@Dashrender said in Azure AD and OnPrem Windows Server 2016:
Can you lay out the setup you put together.
Thanks
Yea I will definitely post up what I did. At the moment I am trying to connect a site to site VPN to a Vultr instance as Azure VM pricing is actually a lot higher now that I am comparing config details.
You have to deploy all this using the ASM model, it doesnt work in ARM. So using the classic GUI or ASM Powershell commands both seem to work.
1.) Create a classic vnet and subnet range in the data center where you will deploy servers that will joing AAD
2.) If you dont have Azure AD, deploy it. Its already deployed as Basic if you have Office 365. Under you AAD in the Classic Portal create a group with EXACTLY this name AAD DC Administrators Add your AAD users that will have permission to join servers to AAD, or that will manage AAD through the AD snap-ins.
3.) Under your AAD in the classic portal, go to configure. Half way down the page there is an option under domain services called Enable Domain Services For This Directory This is what provides Kueberos/NTLM to Azure AD.
Enable this and select the virtual network you created.
Eventually, under DNS Servers two IP addresses will appear. This took forever, like 20 minutes
4.) Go back to your virtual network and place those two DNS servers in your new virtual network. These will then be added to your virtual machines and are your AAD DNS Servers.
5.) At this point, for no known reason, you need to change your the Office 365 work password you are using if you have recently enabled password sync and/or user password management. I am not referring to syncing to a premise AD, that is not required. It appears to be for syncing AAD with Office 365 accounts.
6.) Deploy a Server 2016 VM in Classic Mode or using ASM powershell commands. It seems 2016 and 2012 are able to join Azure AD.
7.) Once you are in your new VM, use the FQDN (domain.com) of your active directory domain to join the domain. It will pop up for authentication. Use the UPN model without the .com. = domain\username and password. This would be any AAD user that was added to the special admin group you created above.
When you reboot you can login with your UPN or your email address if it matches the UPN model.
8.) From there, I deployed a basic RDS server and its been working great. A litty pricier than I first though, but I am working on linking the ASM Virtual Network to a VULTR deployed pfsense instance with a site to site VPN. So if that works an on premise server could also be joined. However I am sure not if this would be feasible given then any drop in internet or VPN connection would cause user's havoc.