Deploy Azure AD Domain Service and Join a Server to the Domain

In this video, I go over deploying Azure AD Domain Services and configuring replication with an on-premises Windows Active Directory domain and Azure Active Directory. I go over deployment options and how to synchronize passwords from Windows and Azure directory services. A server is deployed and joined to the Azure AD Domain Services domain and users source from Azure AD and Windows AD log in using same sign-on credentials.
Link to script:
docs.microsoft.com/en-us/azur...

[@JoseAdolfoChancafeOblitas]

Thank you for your contributions, i ran the demo with success and i was able to understand better the way the components works. Got to be honest that i checked your video around 10 times, to understand and replicate the scenario. I'll start checking the rest of your material, pretty easy to follow.

[@Cryptika]

Brilliant video. This really helped me understand the process without having to waste time in my lab! Cheers

[@moatazyounis7107]

You are making everything simple and in-line. Realy Great Job.

[@Ciraltos]

Thanks a lot 😊

[@alokpratapsingh3893]

Very well explained. Thank you Travis, great work man !!

[@reelauthentictv]

GREAT VIDEO. Very informational and helped me out a ton!!!! Thanks so much Travis

[@312Duck]

Excellent explanations all the way around - thank you!

[@AshishShiwakoti]

This is my 8th time watching your video. After the 8th attempt, I have this screen for inserting username and password to connect my VM server to an azure domain. I had to change DNS server IP in the interface somewhere. I do not know. But I am here. Will learn slowly. I have to use bastion to connect to a server. RDP did not work for me. You have earned one like and one subscriber. Thank you. Keep educating.

[@johnnewbegin8971]

Thank you. Your video really helped me out. I followed step by step and went over it again and again until I got it all right

[@Ciraltos]

Glad it helped!

[@joelfranks1997]

Best video out there for this subject. Gold. Thanks!

[@Ciraltos]

Glad you enjoyed it!

[@abulaith4485]

Very informative , thank you.

[@550891]

Excellent explanation. thank you!

[@ace4love]

You have a true talent for teaching! Wonderful work! One thing I can not find an example of anywhere is a demo of a small office with a handful of desktops connecting to an Azure domain. All examples reference an on premises AD and using AD Connect to sync. Or many examples of AD domain with joining Azure VMs. Would love to see an example of this. More and more are wanting to ditch their on premises servers for Azure AD services.

[@gastonaxellacuesta6441]

Hey! A year later but would be useful to know if you found anything about this.

[@ace4love]

@@gastonaxellacuesta6441 Not found any real examples of using Azure domain services as a domain controller. It is said that the new domain as a service is able to do this, but no examples. In the cases where we needed a small office to have such security control, we ditched on prem AD and used a product like DUO or Okta. Okta being the better of the two. In our cases, the companies only had cloud apps and Okta was a gate keeper for those portals.

[@BryanV-ju5gd]

@@ace4love Since its been another year since the last reply I thought I would ask if you ever found a solution to joining a domain in Azure domain services? We just started looking into this ourselves but it's pretty hard to find examples out there.

[@bijukumarbarik3259]

This is very helpful for everyone.

[@rforestier]

Very good info. Super fan of the channel

[@anilmahadev6810]

very easy and simple! Thanks!

[@kennydelapiedra1643]

Thank you for this very informative video.

[@partyyydude]

Fantastic video - explains the concept and demo very well. Thank you!

[@Ciraltos]

You're very welcome!

[@alejandromartinezcoviza8728]

It is really helpful. Thanks a lot!!!

[@raalk]

This helped me so much, thank you!

[@Ciraltos]

You're so welcome!

[@NickLaoutaris]

amazing video Travis!

[@mathewmcfool]

Great stuff, I have to do this for my employer thanks!

[@Ciraltos]

Any time!

[@Slayer_of_Asian_Stacys]

My goodness. Very informative video. I dropped a like and subscribed.

[@Ciraltos]

Awesome, thank you!

