1

I would like to upgrade a single Windows Server 2012 instance to be a Domain Controller.

The exact context is that I have some console apps that need to be run as administrator at startup. And from testing on a debug server, upgrading a server to be a domain controller allows this. Aside from this, I tried adding a batch file to the StartUp folder and logging in an admin user automatically - but I could not get the scripts to run as admin.

The production machine has to have ports opened explicitly - and almost certainly will have many of the ports that ADS seems to require according to blogs/articles such as this: https://isc.sans.edu/diary/Cyber+Security+Awareness+Month+-+Day+27+-+Active+Directory+Ports/7468

I'm a little worried that after upgrading the machine to a Domain Controller, that I will not be able to login. Is this a possibility?

Is there anything that should be taken into account?

  • 2
    And from testing on a debug server, upgrading a server to be a domain controller allows this. - Erm, wut? Not sure why you would need to run as a DC for this. I really doubt you need to. Knowing nothing else, I suspect it would be a bad idea for you to do this. – Zoredache Jan 30 at 19:42
  • 4
    This sounds like a "worst practice" case for using a Domain Controller. I'd look at figuring out how to make your console apps work on a standalone server or a domain member, not a Domain Controller. – joeqwerty Jan 30 at 19:49
  • In this case the source code is unlikely to be edited, and there is just a single computer – Zach Smith Jan 30 at 19:52
  • if you just have the single computer why do you need an AD? If it's just a single server, install hyper-v and deploy the DC to a separate instance. – Jim B Jan 30 at 19:55
  • 3
    @ZachSmith Best practice a DC should ONLY be a DC. adding other apps/ports provides avenues for compromise see docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/… – Jim B Jan 30 at 20:00
1

What you want to achieve is for a single computer to automatically log in and launch a few console apps on startup?

No need to create a domain controller for that. Try the Sysinternals tool AutoLogon.

As the user you choose to use for automatic logons, Press Win+R to invoke the Run dialog, and paste in shell:startupand press OK. Put shortcuts to the console apps in that folder.

If you explicitly need the apps to ”Run as Administrator”, you should probably create a task in Task Scheduler. Trigger it ”On logon” and select ”Run with highest privileges”.

  • the apps need to run as admin – Zach Smith Jan 30 at 20:19
  • Added that to my post. – Mikael H Jan 30 at 20:21
  • 1
    @ZachSmith ugh, keep in mind that admin on a DC is much more dangerous than admin on a server. – Jim B Jan 30 at 20:24
0

Zach, The server already has an ADMIN account built in. It may or may not be disabled, but it is already there. You could always enable and use that account if you have to.

To run apps all you may need to do is point to the application, right click, and select "Run as administrator".

If you start the app by clicking on shortcut, you can right-click on the shortcut , select properties, and specify that it should be run as admin.

Any of these suggestions should be all you need.

You do not need a domain controller.

  • A batch file needs to run on startup (automatically), and as admin – Zach Smith Feb 2 at 7:28
  • 1
    That's fine. Set a scheduled task to run at startup, tell it to run as the local administrator. You will need to supply it with the local Administrator password. And you still don't need a domain controller. Do you know how to setup a scheduled task? Do you know the password for the local administrator account? If you can answer yes to both questions then you are all set. And you still don't need a domain controller. – Larryc Feb 2 at 16:43

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.