There be any consequences encountered at later date if the IP configurations were made on the server before installing Active Directory and DNS? If so, what problems would I most likely to come across and can they be easily rectified? Does this vary depending Remove additional roles or applications such as web, database, and email from the domain controller.I was wondering whether anybody could advise me on which order Active Directory and DNS services should be setup as part of a Domain Controller, I have seen a majority of sources on the Internet including Microsoft help pages suggesting to install Active DirectoryĪnd DNS services before setting up the IP configurations of the server, however I have seen a minority of sources on the Internet where some people suggest to setup the IP configurations of the server before installing Active Directory and DNS services. If any applications are installed that are not required for the domain controller, this is a finding. However, the DNS server must comply with the DNS STIG security requirements. If any roles not requiring installation on a domain controller are installed, this is a finding.Ī Domain Name System (DNS) server integrated with the directory server (e.g., AD-integrated DNS) is an acceptable application. A basic domain controller setup will include the following:

(Cancel before any changes are made.)ĭetermine if any additional server roles are installed. Select 'Add (or Remove) Roles and Features' from 'Tasks' in the 'Roles and Features' section. Select 'AD DS' in the left pane and the server name under 'Servers' to the right. Review the installed roles the domain controller is supporting. This applies to domain controllers, it is NA for other systems. Microsoft Windows Server 2019 Security Technical Implementation Guide

In this case, non-standard ports might be selected, and this could interfere with intrusion detection or prevention services. Some applications (such as Microsoft Exchange) may require the use of network ports or services conflicting with the directory server. Some applications require the addition of privileged accounts, providing potential sources of compromise.

Web or database server applications usually require the addition of many programs and accounts, increasing the attack surface of the computer.

Executing application servers on the same host machine with a directory server may substantially weaken the security of the directory server.

Windows server 2019 ad ds