[@balaji830]

Travis, thanks for this great video. This does clarifies quite a lots of things. But I do have some questions. Azure managed AD DS is a separate domain altogether. How does users authenticate to this domain? Do we need to join the machines to this AD as well (we cannot have machines joining multiple domains)? May be I am still confused on how this helps? Especially you gave an example of Lift & Shift of an IIS website. I know you did password hash synch. But if the website is now connected with this new domain, how can users have SSO capability to this IIS website, if users are on On-premises Domain? Any explanation would be appreciated.

[@baabujatin]

Awesome stuff as always !! Thanks

[@Ciraltos]

Glad you enjoyed it

[@christianibiri]

Great video and very detailed.

[@Ciraltos]

Glad you liked it!

[@JamesBrodski]

What a great video! Great explanation

[@Ciraltos]

Glad it helped!

[@fsacrini]

Thanks so much!!!

[@Beyond_the_Cloud_with_Azure]

Thanks a lot fo the great video. I followed it and it succeeded It really very helpful.

[@Ciraltos]

Glad it helped!

[@Beyond_the_Cloud_with_Azure]

Travis Roberts I have one question I will be glad if you can help, I have a VM in another VNET I created peering between two Vnets and Added the Ips of ADDS as a DNS for this VNET, but the VM not able to resolve any other hosts in any other VNets. Any Idea how can I solve this ?

[@joshc2764]

Thank you!

[@aravinda40]

Thanks Travis. I m planing to do the same soon. I need your advice for this. I need to keep my on-premise as it is and few remote offices i need users to connect to Azure directly with ADDS. My point is what about the group policy that we already using in local AD? will they work with Azure AD connected PC's and users? Right now i m using AD connect to SSO and password sync for azure from local AD.

[@ragaikaddiss6765]

Thank you. This is a great resource. I have a question please. What if you are not Password Hash Sync? For instance how would it work if you have pass through authentication enabled instead? Thank you.

[@navinballa]

Great efforts, I found that you worked hard in Midnight for this recording, correct?

[@ronhowex]

Great video. Thank you! How does this square with virtual machine managed identities where you can provide access to a machine (i.e. Administrators group membership or Remote Desktop Users group membership) via RBAC?

[@skutsenkow]

This video was excellent. Do you have any advise for customer wanting to get rid of all on-prem servers and currently doing AADC sync? Can those accounts be "flipped" to cloud-only and if so, would the NTLM password hash remain?

[@cangrejoestadistico3771]

Great video Travis. Thanks I have a question. What about if I only have services in Azure. Not on-prem services. Is it recommended to have Azure ADDS? I want to allow all my users to login with their Azure account to Windows, Linux servers and some services that allow LDAP.

[@jeffbrown1591]

Thanks!

[@harrydiggens4234]

Great video. Do you still need the legacy powershell script as the new version of connect seems to have an option for this.

[@CuongNguyen-sg3xf]

Ok I love You tks sir

[@marekzlatnik744]

nice job!!

[@davidfarrell1062]

So is this an extension of Site AD then or is it just using the Azure AD to simulate a separate AD that servers can connect to ?

[@pradeeprajurs9080]

Good Video. Leave it to MSFT to make things this confusing and complicated!

[@Southpaw07]

very informative. TY Travis . i would like to understand if there is a potential security concern enabling legacy password hash sync.

[@Ciraltos]

No good way to answer that. By moving the hashes to Azure AD, the attack surface area against those hashes increase, but that doesn't necessarily mean they are less secure. The hashes are one-way and encrypted in transit. If security is a concern, Azure AD DS supports a one-way outbound trust. You could set up a trust to your user domain to handle authentication instead of passing the hash.

[@Southpaw07]

@@Ciraltos TY Travis , certainly helps clarify my concerns

[@faisaldarbar]

Your video helped a ton. We have the job done. Only one question is that do we need to promote the windows server installation on the VM to a domain controller since we see a flag in server manager notifications. Please advise on this.

[@Ciraltos]

There is no Domain or Enterprise Admin accounts with Azure AD DS. There is no way to add additional Domain controllers outside Azure AD DS (on prem for example) There are a few other limitations www.ciraltos.com/dont-use-azure-ad-domain-services-to-replace-windows-domain-controllers/.

