Automating Dcpromo

The DNSOnNetwork and AutoConfigDNS statements obviously refer to DNS. DNSOnNetwork tests for a properly configured DNS system on the network. AD simply can't run without a correctly configured DNS infrastructure. Therefore, before trying to create a DC, Dcpromo performs a few tests to ensure that DNS is correctly implemented. You can save a few seconds by setting DNSOnNetwork to No, thereby disabling those tests, but I've set it to Yes in this sample script because double-checking DNS's status doesn't hurt.

What if Dcpromo finds that DNS isn't correctly implemented? In that case, AutoConfigDNS gives Dcpromo the power to automatically set up the DC as a DNS server, with just enough intelligence to serve the needs of this DC. You should always—always—set this value to No. AD won't work without a properly configured DNS infrastructure, and Dcpromo doesn't properly configure DNS. If DNS isn't working perfectly, you want Dcpromo to fail.

The AllowAnonymousAccess and RebootOnSuccess statements finish this answer file. The AllowAnonymousAccess statement answers the Dcpromo wizard's question about whether you have Windows NT 4.0­based RAS servers in your network. When Dcpromo configures a new DC to accommodate NT 4.0 RAS servers, it does so by loosening security. Essentially, the statement specifies whether you want to give the Everyone group Anonymous access to this DC. I could write pages about why granting such access is a horrible idea, but to save space, I'll just say that you should set this statement to No unless you have a solid reason for setting it to Yes. The RebootOnSuccess statement instructs Dcpromo to reboot the system after it's finished.

Existing Domain
Let's look at an answer file that creates a replica DC for bigfirm.biz. I've arranged the script that Listing 2 shows so that you'll recognize the first nine statements from Listing 1's example. ReplicaOrNewDomain has a different value (Replica instead of Domain), which tells Dcpromo to create a new DC in an existing domain. ReplicaDomainDNSName gives Dcpromo the name of the domain in which to add the new DC. But to create a new DC in an existing domain, you need to be a domain administrator, so Dcpromo requires some credentials. UserName, UserDomain, and Password provide the name, domain, and password of a user account that has the authority to create a new DC in an existing domain.

If you're wondering why the SafeModeAdminPassword value (swordfish) in Listing 1 and the Password value (onceuponatimeinalandfaraway) in Listing 2 don't match, recall that the password you use to run DSRM isn't necessarily the same as the password of the default domain administrator account. The DSRM Administrator password resides in a DC's local SAM, and AD's Administrator account resides in AD. (By the way, Dcpromo includes an interesting security feature: If you run Dcpromo from an answer file that contains a password, Dcpromo modifies that file to remove the password.)

The final statement, CriticalReplicationOnly, lets you choose to replicate only the barest piece of the AD database before rebooting. If you use the Yes option with this statement, the new DC gets most of its copy of the AD database upon first boot. Although this statement is necessary for the answer file, I haven't found much use for it. I suspect Microsoft offered this option in Win2K as a way for very large enterprise clients (e.g., HP, Intel, Microsoft) to initially set up a DC without triggering a lengthy replication of a potentially huge AD database. But now that Windows 2003 lets you run Dcpromo from a backup of an entire AD database, I don't see the practical value of this option.

Free Tools
I can't tell you how useful I've found batch files that use Netsh for IP control, Dnscmd for DNS server setup, and Dcpromo answer files for AD setup. Put them all together and you have an amazing setup and disaster-recovery tool that didn't cost you a dime. For more information about scripting Dcpromo, check out the ref.chm file in the Windows 2003 CD-ROM's \Support\Tools folder.