Join the Windows Server VM to the Azure AD Domain Services managed domain (2023)

Azure Active Directory Domain Services (Azure AD DS) provides managed domain services such as Domain Join, Group Policy, LDAP authentication, Kerberos/NTLM that are fully compatible with Windows Server Active Directory. With an Azure AD DS managed domain, you can provide domain-join and VM management capabilities in Azure. This guide shows you how to create a Windows Server VM and then join it to a managed domain.

In this guide, you'll learn how to:

If you don't have an Azure subscription,Create an accountbefore you start.

Prerequisites

To complete this tutorial, you'll need the following resources:

• An active Azure subscription.
  • If you don't have an Azure subscription,Create an account.
• An Azure Active Directory tenant associated with your subscription, synced to an on-premises or cloud-only directory.
  • if necessary,create an Azure Active Directory tenanttheassociate your Azure subscription with your account.
• The Azure Active Directory Domain Services managed domain is enabled and configured in your Azure AD tenant.
  • if necessary,create and configure an Azure Active Directory Domain Services managed domain.
• A user account that is part of a managed domain.
  • Make sure that Azure AD Connect password hash synchronization or self-service password reset has been performed so that the account can connect to the managed domain.
• An Azure Bastion host deployed in an Azure AD DS virtual network.
  • if necessary,create an Azure Bastion host.

If you already have a VM you want to join the domain, skip to the dedicated sectionjoin the VM to the managed domain.

Sign in to the Azure portal

In this tutorial, you'll create a Windows Server VM to join a managed domain using the Azure portal. To get started, first sign in toBrama Azurni.

Create a Windows Server VM

To see how you can join a computer to a managed domain, let's create a Windows Server virtual machine. This VM is connected to an Azure virtual network that connects to a managed domain. The process of joining a managed domain is the same as joining a regular local Active Directory Domain Services domain.

If you already have a VM you want to join the domain, skip to the dedicated sectionjoin the VM to the managed domain.

1. From the Azure portal menu or fromDompage, selectCreate a resource.

2. Zstart, to chooseWindows Server 2016 Data Center.

   

3. uBasicswindow, configure the basic settings of the virtual machine. Leave the default settings forAvailability options,Picture, AndSize.

   Parameter	suggested price
   Resource group	Select or create a resource group, for examplemyResourceGroup
   The name of the virtual machine	Enter the virtual machine name, for examplemy virtual machine
   Area	Select the region where you want to create the VM, for exampleeastern United States
   User Name	Enter the username for the local administrator account that you will create in the VM, for exampleblue user
   Password	Enter and then confirm a strong password that will be generated on the VM by the local administrator. You are not providing domain user account credentials.

4. By default, VMs created in Azure are accessible from the internet using RDP. When RDP is enabled, automatic login attacks are likely to occur that can disable accounts with common names such asAdmintheAdmindue to multiple consecutive failed connection attempts.

   RDP should be enabled only when necessary and limited to a set of authorized IP address ranges. This configuration helps improve the security of the VM and reduces the attack surface. Or create and use an Azure Bastion host that only allows access through the Azure portal over TLS. In the next step of this tutorial, use the Azure Bastion host to securely connect to the VM.

   BelowPublic ports of entry, To chooseNO.

5. When you're done, selectNext: Disks.

6. From the drop-down menu forOperating system disk type, to chooseStandard SSD, then selectNext: networking.

7. The VM must be connected to an Azure virtual network subnet that can communicate with the subnet where the managed domain is located. We recommend placing the managed domain in its own dedicated subnet. Don't deploy a VM in the same subnet as the managed domain.

   There are two main ways to deploy a virtual machine and connect it to the appropriate virtual network subnet:

   • Create or select an existing subnet in the same virtual network where the managed domain is configured.
   • Select a subnet in the Azure virtual network connected to it usingAzure virtual network peering.

   If you select a virtual network subnet that is not connected to the subnet of the managed domain, you cannot connect the virtual system to the managed domain. For this tutorial, we'll create a new subnet in an Azure virtual network.

   uNetworkingin the window, select the virtual network where the managed domain is configured, for exampleaaads-vnet

8. Existing in this exampleaaads subnetappears with which the managed domain is associated. Do not connect the VM to this subnet. To create a subnet for the virtual machine, selectSubnet configuration management.

