Windows-Server/checklist.txt at master · luisgiraldo/Windows-Server · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
This checklist intends to provide a high-level overview of a Windows AD infrastructure set-up that will
support Mac OS X clients, RADIUS and VPN authentication, and ExtremeZ-IP (optional) for AFP connectivity.
It first conceived as a result of a presentation given at Penn State MacAdmins Conference in 2014.

- General Set-up
    - Change server name
    - Install updates
    - Set static IP address
    - Gotcha: Require administrator to use a password - net user <username> /passwordreq:yes
- Add Roles
    - Active Directory Domain Services
    - DNS Server
    - File Services
    - Network Policy and Access Services
    - Remote Access
    - Web Server (IIS)
- Add Features
    - Shadow Copy
    - Windows Search Service
- Add Role Services
    - Direct Access and VPN (RAS)
- DC Promo - Promote server to domain controller
- Launch DNS, add reverse zone, update PTR for the server’s A record
- Organize AD
    - Create OU for Org
        - Create Users OU
        - Create Groups OU
        - Create Computers OU
        - Create Servers OU
        - Create Roles OU
    - Add Users
        - Set user’s home profile location, e.g. H = \\hostname.domain.private\Homes\testuser
    - Add Groups (e.g. VPN, RADIUS, or share access), add users to groups
- Launch IIS > Server Certificates > Create self-signed cert
- Configure RRAS
    - Enable RRAS Network Policy (Grant Access)
    - Check Network Policy Conditions
        - NAS Port Type (VPN)
        - Tunnel Type (ESP, L2TP)
        - User Group (VPN Group)
    - Launch wizard for wireless RADIUS configuration
- Enable Shadow Copy (Start > Admin Tools > Computer Mgmt > Shared Folders > RC-All Tasks > Select Volume > Enable
- Shares
    - Create “Homes” share, for housing user home folders
    - Create “Generic” share, for anything else (if required for testing)
- Mac client
    - Bind Mac client to AD
    - Check AD plug-in settings:
        - NHD testing
            - Uncheck “Force local home directory on startup disk”
            - Check “Use UNC path from Active Directory to derive network home location”
            - Confirm protocol (SMB or AFP), choose AFP if using ExtremeZ-IP, for instance
        - PHD testing
            - Check “Create mobile account at login”, and “Force local home directory on startup disk”
    - Log out of Mac client admin account, login as test AD user