Prepare Active Directory for Azure Stack HCI, version 23H2 deployment

Applies to: Azure Stack HCI, version 23H2

This article describes how to prepare your Active Directory environment before you deploy Azure Stack HCI, version 23H2.

Active Directory requirements for Azure Stack HCI include:

• A dedicated Organization Unit (OU).
• Group policy inheritance that is blocked for the applicable Group Policy Object (GPO).
• A user account that has all rights to the OU in the Active Directory.
• Machines must not be joined to Active Directory before deployment.

To manually assign the required permissions for Active Directory, create an OU, and block GPO inheritance, see Custom Active Directory configuration for your Azure Stack HCI, version 23H2.

Prerequisites

Before you begin, make sure you've done the following:

• Satisfy the prerequisites for new deployments of Azure Stack HCI.

• Download and install the version 2402 module from the PowerShell Gallery. Run the following command from the folder where the module is located:

  Install-Module AsHciADArtifactsPreCreationTool -Repository PSGallery -Force
  

  Note

  Make sure to uninstall any previous versions of the module before installing the new version.

• You have obtained permissions to create an OU. If you don't have permissions, contact your Active Directory administrator.

• If you have a firewall between your Azure Stack HCI system and Active Directory, ensure that the proper firewall rules are configured. For specific guidance, see Firewall requirements for Active Directory Web Services and Active Directory Gateway Management Service. See also How to configure a firewall for Active Directory domains and trusts.

Active Directory preparation module

The New-HciAdObjectsPreCreation cmdlet of the AsHciADArtifactsPreCreationTool PowerShell module is used to prepare Active Directory for Azure Stack HCI deployments. Here are the required parameters associated with the cmdlet:

Prepare Active Directory

When you prepare Active Directory, you create a dedicated Organizational Unit (OU) to place the Azure Stack HCI related objects such as deployment user.

To create a dedicated OU, follow these steps:

1. Sign in to a computer that is joined to your Active Directory domain.

2. Run PowerShell as administrator.

3. Run the following command to create the dedicated OU.

   New-HciAdObjectsPreCreation -AzureStackLCMUserCredential (Get-Credential) -AsHciOUName "<OU name or distinguished name including the domain components>"
   
   

4. When prompted, provide the username and password for the deployment.

   1. Make sure that only the username is provided. The name should not include the domain name, for example, contoso\username. Username must be between 1 to 64 characters and only contain letters, numbers, hyphens, and underscores and may not start with a hyphen or number.
   2. Make sure that the password meets complexity and length requirements. Use a password that is at least 12 characters long and contains: a lowercase character, an uppercase character, a numeral, and a special character.

   Here is a sample output from a successful completion of the script:

   PS C:\work> $password = ConvertTo-SecureString '<password>' -AsPlainText -Force
   PS C:\work> $user = "ms309deployuser"
   PS C:\work> $credential = New-Object System.Management.Automation.PSCredential ($user, $password)
   PS C:\work> New-HciAdObjectsPreCreation -AzureStackLCMUserCredential $credential -AsHciOUName "OU=ms309,DC=PLab8,DC=nttest,DC=microsoft,DC=com"    
   PS C:\work>
   

5. Verify that the OU is created. If using a Windows Server client, go to Server Manager > Tools > Active Directory Users and Computers.

6. An OU with the specified name should be created and within that OU, you'll see the deployment user.

   

Next steps

• Download Azure Stack HCI, version 23H2 software on each server in your cluster.