[@michaelbode9744]

Is it possible to actually "manage" Azure AD DS from a Windows Server VM? I know I can "see" Azure AD DS from my Windows Server VM, as I followed your video(s). But rather than having to login to Azure to create a new group and and members (or similar), it would be swell if I could just go into Windows Server to do it like we have for the last 30 years. Is that doable? and how are 2 people not gonna like this video? It's a perfect training video.

[@Thebeatpresident]

Hello! I have really learned a lot from your videos. Thank you. I have a question as it relates to AD Connect. Every time I try to connect to Azure ADDS with the connect tool, it gives me a permissions error saying please use an enterprise admin account. I also do not have permissions in the Active Directory Administrative center after I join the domain. I have added users into the AAD DC Administrators Group. I have followed your video step by step 4-5 times and I cannot figure this out. Can anyone offer some advice?

[@philipappiah2068]

Question ! Can you add an existing AVD Pool to on prem AD or DC after the Pool was deployed without Active directory settings?

[@shubhamgupta3485]

If we are using ADFS for the single sign on for on prem ad users with azure ad via Azure AD CONNECT , enabling the password hash sync for azure adds by running the powershell script will not have any affect on the ADFS sso ?

[@popotit0]

Hi Travis, thank you for the video, very clear. Silly question here.... would be possible to setup a small business (let's say 15 users) with Azure AD DS only? (no on-prem infrastructure...no Windows AD.... 100% cloud).

[@nandankumar-po4ck]

I have the same question, having a on prem ADDS is very expensive for my Company

[@Ciraltos]

Azure AD DS isn't free, It's about $109 US and has a lot of the same management overhead (users, groups, GPO's). It was intended as an option for specific services, such as a legacy web site, that requires Windows AD without extending Windows AD to Azure. With that said, it could work for a small company. My concern would be if that company grows it may outgrow Azure AD DS. Take a look at some of the limitation that come with Azure AD DS www.ciraltos.com/dont-use-azure-ad-domain-services-to-replace-windows-domain-controllers/ For a small company, it may be better to avoid AD DS, Windows or Azure, and just use Azure AD and Azure AD Joined VM's instead. -Travis

[@elorcohen1326]

Thanks a lot for making this video, I'm getting promote to domain controller task but when trying to promote with any global admin I use giving me this error: "could not log onto the domain with the specified credential supply a valid credential and try again" Checked and that's not credentials problem

[@tyraelmain5219]

Hi, do we still need a virtual server in order to use the ADDS? I have been told that the ADDS is already enough to use for normal AD function such as user creation..etc.

[@nightwintertooth9502]

I havent thusfar found a way to deploy this resource in powershell from the azure CLI or terraform. Is there a way to automate creation of ADDS?

[@vivek.padale]

Awesome video Travis. Please help me with my query, if my on-prem AD and AAD-DS are sync via AAD connect, can i use AAD-DS for authenticating and authorizing on-prem users for accessing internal or intranet resources. And also can i use AAD-DS as a DR for on-prem AD. Regards, Best of Luck!!!!

[@Ciraltos]

Although an account can be synced from Windows AD, to Azure AD, and Azure AD DS, they exist in two different domains and the Azure AD DS domain does not support trust relationships. Based on what you are asking, you may want to consider extending your domain to Azure by placing a DC in Azure.

[@vivek.padale]

@@Ciraltos Thanks Travis, So if my on-Prem AD goes down then can the on-prem users access intranet resources by getting authenticating and authorizing via Azure ADDS

[@lordfraybin]

I've got Azure AD DS syncd with my on prem, but when going to force the user password reset, it says I dont have a license to do password resets?? Did something change in azure since this tutorial?

[@Ciraltos]

You may be going into Azure AD, Password Reset. That’s for Self Service Password Reset and requires an Azure AD Premium license. Go to the individual user and select the option to reset the password to force a password reset.

