Virtualising a DC to learn more about AD/tinker/break all of the things?

[Garacesh]

Basically, uh, yeah. Where do I start?

 

We have the ISO of 2008 R2 and of course, the license to use it. I'm looking to build a DC that's detached from our domain and basically tinker around with AD/etc without risking any damage (because I'd have to be dimmer than Mr. Gove to make any alterations to the live AD when I don't know what I'm doing) and see what I can learn.

 

Where to begin actually virtualising a server?

Would anybody recommend any specific software?

Do I just host it on my machine or do I need a separate box? (In which case, is it worth virtualising at all if I need another physical machine?)

 

Blah.

I've never really handled creating a virtual server before, rather than just logging on and doing things like it were a normal machine.

[CHR1S]

Install Hyper-V Server 2012, disktovhd the existing DC, import into Hyper-V (make sure you dont connect to network) and play away!

 

Edit - yes you need some hardware to run it on.

Edited October 10, 2013 by CHR1S

[Garacesh]

I'll likely start 'from scratch' rather than importing our current DC, it's more a look at AD in general, not our AD.

I think learning about our AD before AD as a broader subject would end up with me 'standardising' to what we currently had if I needed to ever build a new AD tree. I'd rather learn 'AD' than 'Our AD' and design my own trees to my own specifications (and fail because I did it wrong, but still, that's how I learn best)

 

Question: If I need a separate box to install it on, why bother with virtualisation? Why not just install Win. Server onto the box? What benefits would there be?

Derp. Reverting to snapshots, of course.

Edited October 10, 2013 by Garacesh

[CHR1S]

You can ONLY snapshot a DC in 2012, not earlier.

 

Virtualisation is there for many reasons, hardware independence being a major one (If one server fails, have a redundancy on another and carry on working) especially at upgrade time when you can replace the entire server behind it and just keep going.

 

Distribution of roles, rebooting a print server but leave everything else running for example.

 

With dynamic RAM and CPU sharing its also much more efficient.

[themightymrp]

Depending on what hardware you have available, this is what I did:

 

Installed FREE VMware Player or VirtualBox

 

Create 2 virtual machines, 1 to host your virtual AD server, the other to stick on a client OS such as Win 7 etc. For testing purposes, give each machine at least 1Gb of RAM and 1 CPU core (again, depends on the kit you have to play with). It doesn't need to be too flash to play around

 

Bung in the CD (or connect to the ISO) of the 2008 R2 disk and install the server. Set the network adapter to connect to a virtual segment/local to the machine network. Whichever the software says. Once its done, run DCPROMO to install the necessary AD services.

 

Leave this running, bung in a Windows 7 disk. Boot up your second virtual machine and install 7. Set the network adapter to belong to the same virtual segment. Join it to your test domain.

 

Both OS's give you between 30 and 120 days free trial. Just mess around with settings during this time, you can always reinstall when they expire

[Garacesh]

You can ONLY snapshot a DC in 2012, not earlier.

 

Virtualisation is there for many reasons, hardware independence being a major one (If one server fails, have a redundancy on another and carry on working) especially at upgrade time when you can replace the entire server behind it and just keep going.

 

Distribution of roles, rebooting a print server but leave everything else running for example.

 

With dynamic RAM and CPU sharing its also much more efficient.

Really? I thought you could snapshot any virtual machine..? On account that it was virtual?

And aye, those are some real good reasons to virtualise. I just meant in my specific example (a mock DC just to play around with), were there any benefits to virtualising

 

Depending on what hardware you have available, this is what I did:

-snip-

That's great I'll give it a try. Thanks!

[Arthur]

Really? I thought you could snapshot any virtual machine..? On account that it was virtual?

You can snapshot any VM, but you should only clone/snapshot DCs that are running Windows Server 2012 or 2012 R2.

 

social.technet.microsoft.com/wiki/contents/articles/12149.windows-server-2012-virtualization-safeguards.aspx

technet.microsoft.com/en-us/library/hh831734.aspx

 

Edit. The hypervisor should also support the VM Generation ID feature too.

Edited October 10, 2013 by Arthur

[CHR1S]

You can snapshot any VM, but you should only clone/snapshot DCs that are running Windows Server 2012 or 2012 R2.

 

social.technet.microsoft.com/wiki/contents/articles/12149.windows-server-2012-virtualization-safeguards.aspx

technet.microsoft.com/en-us/library/hh831734.aspx

 

Ye thats what I was trying to say, you put it better.

[cpjitservices]

I'll likely start 'from scratch' rather than importing our current DC, it's more a look at AD in general, not our AD.

I think learning about our AD before AD as a broader subject would end up with me 'standardising' to what we currently had if I needed to ever build a new AD tree. I'd rather learn 'AD' than 'Our AD' and design my own trees to my own specifications (and fail because I did it wrong, but still, that's how I learn best)

 

Question: If I need a separate box to install it on, why bother with virtualisation? Why not just install Win. Server onto the box? What benefits would there be?

Derp. Reverting to snapshots, of course.

 

not to mention... power saving

[KK20]

whether you CAN and SHOULD snapshot a DC are different though. I suppose if you are only playing about (and have one DC) then snapshot away. If you do ever plan on VMing your DCs then it might be a good idea to have a physical one (with GC at least) just in case.

[Firefox]

Snapshotting a 2008 DC for your particular intention is completely fine.

 

You mentioned you don't mind starting again, however if you actually want some "test data" then taking a copy of live would probably be the quickest way to achieve this.

 

In our environment, I actually promoted another DC into the live environment, made it a GC with DNS. Then moved it to it's own isolated part of the network and seized the fsmo roles to it. I was left with a fully functional "test environment" that I just needed to remove the other servers\user devices from