Building my EMS Lab – Part 2: Setting up the on-premise components

  • Article

Introduction

This is the second article on how I built my EMS lab. If you are looking for the first part, click here.

In this article, I’ll walk you through setting up the on-premise components,starting with the domain controller, then hooking it up to the cloud using AD Sync and AD Connect and finally installing and configuring Configuration Manager.

 

Setting up the DC1 VM

In this section we'll make DC1 a domain controller and DNS

  1. First, we need to give DC1 a static IP (also see here)
    1. On your laptop (ie not one of the VMs), download and install the Windows Azure Powershell extensions here
    2. Open PowerShell
    3. Type "Add-AzureAccount", and log in with the credentials you used to create your Azure account
    4. Type "Get-AzureVM -ServiceName emdemo -name dc | set-azurestaticvnetip -ipaddress 10.0.0.4 | update-azurevm"
  2. Promoting the VM to a Domain Controller
    1. Log on to DC1
    2. In the Server Manager > Manage > Add Roles & Features
      1. Add Active Directory Domain Service
    3. Promote this server to a domain controller
    4. Add a new forest
    5. Root name: emdemo.local
      NOTE: I chose to have a separate internal (.local) and external (.be) domain, as this is the case with most customers and provides a better view on when things are on the intranet and when they are on the extranet. You are free to set this up differently.
    6. Enter your admininistrator password
    7. Ignore the DNS warning
    8. Choose a valid NetBIOS name, I chose EMDEMO
    9. Click Install and reboot the VM
  3. Configuring the DNS
    1. In the Azure console
      1. Go to the EMDemo Virtual Network
        1. New > Virtual Network > Register DNS Server
          1. Name = DC1, IP = 10.0.0.4
          2. On the EMDemo Virtual Network > Configure
          3. Ensure DC1 with IP 10.0.0.4 is listed under DNS servers
  4. Domain Joining the ADFS and SCCM VM
    1. NOTE: do not domain join the WAP VM
    2. Connect to each of the VMs, and domain join them
    3. Log out of AFDS, DC and SCCM and log in with your domain account (ie DOMAIN\USERNAME). Use this username from now on.
  5. Continue the DNS setup
    1. Log on to DC1
      1. Open the DNS manager (in the Server Manager > Tools > DNS)
        1. Ensure that there are public DNS servers listed:
          1. Right click the domain > Properties > Forwarders
          2. Make sure there are public DNS servers listed there
          3. You can use 8.8.8.8 and/or 8.8.4.4
        2. Because of our odd-lab setup, we need to tweak the DNS a bit
          1. Expand the Domain node > right click "Forward Lookup Zones" > New Zone
          2. Primary Zone
          3. Zone name = EMDemo.be, use 8.8.8.8 and 8.8.4.4 as public DNS servers again
          4. Right click this new zone > New Alias (CNAME)
            1. Alias = adfs, FQDN = adfs.emdemo.local
    2. Testing if it works
      1. Log on to WAP
        1. Open a command prompt
        2. Ensure that you can ping emdemo.local (it should resolve to 10.0.0.4)
        3. Ensure that you can ping adfs.emdemo.be (it should resolve to adfs.emdemo.local)

 

Exposing the WAP externally

  1. In the Azure Management console
    1. Go to the WAP VM
      1. Choose Endpoints > Add
        1. Choose "Standalone Endpoint"
        2. Choose HTTPS
      2. Repeat this for a HTTP endpoint
      3. Select the HTTP endpoint and click "manage ACL"
        1. Description = Authorized Users, Remote subnet = 0.0.0.0/0
    2. Go the the EMDemo cloud service > Dashboard
      1. Locate your Public Virtual (VIP) address and write it down somewhere
  2. With your domain registar (where you can modify the DNS records for emdemo.be)
    1. Add a CNAME to adfs.emdemo.be to emdemo.cloudapp.net
      NOTE: It is a best practice to use an A record to registere ADFS. Because this is a lab environment and because the VIP can change when you shut down all VMs, a CNAME provides a better solution. If you are using this in a production environment, please use an A record.

