Windows/Server

Download

• https://www.microsoft.com/de-de/evalcenter/download-windows-server-2025
  • https://go.microsoft.com/fwlink/?linkid=2293216&clcid=0x407&culture=de-de&country=de

Active Directory

• Rename server

Rename-Computer -NewName "RDS" -Restart

• Server Manager -> Add roles -> Active Directory Domain Services + DNS

Install-WindowsFeature AD-Domain-Services, DNS -IncludeManagementTools

• Active Directory -> Promote -> Add new forest (ad.example.de)

$SecurePassword = Read-Host -Prompt "SafeMode Admin Password" -AsSecureString

Install-ADDSForest -DomainName "ad.example.com" -DomainNetbiosName "AD" -InstallDns -SafeModeAdministratorPassword $SecurePassword

Remote Desktop Services

• Add user group

Import-Module ActiveDirectory
New-ADGroup "RDS allow log on" -GroupScope Global -GroupCategory Security

• Install role

Install-WindowsFeature RDS-RD-Server,RDS-Licensing -IncludeManagementTools
Restart-Computer

• Group Policy Management
  • Forest → Domains → ad.example.de → Right click: Domain Controllers → Create GPO: "RDS"
  • Right click: "RDS" → Edit
    • Computer Configuration → Policies → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Licensing
      • Use the specified Remote Desktop license servers: Enable and add Server FQDN
      • Set the Remote Desktop licensing mode: Per User
    • Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → User Rights Assignment
      • Allow log on through Remote Desktop Services → add "RDS allow log on"
• Update policies

gpupdate

• Verify policies
  • "secpol"

• Enable users - Add users to groups:
  • Remote Desktop Users
  • RDS allow log on

Time Service

w32tm /query /status
w32tm /query /peers
w32tm /query /source

w32tm /resync
w32tm /resync /force

#Standalone
w32tm /config /manualpeerlist:"time.cloudflare.com,0x8 time.google.com,0x8 0.de.pool.ntp.org,0x8" /syncfromflags:manual /update
net stop w32time && net start w32time
w32tm /resync /force