Setting up Additional Domain Controller using IFM ( Install From Media)

Setting up a Domain Controller using IFM ( Install From Media)

There should be a good bandwidth when we are setting up an additional Domain Controller ( Default 500 Kbps). Now Imagine you are planning to add an additional DC on a remote site but the bandwidth is quite low (below 500Kbps), as a result you will not be able to add additional DC.

One solution that was used before 2008 was to take a System State backup & then transfer the media to Remote site via some external media & then using it. But taking System State backup takes long time & also it's not secure / preferable to do this way. Instead we can use Install from Media Option. 

From 2008 Onwards Microsoft introduced IFM (Install From Media) using which if we still have low bandwidth, then also we can add additional Domain Controller. In Install from Media, we basically copy NTDS.DIT ( AD Physical Database file ) & some registry settings which are required to Promote a Domain Controller.

Note - You can join Computers to domain Offline but Domain Controller can't be promoted in Offline Mode, There needs to be connectivity with a Working Writable DC for promoting a new DC. 

Steps

1. Login to any Writeable Domain Controller, Open CMD as an Administrator.

2. Follow below commands - 

ntdsutil 

activate instance ndts

ifm

create full C:IFM

Once done, it will automatically copy the AD Database & registry setting into IFM folder under C:\

3. At this Point, IFM Media is ready, now we simply need to install ADDS role onto the Remote site server which we are planning to promote as a Domain Controller.

Note - Kindly make sure, prerequisite for Promoting a Domain Controller is met. Things like IP Configuration, Primary / Secondary DNS should be properly configured etc.

Ex - DC1 is in Site 1, I am adding DC2 as additional Domain Controller in Site 2. 

Installing ADDS using Powershell, you can also do the installation via GUI.

Below is the command - 

Install-WindowsFeature -Name AD-Domain-Services -IncludeAllSubFeature -IncludeManagementTools

Post installation of ADDS role, Click on Notification Tab & Start Promoting it to a Domain Controller.

Since, we are adding additional Domain Controller, hence we will select Add a domain controller to an existing domain, Cross check the domain name & make sure user with sufficient access would be listed.

(Since i am logged in as Administrator which is Part of Domain Admins, hence it's auto populated in below field.)

Click Next & Select Site 2, I will be setting up this DC as a Global Catalog Server & hence check marking on it, providing the DSRM password & clicking on Next.

DSRM - Directory Service Restore Mode, It's not a Administrator or any Domain ID credentials. It's a Local Password for this DC only, You can have different DSRM password for different DC's. This password is primarily  useful in activities when we are taking our DC into Restore Mode. Once such example could be taking the DC into Safe mode for Restoration from last backup.

Now here you need to do some changes. Instead of Selecting Replicate from Option, we will check mark on Install from Media Option & browse to the IFM folder which we created from another writable domain Controller( DC1).

I have copied it in DC2 Desktop, so will be selecting accordingly.

Keep the default path for storing NTDS, Log file & Sysvol folder & click Next

Review all the options selected & click Next, It will run a Prerequisite Check, let it complete. Once done Click on Install.

Now the Promotion process will start. Once complete, your system will be automatically restarted.

Post reboot, you will have additional DC in the Remote Site. You can cross check in AD Sites & Services, under Site 2 you will see DC2 as new entry, or in AD Users Computer under Domain Controllers OU & many other places also.