Use Active Directory Administrative Center outside domain

active-directorywindows-8.1windows-server-2012windows-server-2012-r2

I'm setting up a Active Directory lab environment on a Windows 8.1 laptop. I now have a Windows Server Core 2012 domain controller running inside a VM. I installed Server Manager for Windows 8.1 and have set things up so I can manage everything from the Win8.1 host machine.

Well, everything except Active Directory Administrative Center (ADAC). When started it produces an error: Your account or computer is not joined to any domain. Join to a domain and try again. All other AD-related management tools work just fine.

Is it impossible to run ADAC outside an AD domain or am I still missing some configuration? I do not want to join the host machine to the lab domain.

Best Answer

Is it impossible to run ADAC outside an AD domain or am I still missing some configuration?

Yes. Most of the built-in tools to manage things relating to your domain require that they are being run as a domain user. That necessitates the machine they are running from be joined to that domain.

That said, there are 3rd party tools that can be used to manage a domain. For example, any LDAP browser can manipulate objects in the directory. You just don't get a lot of the GUI niceties like check boxes and radio buttons for certain properties.

Related Solutions

Active Directory Administrative Center in Windows Server 2012 can not delete any domain controllers

What errors are occurring on the demote attempt? I'd say take a look at that before jumping to the nuclear option.

Sites and Services is still available for your DC nuking needs in 2012 (and still handles the metadata cleanup automatically), you can install it via Add Roles and Features (Features -> Remote Server Administration Tools -> Role Administration Tools -> AD DS and LDS -> AD DS -> AD DS Snap-Ins and Command Line Tools), but avoid doing that in favor of a demote through dcpromo if you can.

Join VM to specific Active Directory OU using System Center VMM 2012 Guest OS Profile

It appears there are two ways to specify an OU when joining a VM to the domain using a Guest OS Profile. The first is to use the Get-SCGuestOSProfile and Set-SCGuestOSProfile PowerShell cmdlets to modify the DomainJoinOrganizationalUnit setting used to join the domain. This is the most straight forward approach but is not visible in the GUI and is a bit more difficult to setup.

The second is to add an unattend.xml file to your VMM Library that includes the the MachineObjectOU element. In my case I used the following to join a 2012 Server to the "My Servers" OU on our Child.Parent.com domain:

<?xml version="1.0" encoding="utf-8"?>
<unattend xmlns="urn:schemas-microsoft-com:unattend">
    <settings pass="specialize">
        <component name="Microsoft-Windows-UnattendedJoin" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
            <Identification>
                <MachineObjectOU>OU=My Servers,DC=Child,DC=Parent,DC=com</MachineObjectOU>
            </Identification>
        </component>
    </settings>
</unattend>

The unattend.xml file will be merged with the settings provided in the Guest OS profile (like the domain join credentials), so this option will also let you customize other installation settings and will still visible in the GUI.

Best Answer

Related Solutions

Active Directory Administrative Center in Windows Server 2012 can not delete any domain controllers

Join VM to specific Active Directory OU using System Center VMM 2012 Guest OS Profile

Related Topic