[@owaisaziz8537]

Can we use azure ad services to administrate devices like mac linux and win and how much we can can we encrypt devices authentication group policy's for linux and mac too patch management etc

[@mahsaataolahi463]

Thank you so much for your useful video, Can I ask you one question? you created a VM on the azure portal and set the same virtual network, what we should do when we have an on-premise Windows server, I mean one Windows server that is installed on local servers not azure portal. I hope you can help me in this way :)

[@Ciraltos]

It is possible to join the on-prem server to the Azure AD DS domain providing there is private connectivity between the networks, such as site-to-site VPN or Express Route. Also, DNS has to point to Azure AD DS.

[@mahsaataolahi463]

​@@Ciraltos Thanks for your information, but it was a little complicated for me, how can I have a site to site VPN between my local server and azure portal? Do you have any video or article regarding this?

[@Ciraltos]

I do. kzbin.info/www/bejne/h4KXYZqurd2Hbrs

[@cusman]

What else is needed so that a new Windows 11 laptop can sign-on using Azure AD / Microsoft 365 account that now has Enterprise Azure AD service (cloud-only)? Secure LDAP setup? Anything else?

[@bobbydk123]

We use AD to AAD with PTA. If we deploy AADDS will AAD be able Auth against AADDS if the PTA connection goes down?

[@karanpandya6448]

Travis i am able to login with synced identity from on prem(synced to Azure adds) to a managed domain joined machine WITHOUT running this script.how is that possible? Am i missing anything?

[@yatinnaik3011]

You could have also added the 4th type; AD LDAP

[@shahidrabbani6458]

Hi, I configured Azure AD and Azure ADDS and authenticate my windows10 machine with azure AD. I created an OU in my AADDS and moved that user in OU. I created GPO and configured few settings but its not applying to my Windows10. Is there any step is required to enforce GPO to my windows10?

[@Ciraltos]

The client computer will need to be Azure AD DS joined for GPO's to apply.

[@naturevibezz]

Company A is a start-up company that wants a cloud only infrastructure with Office 365 and Azure. They don't want to build on-premises servers except for workstations to be used by the employees. 1. If we use AAD DS, can we join workstations on-premises without even building a domain controller locally? 2. If yes, do they need a site to site VPN for this?

[@Ciraltos]

On-premises computers can join Azure AD DS and it would require a VPN between on-premises and Azure. Azure AD DS is not intended as a replacement for Windows AD. I did a post on that here www.ciraltos.com/dont-use-azure-ad-domain-services-to-replace-windows-domain-controllers/

[@fbifido2]

Question: - say you have AD (on-prem), then AAD, which you use AAD connect to sync password hash, then you deploy AADDS, reset all user password. 1. how do you remove AD (on-prem)? (i have move all my servers to Azure IaaS) 2. how do i clean up after AD? 3. my end product is to only use AAD join + Intune, with all client device and servers.

[@eashwerdev518]

Hello Travis does the uid change eg if i create a user in Active directory with a uid=80000 and then post syncing users and password and registering the vm to to azure ad domain service will the uid remain same as the uid in legacy active directory or does azure active directory give its own uid

[@eashwerdev518]

also can we RDP to the azure active directory domain services

[@patricksegovia918]

After Azure ADDS is added and the server joins the domain, can RDS be deployed on that server?

[@jacoventer8763]

Does the script solve the issue for guest users' passwords maybe?

[@Ciraltos]

Not sure what issue that is. B2B users don't have a password in Azure AD so they can't use Azure AD DS. docs.microsoft.com/en-us/azure/active-directory-domain-services/faqs#can-guest-users-invited-to-my-directory-use-azure-ad-domain-services

[@TheVeeOhla]

Hiya, Great video, couldn't you technically "set user to change password at next logon" to True and False and AD will see that as a "password change" for all users?

[@Ciraltos]

Azure AD doesn't have the legacy NTLM password hash, it needs to create it when the password is changed.

[@TheVeeOhla]

@@Ciraltos ahh, usually onPrem AD sees toggling that on and off as a "password change" I'm in the middle of configuring my AADDS. I'm going to test and see if it tricks it lol

[@BigRedAdventures]

How would you use this for AWS Workspaces?