   

9. In the left menu of the virtual network window, selectAddress space. The virtual network is created with a single address space10.0.2.0/24, used by the default subnet. Other subnets like forworkloador Azure Bastion may already exist.

   Add an additional IP address range to the virtual network. The size of this address range and the actual range of IP addresses to use depends on other configured network resources. The IP address range cannot overlap with an existing address range in your Azure or on-premises environment. Make sure the IP address range is large enough for the number of VMs you want to deploy in the subnet.

   In the following example, an additional range of IP addresses10.0.5.0/24is added. Choose when you're readyRescue.

   

10. Then in the left menu of the virtual network window, selectSubnets, then select+ Subnetto add a subnet.

11. to choose+ Subnet, then enter the subnet name, for examplemanagement. DefineAddress range (CIDR blocks), Such as10.0.5.0/24. Make sure this IP address range doesn't overlap with other existing Azure or on-premises address ranges. Leave other options as default, then selectAll right.

    

12. It takes a few seconds to create a subnet. Once created, selectXto close the subnet window.

13. Come back toNetworkingto create a virtual machine, select the created subnet from the drop-down menu, for examplemanagement. Double check that the correct subnet is selected and don't deploy the VM in the same subnet as the managed domain.

14. ForPublic IP, To chooseNOfrom the drop-down menu. Since you're using Azure Bastion to connect to management in this guide, you don't need the public IP assigned to the VM.

15. Leave other options as default, then selectManagement.

16. he would beBoot diagnosticsI am doingFrom gave from. Leave other options as default, then selectBrowse + Create.

17. Check the virtual machine settings, then selectcreate.

Creating a virtual machine takes a few minutes. The Azure portal displays the deployment status. When the virtual machine is ready, selectWhen will he find again.

Log in to the Windows Server VM

Use Azure Bastion host to securely connect to VMs. With Azure Bastion, a managed host is deployed in your virtual network and provides RDP or SSH internet connections to your VMs. Virtual machines don't require public IP addresses, and you don't need to open NSG rules for external remote traffic. You connect to the VM using the Azure portal in your browser. if necessary,create an Azure Bastion host.

To use bastion host to connect to a VM, do the following:

1. uReviewwindow for the virtual machine, select itI connect, LaterBastion.

   

2. Enter the credentials for the VM registered in the previous section, then selectI connect.

   

If necessary, allow your browser to open pop-ups to display the Bastion link. It takes a few seconds to connect to the virtual machine.

Join the VM to the managed domain

Now that we've created the VM and established an Internet RDP connection using Azure Bastion, let's now join the Windows Server VM to the managed domain. This process is the same as joining a computer to a regular local Active Directory Domain Services domain.

1. IServer administratordoes not open by default when you connect to a virtual machine, select itPrinciplemenu, then selectServer administrator.

2. In the left windowServer administratorwindow, selectlocal server. Belowreal estatein the right pane, selectGrupa Radna.

   

3. uSystem propertieswindow, selectTo changeto join the managed domain.

   

4. uSectorenter the name of the managed domain, e.gaddcontoso.com, then selectAll right.

   

5. Enter your domain credentials to join the domain. Provide credentials for a user that is part of the managed domain. The account must be in a managed domain or Azure AD tenant - Accounts from external directories associated with the Azure AD tenant cannot be properly authenticated during the domain join process.

   Account credentials can be specified in one of the following ways:

   • UPN format(recommended) - Enter the user principal name (UPN) suffix for the user account as configured in Azure AD. For example, the user's UPN suffixcontosoadminit would becontosoadmin@aaddscontoso.onmicrosoft.com. There are a few common cases where the UPN format can be reliably used to connect to a domain and notSAMA account nameform:
     • If the user's UPN is long, e.gdee has a very long name,SAMA account namecan be generated automatically.
     • If multiple users have the same UPN prefix in the Azure AD tenant, for exampleDee, ISAMA account nameformat can be generated automatically.
   • SAMA account name format- Enter the account nameSAMA account nameform. For example,SAMA account nameusercontosoadminit would beAADDSCONTOSO\contosoadmin.

