Azure AD and OnPrem Windows Server 2016

bigbear

@scottalanmiller I know you mentioned you are a "cloud first" guy. Would you go with VULTR on this type of small setup or just order in a server and run it off Hyper-V local?

bigbear

@scottalanmiller in addition to my question above I am curious, can you deploy an Azure AD (no servers) and Windows 10 and still have the benefit of Group Policies? Reading some mixed info on that right now as well...

Dashrender

@bigbear said in Azure AD and OnPrem Windows Server 2016:

@scottalanmiller in addition to my question above I am curious, can you deploy an Azure AD (no servers) and Windows 10 and still have the benefit of Group Policies? Reading some mixed info on that right now as well...

What I have read recently, if you use the paid version of Azure AD, yes you can get some GPO options.

Dashrender

If your vultr RPS server doesn't have internet access, how will you connect to it?

Will you have a VPN into the private Vultr network that grants you access?

bigbear

@Dashrender said in Azure AD and OnPrem Windows Server 2016:

If your vultr RPS server doesn't have internet access, how will you connect to it?

Will you have a VPN into the private Vultr network that grants you access?
Supposedly be remote desktoping into the app server, then internally to the AD server. Or via console access.

As I think about this more, there is pfsenes in the ISO library. If not for a router/gateway from private networks to public, I dont know what else that would be there for. So it would seem to be possible.

scottalanmiller

@Dashrender said in Azure AD and OnPrem Windows Server 2016:

If your vultr RPS server doesn't have internet access, how will you connect to it?

It's the AD server that would be without Internet.

bigbear

@scottalanmiller right but if I use ISO library to launch a pfsense instance, trying to figure out how they would stop me from setting that as my gateway on the AD server.

scottalanmiller

@bigbear said in Azure AD and OnPrem Windows Server 2016:

@scottalanmiller right but if I use ISO library to launch a pfsense instance, trying to figure out how they would stop me from setting that as my gateway on the AD server.

They wouldn't stop you, it's just normal virtualization, nothing weird.

bigbear

@scottalanmiller I'm half way there, the AAD may work for RDS without the need for and AD server.

I'm waiting for my AAD DNA ip addresses to generate!

bigbear

UPDATE:

The lack of guides for this is really stunning. If you arent syncing with any OnPrem AD you have to have to have 365/Azure AAD users reset their password.

Officially Joined Server 2016 instance to ADD and rebooting now. I would hope RDSH will be easy to deploy next.

The cost of running the same spec VM on Azure is about $35 more than Azure. However the cost of VULTR goes up $56 for the minimum 2016 server to add a domain controller. Plus on Azure I wont have to manage Active Directory.

Maybe $150 in total cost to run a 14GB instance for RDSH isn't too shabby.

bigbear

And it's official, Azure AD only, no premise AD or synced AD, and a single RDSH deployed and working!

Lots of notes scratched out to the side.

Dashrender

Can you lay out the setup you put together.
Thanks

scottalanmiller

@bigbear said in Azure AD and OnPrem Windows Server 2016:

And it's official, Azure AD only, no premise AD or synced AD, and a single RDSH deployed and working!

Lots of notes scratches out to the side.

Sweet!!

bigbear

@Dashrender said in Azure AD and OnPrem Windows Server 2016:

Can you lay out the setup you put together.
Thanks

Yea I will definitely post up what I did. At the moment I am trying to connect a site to site VPN to a Vultr instance as Azure VM pricing is actually a lot higher now that I am comparing config details.

You have to deploy all this using the ASM model, it doesnt work in ARM. So using the classic GUI or ASM Powershell commands both seem to work.

1.) Create a classic vnet and subnet range in the data center where you will deploy servers that will joing AAD

2.) If you dont have Azure AD, deploy it. Its already deployed as Basic if you have Office 365. Under you AAD in the Classic Portal create a group with EXACTLY this name AAD DC Administrators Add your AAD users that will have permission to join servers to AAD, or that will manage AAD through the AD snap-ins.

3.) Under your AAD in the classic portal, go to configure. Half way down the page there is an option under domain services called Enable Domain Services For This Directory This is what provides Kueberos/NTLM to Azure AD.

Enable this and select the virtual network you created.

Eventually, under DNS Servers two IP addresses will appear. This took forever, like 20 minutes

4.) Go back to your virtual network and place those two DNS servers in your new virtual network. These will then be added to your virtual machines and are your AAD DNS Servers.

5.) At this point, for no known reason, you need to change your the Office 365 work password you are using if you have recently enabled password sync and/or user password management. I am not referring to syncing to a premise AD, that is not required. It appears to be for syncing AAD with Office 365 accounts.

6.) Deploy a Server 2016 VM in Classic Mode or using ASM powershell commands. It seems 2016 and 2012 are able to join Azure AD.

7.) Once you are in your new VM, use the FQDN (domain.com) of your active directory domain to join the domain. It will pop up for authentication. Use the UPN model without the .com. = domain\username and password. This would be any AAD user that was added to the special admin group you created above.

When you reboot you can login with your UPN or your email address if it matches the UPN model.

8.) From there, I deployed a basic RDS server and its been working great. A litty pricier than I first though, but I am working on linking the ASM Virtual Network to a VULTR deployed pfsense instance with a site to site VPN. So if that works an on premise server could also be joined. However I am sure not if this would be feasible given then any drop in internet or VPN connection would cause user's havoc.

bigbear

Dropping a note on this. Azure AD Domain Controller services does actually charge a minimum of .15/hour, so there is a $90 minimum cost for enabling this feature.

Not really a deal killer, but as @scottalanmiller alluded to they seem to spin up an S1 instance that you cant control and manage that NTLM/Domain Controller part for you.

stacksofplates

Coming from me who doesn't deal with Microsoft. This whole thread sounds soo confusing.

scottalanmiller

@stacksofplates said in Azure AD and OnPrem Windows Server 2016:

Coming from me who doesn't deal with Microsoft. This whole thread sounds soo confusing.

Seriously. Everything around Azure, Azure AD and AD is ridiculous and unnecessarily confusing. From confusing tech to intentionally overlapping names.

Dashrender

It sounds like a mixing of old and new ways to work.. /sigh.

scottalanmiller

@Dashrender said in Azure AD and OnPrem Windows Server 2016:

It sounds like a mixing of old and new ways to work.. /sigh.

That's exactly what it is. Just gatewaying to a traditional AD server.

bigbear

At least it doesn't require on-premises AD. It's "all cloud". It just seems like they are deploying a traditional or perhaps publicly unavailable version of AD to instances you can't see.

I have found a couple Microsoft-supported ways to use RDS on Vultr. There is a workgroup mode and a Microsoft support article says deploying AD on the RDS server is appropriate in small environments where there is one server. I could then at least sync to Office 365.

I was also looking at JumpCloud, some kind of cloud directory service probably similar to Amazons. I could possibly join 2016 server to that and sync that back with Office 365. But I haven't seen anyone talking about it out there.