Active Directory Configurations

Parent topic: Appendix for Configuring NPS

Deploying AD Domain System and Creating AD Users and Groups

Deploy and configure the Active Directory Domain System (AD DS) feature in the same Windows Server to integrate AD services with the NPS. This way, you can grant or deny access to the network based on users and User Groups.

Complete the following steps to deploy the AD services in the Windows server.

Note: After adding the AD DS role and completing the AD DS post-deployment configuration in the Server Manager, the Windows Server will reboot, requiring you to log in again to create the AD users and groups.

  1. Open the Server Manager.
    Note: Type “server manager” in the search bar in the Windows Server to quickly find the Server Manager application.

    Launching the Server Manager Application

  2. Add the AD DS role in the Server Manager. In the Server Manager Dashboard, click Add roles and features.
    The Add Roles and Features Wizard opens.
    1. In Before You Begin, click Next >.
    2. For the Installation Type, select Role-based or feature-based installation. Click Next >.
    3. For the Server Installation, keep the default selection, and click Next >.
    4. For the Server Roles, select Active Directory Domain Services. Click Next >.

      Selecting the AD DS Server Role

    5. In Features, keep the default selection, and click Next >.
      Note: The necessary features (directly related to the Server Roles you selected) are automatically selected and no additional features are required.
    6. In AD DS, click Next >.
    7. In Confirmation, click Install.
      The AD DS installation is now completed. You can close the Add Roles and Features Wizard window.
      Attention: A warning flag in the Windows Server Manager UI will notify you that post-deployment configuration action is required.

      AD DS Post-deployment Configuration Flag in the Server Manager Dashboard

  3. Perform the AD DS post-deployment configuration. Click the flag icon with the warning sign in the upper-right corner in the Server Manager Dashboard to display the list of pending tasks and click Promote this server to a domain controller.
    The Active Directory Domain Services Configuration Wizard opens.
    1. In the Deployment Configuration tab, select Add a new forest and type the Root domain name you would like to assign to this new domain. Alternatively, you can select the option Add new domain to an existing forest, in case a forest already exists. Click Next>.

      AD DS Deployment Configuration, Typing the Root Domain Name

    2. In Domain Controller Options, type a password for Directory Services Restore Mode (DSRM). Click Next >.
    3. In the following tabs, keep the default selection, and click Next > until you get to the Prerequisites Check tab.
    4. In the Prerequisites Check tab, ensure all prerequisite checks pass successfully, then click Install to begin the installation.
      Note: If any of the prerequisite checks do not pass, address each issue by following the instructions provided in the configuration wizard.

      Prerequisites Check

      After the Domain Server is installed, the session is logged out. The server will reboot.

  4. Log in using the newly configured domain credentials with the format Domain-Name\UserName.
  5. Open Active Directory Users and Computers. Open the Server Manager and click Tools > Active Directory Users and Computers.

    Opening Active Directory Users and Computers

  6. Create a user. Expand the domain name folder in the hierarchy, right-click the Users folder, and select New > User.

    Creating a New User

    The New Object - User window opens.

    1. Type the new user's first name, last name, and user logon name information in the corresponding fields. Click Next >.

      New Object - User Window

    2. Type the password for this user and enable/disable the available password preferences according to your needs. Click Next >.
    3. Confirm the details in the final step and click Finish.
      The user is created.
    4. Double-click the user you have just created to open the properties window of the user.
    5. In the Account tab, select Store password using reversible encryption and click OK.

      Enabling Reversible Encryption for the Stored Password

  7. Create a user group. Expand the domain name folder in the tree hierarchy, right-click the Users folder, and select New > Group.
    The New Object - Group window is displayed.

    Creating a New User Group

    1. Type the group name and keep the default selection for the Group scope and Group type options.
    2. Click OK.
      The new group is created.

      New Object - Group Window

      The User Group is created and listed in the Users folder.

  8. Add users to the User Group. Double-click the User Group you have just created and navigate to the Members tab.

    User Group Properties

    1. In the Members tab, click Add….
      The Select Users, Contacts, Computers, Service Accounts or Groups window is displayed.
    2. Type the logon name of the user in the Enter the object names to select field. Click the Check Names option to validate the object information. Click OK.

      The user is added to the members list of the group.

      Using the Name Validation Option

      Note: When using the Check Names option, if the logon name you entered is correct, the object name information will auto complete, otherwise, a notification window will inform you that the object was not found. To ensure the user exists, you may alternatively add the user to a group by navigating to the user's Properties folder, click the Member Of tab, click Add..., and enter the desired Group name

    3. Click Apply and OK.

      The user has been added to the User Group.

    You have successfully created a user and assigned it to a User Group in Active Directory (AD). The Network Policy Server (NPS) can now use these user's credentials to grant network access based on their group membership.

Deploying the AD Certification Authority

The IEEE 802.1X authentication protocol requires encrypted end-to-end communication. This is achieved through SSL certificates exchanged between the NPS server and the authenticator. Deploy an AD Certification Authority (AD CA) for the NPS to automatically get an SSL certificate assigned for the RADIUS services.

Complete the following steps to deploy the AD CA:

  1. Add the AD DS role in the Server Manager. In the Server Manager Dashboard, click Add roles and features.
    The Add Roles and Features Wizard window is displayed.
    1. In Before You Begin, click Next >.
    2. For the Installation Type, select Role-based or feature-based installation. Click Next >.
    3. For the Server Installation, keep the default selection and click Next >.
    4. For the Server Roles, select Active Directory Certificate Services. Click Next >.
    5. In Features, keep the default selection and click Next >.
    6. In AD CS, click Next >.
    7. In Role Services, select Certification Authority, and click Next >.
    8. In Confirmation, click Install.
      The AD CS installation is completed. You can close the installation window.
      Attention: A warning flag in the Windows Server will notify you that post-deployment configuration action is required.

      AD CS Post-deployment Configuration Flag in the Server Manager Dashboard

  2. Perform the AD CS post-deployment configuration. Click the flag icon with the warning sign in the upper-right corner in the Server Manager Dashboard to display the list of pending tasks and click Configure Active Directory Certificate Services on the destination server.
    The AD CS configuration wizard is displayed.
    1. In Credentials, keep the default selection (which is the same as the credentials for the AD DS). Click Next >.
    2. In Role Services, select Certification Authority. Click Next >.
    3. In Setup Type, select Standalone CA. Click Next >.
    4. In CA Type, select Root CA. Click Next >.
    5. In Private Key, select Create a new private key. Click Next >.
    6. In Cryptography, select 2048 for the key length and SHA256 for the hash algorithm. Click Next >.
    7. In CA Name type the Common name for this CA, and keep the other fields with the default details. Click Next >.

      AD CS Configuration, CA Name

    8. In Validity Period, select the validity period of your preference. Click Next >.
    9. In Certificate Database, keep the default selection. Click Next >.
    10. In Confirmation, click Configure. When the "Configuration succeeded" status appears, click Close to to close the wizard.

    You have correctly configured AD CS and an SSL certificate is automatically assigned to the NPS.