 

Setting up ADFS with AD Connect

  1. Adding the emdemo.be domain to your directory
    1. In the Azure console, go to the emdemo directory
      1. Click Domains
        1. Click Add
          1. Domain Name = emdemo.be
          2. Check "I plan to configure this domain for SSO"
        2. Observe that your domain is added, but with status “Unverified”
  2. Log on to ADFS

    1. At the time of writing, AD Connect is still in beta. Please check if there is a newer version. Read about it, download and install it from here.

    2. Run it and follow the instructions, make sure you have your SSL certificate ready on your ADFS VM

      image

      1. In Azure Tenant, enter your Azure AD admin credentials
      2. I chose not to go with the express settings, as I wanted single-sign on > Click Customize
      3. Choose Single AD Forest
      4. Choose Single Sign On
      5. Under Options > AD Credentials, enter your on-prem admin credentials
      6. Under AD FS Farm
        1. I would like to set up a new farm
        2. Choose your SSL certificate here
        3. Subject name prefix = adfs
        4. Under Federation Server
          1. Add adfs.emdemo.local
        5. Under Proxy Servers
          1. Add wap.emdemo.local
          2. TROUBLESHOOTING: When this doesn’t work, try here
        6. Under Credentials
          1. Enter your on-prem admin credentials
        7. Under Service Account
          1. Create a group managed service account for me
      7. Under Azure Domain
        1. Your Azure AD domain should be listed there
      8. Under Execute
        1. Uncheck "Start the synchronization process…"
        2. TROUBLESHOOTING: if you run into an "Install Active Directory Powershell" issue, open PowerShell and run "winrm quickconfig"
        3. TROUBLESHOOTING: if you run into an "Configure Service Account""" issue, open PowerShell on the DC and run "winrm quickconfig"
      9. Click Install
      10. Once the installation is complete, click Verify
      11. The version of AD Sync I downloaded still contains the old "Windows Azure Active Directory Sync" tool. Uninstall this from the control panel.
        image
         
      12. Reboot the ADFS VM

 

Synchronizing with AD Sync

  1. Log on to ADFS
    1. Get AD Sync here, install and run it, follow the instructions (it is pretty self-explanatory)
      For more information on AD Sync, see here
      1. Under Azure AD Credentials
        1. Enter your Azure AD admin credentials
      2. Under AD DS Credentials
        1. Forest = emdemo.be
        2. Enter your on-prem admin credentials
      3. Under User Matching, leave the default
      4. Under Optional Features
        1. Ensure Exchange Hybrid Deployment is unchecked
        2. Ensure Password write-back is checked
        3. Ensure Azure AD app and attribute filtering is unchecked (unless you want to filter what attributes are synced up)
        4. Continue the wizard until it starts synchronizing
    2. NOTE: If you want to test/force synchronization, open PowerShell and under \Program Files\Microsoft Azure AD Sync\bin, run ".\DirectorySyncClientCmd.exe delta"
  2. Test ADFS
    1. From within your lab: try browsing to https://adfs.emdemo.be/adfs/ls/idpinitiatedsignon.htm. You should be able to log on succesfully.
    2. From outside you lab, do the same.

 

Installing System Center Configuration Manager 2012 R2 (or SCCM for short)