[@ritenmehta9454]

Good video sir , But I have some questions in my organization around 3000/- employees and must be 1000/- of laptops desktops printers plotters and so on and we have windows server R2 2012 Ad So what could I first to join all the things on azure cloud our IP RANGE IS 172.16.16-21.1-255 how to separate on cloud for each series. Thank you.

[@LoudyCan]

did you get the answer for this, I have the same question

[@ashoksan14]

what about network setting ? do we need check AD ports, subnets to communicate from Azure AD new VM subnet.

[@Ciraltos]

Azure AD DS requires a network during deployment. All subnets are routable by default on a VNet. As long as the VM is on the same VNet, it should be able to reach Azure AD DS. DNS has to be configured to point to Azure AD DS, that is one of the steps outlined.

[@ashoksan14]

@@Ciraltos perfect, worked for me, i setup Azure ADDS lab as per your video and joined vm to the Azure adds. Next i have to built new vm in different subnet with peering. I hope that take care network connection between Azure Adds and new vm. Let me know if i missed any task, please share any relevant documents.

[@georgec.underwood6952]

Please please please help me, i did everything like you but I still got the "The requested account is currently locked out and may not be logged on to" , I didn't write my password or user name wrong, but is more than the 15'st time that this is happening please help.

[@Ciraltos]

Be sure to change the password on the account after enabling Azure AD DS. If the account is sourced from Windows AD, be sure to enable legacy password replication to Azure AD.

[@georgec.underwood6952]

@@Ciraltos why is my account not eligible can you connect to team viewer with me

[@michaelbode9744]

You have to change the password of any account trying to logon. If you try too many times without doing so, that account will be locked out for a minimum of 30 minutes with no way to unlock it. *I ran into this same situation. So, logon to portal.office365.com as that user, then manually change the password. *This is what I did once I remembered I missed this step. Even after changing it, I still had to wait 30 minutes because the account was already locked.

[@Ciraltos]

Here is a link to an overview of the password change requirement. Any Azure AD account replicated to Azure AD DS needs a password change before it can log in. docs.microsoft.com/en-us/azure/active-directory-domain-services/tutorial-create-instance#enable-user-accounts-for-azure-ad-ds

[@naturevibezz]

Join my local system to a domain. Restrict users from saving files to a specific location. Employees could log in to any laptop/pc using credentials and all their files will be there. Apply group policies, OU's etc Note that we don't have any on-premises AD domain controllers. Can I get the above requirements using Azure AD and Azure AD domain services? If not please specify what all thongs can be done among them using Azure AD and Azure AD domain services.

[@stevete6425]

How can I join my pc at home from the Azure AD domain

[@mike4088]

Can you use this as a replacement to an onprem dc?

[@Ciraltos]

Kind of, but with limits. It looks like you saw the video that goes over the different version of AD.

[@punitpatel2818]

I have some user in gsuit and I want login with azure ad user can you help me

[@dirtpipedan]

2:22AM? Get some sleep Travis!

[@deanvukovic9069]

Cloud stuff looks complicated. I started recently new job and they use all cloud and for me so far job is bene boring and not much things to do in IT Support.

[@_drummerivaniiko_3269]

Hi travis, hope your are well, question: how do i create a VM on azure and then add it to an existing on premise domain. We need to expand our file server to the cloud syncronizing users credentials.

[@UTCUTR]

Doesnt work

[@deepakkprajapati2417]

The world has changed, worst, unnecessary, vulgar videos has more likes and the video which is giving knowledge has less like. Very disappointing.

[@TravelIndiaSolo]

Great, very informative video. I need some help, We have azure with a domain xyz.com, I setup my ADDS as abc.com. When I try to join a personal computer, it doesn't give me the option to join abc.com, it takes me to xyz.com by default. How can I change it and choose abc.com?

[@syedmahmudulhasan3468]

Awesome stuff as always !! Thanks

[@Ciraltos]

My pleasure!

[@archielaffan1249]

Does Azure AD DS need to have a S2S or P2S VPN similar to AD DS. i.e. to join to a domain etc/authentication?

[@Ciraltos]

Yes, there has to be a private connection like Windows AD DS. VNet peering is an option for other Azure VNets.

[@archielaffan1249]

@@Ciraltos thank you