Installation & Configuration of Windows 2008 R2 AD for SCCM

This article will address how to prepare and install Active Directory Domain Services (AD) on Windows Server 2008 R2 Standard 64-bit (W2K8R2) for System Center Configuration Manager 2007.
Please check the below TechNet links for the supported configurations for SCCM.
http://technet.microsoft.com/en-us/library/bb680717.aspx
To execute the below steps, you should be familiar with the Windows server 2008.
Here I have taken Windows Server 2008 R2 Standard edition for the lab purpose.
Section A
Preparing Windows for Active Directory Domain Services installation.
1.  Change the computer name of the AD system. Here I have changed the name to AD.

2. Turn off Windows Firewall

3.  Disable IPV6 and configure IPV4 settings as below

4. Add the required role from Server manager as shown:

To add the “Active Directory Domain Services” Role click on the Role Directory within Server Manager and select Add Roles in the Roles Summary. Install DotNet Framework when prompted.
Consider using a Proper domain name for the new domain controller.
We need not install DNS separately; installation of AD DC will automatically prompt for the installation of DNS server.

Section B
Installation of Active Directory Domain Services (DCPROMO)
Now that the Server has been prepared for the installation of AD we can proceed. You now have three different ways we can begin the installation.

1.  Within Server Manager, if you expand the Roles directory you will see the Active Directory Domain Services directory. Select that and you will find in the Summary “Run the Active Directory Domain Services Installation Wizard (dcpromo.exe)” Simply click that to begin the installation.

2.  The command line equivalent to Active Directory Domain Services Installation Wizard is Servermanagercmd.exe –I ADDS-Domain-Controller

3. The last and the most recognized method is typing DCPROMO.exe at the command prompt.

Whichever way you choose, you should get to this point. Simply click next. You do not check advanced mode.

Click Next and select Create a new domain in a new forest

Click next and provide the Forest Root Domain Name, Here I have given it as contoso.com

After the installation verifies that the NetBIOS Name, you will choose the Forest function level. I chose 2008 R2. After selecting click Next.

It will examine and verify your DNS setting. DNS server should already be checked. Now click Next.

The next prompt is ok; you can safely click on Yes.

Click Next and verify the log files locations, if needed you can change the locations.

Click next and enter the Domain Administrator password. This is not the local admin password but for recovery options.

Click Next and then summary is displayed, you can also export the settings to be used for other AD installations by supplying this answer file.

The installation will now complete. You can check the reboot on completion if you like.

Click Finish and reboot the server.

AD Domain Controller is ready and you can login with the domain admin account into the system

Section C
Preparing for SCCM

1. Map the  SCCM media and find the file extadch

We have to run this file to extend  the schema for SCCM

Note:

• The location of the file is in \SMSSETUP\BIN\I386 in the SCCM media
• The account used to run this application should have schema admins rights.

In production environment, consult your AD Windows team for extending schema.

• The below reference link is for AD schema extension

http://technet.microsoft.com/en-us/library/bb680608.aspx

2. We can verify whether  the schema is extended  or not  by checking the extadch.log file  in the  C drive(  root) of the system where  the  file  has been executed.

3. Once the schema has been extended, we have to create appropriate groups for SCCM Servers.  Here I have created a group called SCCM_SERVERS
We can add all the upcoming SCCM servers into this group for better management

4. Then, we have to create system management container within the system node in the AD and provide full permissions for the SCCM_SERVERS group on that container.
The reference article for the same.
http://technet.microsoft.com/en-us/library/bb632591.aspx

• Log on as an account that has the Create All Child Objects permission on the System container in Active Directory Domain Services.

Here, the domain admin account contoso\administrator

• Run ADSI Edit, and connect to the domain in which the site server resides

i.e. connect to default naming context

• Expand Domain <computer fully qualified domain name>, expand <distinguished name>, right-click CN=System, click New, and then click Object.

• In the Create Object dialog box, select Container, and then click Next.

• In the Value box, type System Management, and then click Next.

Type the exact name without any changes; this is the container where the SCCM will publish the data into Active directory

• Click Finish.

5. Now the only part left out in AD is providing permissions for SCCM group to the newly created System Management container, then we are good to go with the SCCM installation.
Here is how we do it—
Go to System management container, right click and select properties. Select Security tab on the property window>>> click add, enter the sccm_servers group and provide full permissions to the group on the container.

Make sure permissions are provided to all the descendant and child objects as shown.

Disclaimer: This document is only for Lab purpose and should be thoroughly tested before implementing the procedures in the production.
Hope this post has been informative to you, happy installations!!!