  1. Log on to SCCM
    1. Start downloading the SCCM & SQL Server bits (this may take a while)
    2. In the Server Manager > Manage > Add Roles & Features
      1. Install the following roles:
        1. Web Server (IIS)
      2. Install the following features:
        1. NET Framework 3.5
        2. BITS
        3. Remote Differential Compression
      3. I Role Services:
        1. Under Security
          1. Add Basic Auth
          2. Add IP and Domain Restrictions
          3. Add URL Auth
          4. Add Windows Authentication
        2. Under Application Development
          1. Add ASP
          2. Add ASP.NET 3.5
          3. Add ASP.NET 4.5
        3. Under Management Tools
          1. Add IIS Management Scripts and Tools
          2. Add Management Services
        4. Under IIS 6 Management Compatibilitiy
          1. Add IIS 6 WMI Compatbility
        5. Finish the installation
  2. In the mean time, log on to DC1
    1. Open ADSI Edit (through Search)
      1. Action > Connect To > OK
      2. Under CN=System
      3. Right Click > New > Object
      4. Container
      5. Value = System Management
    2. Open Active Directory Users & Computer (through Search)
      1. View > Advanced Features
      2. Under the domain node
        1. System > System Managemetn > Properties
          1. Hit the Security tab
          2. Click Add
            1. Object Types
              1. Ensure only "Computers" is checked
            2. Object Names
              1. SCCM (ie the computer name)
          3. Allow "Full Control"
          4. Click Advanced
            1. Select SCCM
            2. Click Edit
            3. Change "Applies to" to "This object and all descendant objects"
            4. Hit OK & Apply to close all dialog boxes
  3. Log back on to SCCM, wait for the download of the SCCM bits to complete
    1. We’re now going to extend the AD schema for SCCM
      1. Extract the SCCM bits
      2. Run SMSSETUP\BIN\X64\extadsch.exe as Administrator
    2. Installing the prerequisites for SCCM
      1. Install SQL Server 2012
        1. Run setup in the root of the installer media
        2. Click Installation
        3. Click "New sql server standalone" (top option)
        4. Enter your (evaluation) product key
          NOTE: Microsoft employees, click here
        5. Under "Feature Selection", select the following features
          1. Database engine services
          2. Client tools connectivity
          3. Management tools
        6. Under the "Server Configuration" section
          1. Set all stratup types to automatic
          2. SQL Server Database Engine > Account Name > Browse > "NETWORK SERVICE"
        7. Under "Database Engine Configuration"
          1. Add current user
      2. Install ADK
        1. Download the bits here
        2. Run setup
        3. Select the following features:
          1. Deployment Tools
          2. Windows preinstallation Environment
          3. User State Migration Tools
    3. Installing SCCM 2012
      1. Run Setup
      2. Select "Use typical installation options for a stand-alone primary site"
      3. Enter the (evaluation key)
        NOTE: Microsoft employees, click here
      4. Accept the license terms
      5. Select "Download required files" and set a temporary path
      6. Choose a site code (eg. PRI)
      7. Choose a site name (eg. EMDemo Primary Site)
    4. Setting up SCCM
      1. Run the ConfigMgr console
        1. Under Administration > Hierarchy Configuration > Boundaries > right click > create boundary
          1. Type: Active Directory Site
          2. Active Directory Site name: EMDemo Main Site
          3. OK
        2. Under Boundary Groups > Create Boundary Group
          1. Name = Main Boundary
          2. Click Add
          3. Select the boundary you just created
        3. Under Discovery Methods
          1. Select Active Directory System Discovery > Properties
            1. Click Enable Active Directory System Discovery
            2. Click the yellow star
            3. Click browse
            4. Select the top node
            5. Check "Discover Objects within Active Direcotyr Gourps"
            6. Click OK
            7. Click OK
            8. Click No
          2. Select Active Directory Forest Discovery
            1. Click Enable 
            2. Click Automatically create Active Directory Site boundaries
            3. Click OK
            4. Click No
          3. Select Active Directory Group Discovery
            1. Click Enable
          4. Select Active Directory User Discovery
            1. Click Enable
            2. Click the yellow star
            3. Click Browse 
            4. Select "Users"
            5. Check "Discover objects within AD Groups"
            6. Click OK
            7. Click No
          5. Click "Run Full Discovery Now"
        4. Under Overview > Devices > Click Refresh Now

That’s it! Click here for the next part.