Deploy an Active Directory forest on Compute Engine

This document describes how to deploy an Active Directory forest on Compute Engine in a way that follows the best practices described in Best practices for running Active Directory on Google Cloud.

This guide is intended for administrators and DevOps engineers. It assumes that you have a solid understanding of Active Directory and basic knowledge of Google Cloud networking and security.

Architecture

The deployment consists of two projects:

• A host project that contains a Shared VPC network, a private DNS forwarding zone, and firewall rules for Active Directory.
• A service project that contains two domain controllers that are deployed across two zones.

This architecture lets you do the following:

• Deploy additional Windows workloads in separate projects, and let them use the Shared VPC network and Active Directory forest.
• Integrate the Active Directory forest with an existing on-premises forest to implement the resource-forest pattern.

Before you begin

To follow the instructions in this guide, make sure you have the following:

• Subnet CIDR ranges for two subnets:

  • Domain controllers subnet. This subnet contains the domain controllers. Using a dedicated subnet for domain controllers helps you distinguish domain controller traffic from other server traffic when you manage firewall rules or analyzing network logs.

    We recommend a subnet CIDR range that's sized /28 or /29.

  • Resource subnet. This subnet contains servers and administrative workstations. Use a subnet CIDR range that's large enough to accommodate all the servers that you plan to deploy.

  Make sure that your subnets don't overlap with any on-premises subnets, and allow sufficient room for growth.

• A DNS domain name and a NetBIOS domain name for the Active Directory forest root domain. For more information about choosing a name, see Microsoft naming conventions.

Deploy a shared network

In this section, you create a new project and use it to deploy a Shared VPC network. Later, you'll use this network to deploy the Active Directory domain controllers.

Create a project

You now create a new project and use it to deploy a Shared VPC network.

1. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

   Roles required to select or create a project

   • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
   • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

   Go to project selector

2. Verify that billing is enabled for your Google Cloud project.

3. Enable the Compute Engine and Cloud DNS APIs.

   Roles required to enable APIs

   To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

   Enable the APIs

To get the permissions that you need to deploy a shared network, ask your administrator to grant you the following IAM roles on the project or parent folder:

• Compute Network Admin (roles/compute.networkAdmin)
• Compute Security Admin (roles/compute.securityAdmin)
• Compute Shared VPC Admin (roles/compute.xpnAdmin)
• DNS Administrator (roles/dns.admin)

For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Delete the default VPC

By default, Compute Engine creates a default network in each new project that you create. This network is configured in auto mode, which means a subnet is pre-allocated for each region and is automatically assigned a CIDR range.

In this section, you replace this VPC network with a custom mode network that contains two subnets and that uses custom CIDR ranges.

1. In the Google Cloud console, open Cloud Shell.

   Activate Cloud Shell

2. Launch PowerShell:

   pwsh
   

3. Configure the gcloud CLI to use the new project:

   gcloud config set project PROJECT_ID
   

   Replace PROJECT_ID with the ID of your project.

4. Delete all firewall rules that are associated with the default VPC:

   $ProjectId = gcloud config get-value core/project
   & gcloud compute firewall-rules list `
     --filter "network=default" `
     --format "value(name)" |
     % { gcloud compute firewall-rules delete --quiet $_ --project $ProjectId }
   

5. Delete the default VPC:

   & gcloud compute networks list --format "value(name)" |
     % { gcloud compute networks delete $_ --quiet }
   

Create a custom mode VPC network

You now create a custom mode VPC network in the your VPC host project.

1. In PowerShell, initialize the following variables:

   $VpcName = "VPC_NAME"
   $Region = "REGION"
   $SubnetRangeDomainControllers = "DC_CIDR"
   $SubnetRangeResources = "RESOURCES_CIDR"
   

   Replace the following:

   • VPC_NAME: the name of the VPC.
   • REGION: the region to deploy the Active Directory domain controllers in.
   • DC_CIDR: the subnet range to use for the domain controllers subnet.