OU where your GPO will apply.

6. In the left sidebar, right-click the Users container. Select New > User.

   • Set a first and last name of your choice
   • User logon name: student
   • Click Next, set a password, and uncheck “User must change password at next logon”
   • Finish the wizard

7. Right-click the new student user and select Add to a group. Type Domain Admins and click OK.

   Domain Admins Warning

   Adding a user to Domain Admins is done here for simplicity. In production, you would never grant Domain Admin to regular users.

Think About It

You used an OU to target the GPO and a group (Domain Admins) for permission assignment. Could you swap these — use a group to target the GPO and an OU for permissions? Why are OUs and groups used for different purposes?

Create and Apply a Group Policy Object

1. Back in Group Policy Management, right-click the Lab Computers OU and select Create a GPO in this domain, and Link it here. Name it Lab Policy.

2. Right-click Lab Policy under the Lab Computers OU and select Edit. This opens the Group Policy Management Editor.

3. Disable local GPO overrides. Navigate to:

   Computer Configuration > Policies > Administrative Templates > System > Group Policy

   Find Turn off Local Group Policy Objects processing. Double-click it, set to Enabled, and click OK.

4. Enable loopback processing. In the same folder, find Configure user Group Policy loopback processing mode. Set to Enabled with Mode set to Replace. Click OK.

   This ensures that user settings applied to this OU’s computers override user-specific settings from other OUs, which is important for shared or lab machines.

5. Add a system PATH entry. Navigate to:

   Computer Configuration > Preferences > Windows Settings > Environment

   Right-click Environment and select New > Environment Variable. Configure:

   • Action: Create
   • Check System Variable
   • Check the PATH checkbox (this sets the Name to PATH)
   • Check Partial (append rather than replace)
   • Value: C:\Users\Public\cs312

   Click OK. This adds a directory to the system PATH on every computer in the OU, demonstrating how GPOs can push configuration changes across an entire fleet.

6. Close the editor windows.

Think About It

You linked the GPO to the Lab Computers OU. If you also linked a conflicting GPO at the domain level, which one would win? Why?

Test the Domain Configuration

1. Connect to the WindowsClient via RDP. This time, log in with the domain account:

   • Username: CS312LAB\student
   • Password: the one you set when creating the user

   Domain Login Tip

   If the RDP client does not show a domain login option, look for More choices or Use a different account to enter the domain-qualified username.

2. The first login for a new domain user takes extra time as Windows creates the user profile. Be patient.

3. Open a Command Prompt and verify your identity:

   Check Domain Login Identity

   whoami

   This should return cs312lab\student.

4. Force Group Policy to apply immediately (rather than waiting up to 90 minutes for the automatic refresh):

   Force Group Policy Update

   gpupdate /force

5. Verify the GPO took effect by checking the PATH:

   Check Updated PATH

   echo %PATH%

   You should see C:\Users\Public\cs312 in the output. Restart the command prompt for the change to take effect if you don’t see it immediately.

6. For a detailed report of which computer-side GPOs are applied to this machine, open Command Prompt as administrator and run:

   Generate Group Policy Report

   gpresult /scope computer /r

   Look for Lab Policy under “Applied Group Policy Objects.”

Think About It

The lecture compares GPOs to Ansible playbooks. In what ways is this analogy accurate, and where does it break down?

Cleanup

1. In the EC2 Dashboard, select both instances (DomainController and WindowsClient). Click Instance state > Terminate instance.

2. In the VPC Dashboard, delete the cs312-ad-vpc VPC (this also removes its subnets, route tables, and internet gateway).

3. Delete the key pair if you no longer need it.