Creating a functional domain using VPC in AWS

In this example I am going to create a functional domain called PDT.local it will have a Domain controller a Terminal server and a Member server which I will put on it’s own subnet. I will be allowing access only through the Terminal server from the internet and I will be using this server to connect to the other servers. In a production network I might do this differently but this is just an example.

My servers will be set up as following:




Step 1 Log on to the AWS console and select VPC


Click on the Start VPC Wizard


At the select VPC configuration wizard choose the option that suits you best I am choosing VPC with a Single Public Subnet.

Click Select.

Screen Shot 2014-11-13 at 11.55.59 am

Enter a master CIDR block in this case and for the public subnet


Screen Shot 2014-11-13 at 12.10.08 pm

Click Create VPC

Screen Shot 2014-11-13 at 12.10.16 pm

The wizard then takes a couple of minutes to create the networking components.

When it is finished click on Subnets

Screen Shot 2014-11-13 at 12.16.44 pm

Then Create Subnet

Give the subnet a name tag select the correct VPC and the Availability Zone that you selected earlier and enter a CIDR block. In this case This is the subnet where I will be putting the member server.

Screen Shot 2014-11-13 at 12.19.27 pm

The next step is to create Security groups there will need to be at least one for each subnet.

Screen Shot 2014-11-13 at 12.32.27 pm

Screen Shot 2014-11-13 at 12.35.38 pm

Now we need to create rules for the Security Groups.

Click on the Security group and go to the Inbound rules tab then click edit.

I am only going to configure inbound rules but if you need more granular control you can configure outbound rules too.

Screen Shot 2014-11-13 at 12.42.07 pm

Click on Edit.

Screen Shot 2014-11-13 at 12.45.58 pm

There is a nice feature here now where you get to choose the source security group from a pop up menu. I am going to give all access to the Member servers security group and port 3389 access from the internet. Normally you would lock this down to a specific IP address or range.

Screen Shot 2014-11-13 at 12.52.54 pm

For member servers I am locking it down to only traffic from the Domain Controllers Security group I am allowing all traffic but this could be made more specific.

Screen Shot 2014-11-13 at 12.56.06 pm

Now it is time to spin up the 3 instances two in the subnet and one in the .2.0 subnet.

Go back into EC2 launch an instance The first one I am going to build is the Terminal Server as that is the one I am connect to the internet.

So just build an instance as normal only on the Configure Instance Details screen choose as follows.

select the Network and the subnet and for the internet facing server select enabled under the Auto-assign Public IP choice.

Screen Shot 2014-11-13 at 1.19.50 pm

Then just make sure it is in the correct security group.

Then build the other 2 instances taking care to put them in the correct security groups.

While the 3 instances are building I am going to create network interfaces so that I can assign my servers static IP addresses. Actually I am only going to do this for the Domain controller but in a production environment I would do this for all the servers.

So under the EC2 console navigate to Network interfaces

Screen Shot 2014-11-13 at 1.42.29 pm

Click Create Network Interface and enter a description, select the correct subnet, enter a private IP address and select the correct security groups for this interface.

Click yes create.

Screen Shot 2014-11-13 at 1.49.39 pm

Select the network interface and click attach.

And attach it to the Correct instance.

This server now has two network interfaces you can disable the network interface that has the dynamically assigned IP address from inside the server.

Now it is time to log on.

Screen Shot 2014-11-13 at 1.59.11 pm

go to the instance and click connect.

Having logged on the Terminal server I confirm that I can ping the other two servers and then I create RDP connections to them.

For the Domain controller I renamed it and disabled the adapter with the dynamic IP address.

I did the same for the member server and then for the Terminal Server.

Now for the Domain Controller I am going to add the Domain Services role and promote it to a Domain Controller.

Set a local admin password for the other two servers one that is easier to remember than the AWS assigned one or document the AWS assigned one.

The one last step that needs to be done before you can add the servers to the domain is to do an ipconfig /all find out the DNS server address go into the network adapter properties and change the primary DNS server to that of the Domain Controller and the secondary to the DNS server you discovered with ipconfig.

Screen Shot 2014-11-13 at 2.56.47 pm

then ping the fully qualified domain name of the DC and you should be able to join the domain.

One interesting point of note is that the Terminal server was not able to ping the DC by it’s  name until I added a statically assigned network adaptor. After that all three servers are on the domain and could be configured further.

Screen Shot 2014-11-13 at 3.26.42 pm