6. It takes a few seconds to connect to the managed domain. When you're done, the domain will greet you with the following message:

   

   to chooseAll rightto continue.

7. To complete the managed domain join process, restart the VM.

After the Windows Server VM restarts, all policies applied to the managed domain are sent to the VM. You can also now log into the Windows Server VM with the appropriate domain credentials.

Resource cleaning

In the following tutorial, you'll use this Windows Server VM to install management tools that allow you to manage your managed domain. If you do not want to continue with this series of guides, please read the cleaning steps belowdelete the virtual machine. Otherwise,go to the next tutorial.

Disconnect the VM from the managed domain

To remove the VM from the managed domain, follow the steps againjoin the VM to the domain. Instead of joining a managed domain, choose to join a workgroup, which is the default settingWORKING GROUP. After the VM restarts, the compute object is removed from the managed domain.

if youdelete the virtual machinewithout domain separation, the abandoned compute object remains in Azure AD DS.

Delete the virtual machine

If you do not intend to use this VM with Windows Server, delete the VM by following these steps:

1. Choose from the menu on the leftResource groups
2. Select your resource group, for examplemyResourceGroup.
3. Select your virtual machine, e.gmy virtual machine, then selectDelete. to chooseIto confirm the deletion of the resource. Deleting a virtual machine takes a few minutes.
4. After deleting the VM, select the OS disk, network interface card, and any other resources frommyVM-prefix and delete them.

Troubleshoot domain join issues

The Windows Server VM should be successfully joined to the managed domain in the same way that a normal local computer would be joined to an Active Directory Domain Services domain. If the Windows Server VM is unable to join the managed domain, there is a connectivity or credential issue. Read the troubleshooting sections below to successfully join the managed domain.

Problems with connection

If you don't receive a message asking for credentials to join the domain, there's a connection problem. The virtual machine cannot connect to the managed domain in the virtual network.

After completing each of these troubleshooting steps, try rejoining the Windows Server VM to the managed domain.

• Make sure the VM is connected to the same virtual network where Azure AD DS is enabled or has a direct network connection.
• Try to ping the DNS domain name of a managed domain such asping aaddscontoso.com.
  • If the ping request fails, try ping the IP addresses of a managed domain such asping 10.0.0.4. The IP address of your environment is displayed atreal estateafter selecting the managed domain from the list of Azure resources.
  • If you can ping the IP address but not the domain, DNS may be misconfigured. Confirm that the IP addresses of the managed domain are configured as DNS servers for the virtual network.
• Try flushing the DNS resolver cache on the VM withipconfig /flushdnsmandate.

Credential issues

If you receive a message asking for domain-join credentials, but you get an error after entering these credentials, the VM may be joining the managed domain. The provided credentials do not allow the VM to join the managed domain.

After completing each of these troubleshooting steps, try rejoining the Windows Server VM to the managed domain.

• Make sure the specified user account belongs to a managed domain.
• Confirm that the account is part of an Azure AD managed domain or tenant. Accounts from external directories associated with an Azure AD tenant cannot be properly authenticated during the domain join process.
• Try using the UPN format to specify credentials such ascontosoadmin@aaddscontoso.onmicrosoft.com. If there are multiple users in the tenant with the same UPN prefix, or if the UPN prefix is ​​too long,SAMA account namefor your account may be created automatically. In these cases,SAMA account nameyour account format may be different from what you expect or use for your local domain.
• Check if you havepassword synchronization is enabledin a managed domain. Without this configuration step, the necessary password hashes will not exist in the managed domain to properly authenticate the connection attempt.
• Wait for password synchronization to complete. When a user account password is changed, automatic background sync from Azure AD updates the password in Azure AD DS. It takes some time before the password becomes available to use the domain connection.

Next steps

In this guide, you've learned how to:

To manage a managed domain, set up a management VM using the Active Directory Admin Center (ADAC).