Deploy an Active Directory resource forest

This series walks you through using Managed Microsoft AD to deploy an Active Directory resource forest on Google Cloud. You'll learn how to:

Set up a Shared VPC that enables you to access Managed Microsoft AD from multiple projects, and connect Managed Microsoft AD to an on-premises Active Directory using a forest trust.
Configure firewall rules that protect access to Active Directory from unauthorized sources.
Deploy Managed Microsoft AD in a single region and connect it to an existing Shared VPC.
Create a management VM and join it to the domain.
Use a delegated administrator to connect to Managed Microsoft AD.

Architecture overview

To allow VMs from multiple projects to use Active Directory, you'll need a Shared VPC and three separate subnets:

Managed Microsoft AD subnet: Used by Managed Microsoft AD to run domain controllers.
Management subnet: Contains machines that are exclusively used for the purpose of managing Active Directory.
Resource subnets: Contains Active Directory member servers (such as application or database servers). Each resource subnet is scoped to a single region. In this guide, you will only create a single resource subnet, but you can add additional resource subnets later if you plan to deploy servers across multiple regions.

Deployment outline

To reduce security risks, you'll deploy a management VM with an internal RFC 1918 IP address and no internet access. To log in to VM instances, you'll use IAP TCP tunneling.

Following the best practice of using separate projects for management and servers, you'll create two separate projects:

VPC host project: Contains the Shared VPC configuration as well as Managed Microsoft AD.
Management project: Dedicated to managing Active Directory. You'll create a management VM within this project and use it to configure Active Directory.

Before you begin

This tutorial uses a Shared VPC, which requires the use of a Google Cloud Organization. If you do not have an organization, create one first. Additionally, some setup activities require administrative roles. Ensure you are granted the following IAM roles before proceeding.

This article assumes you are using a Windows machine with the Google Cloud CLI installed. You'll need to adjust some of the steps if you are using a different operating system.

Finally, collect the following information before you begin:

Project names for the VPC host project and the management project. These two projects will serve a central role in your deployment, so pick names that are easy to recognize and follow your corporate naming conventions.
Folders to create the VPC host project and the management project project in. If you don't have a suitable folder already, consider creating a separate sub-folder for cross-functional resources and services such as Active Directory.
A DNS domain name to use for the forest root domain of the new Active Directory forest.
An initial region to deploy resources in. Note that you can only deploy Managed Microsoft AD in some regions (this doesn't affect the general availability of your domain, which is available in all regions where your VPC has a presence). Consult the best practices on region selection if you are unsure which region best suits your needs. You will be able to extend the deployment to additional regions later.
The name of the shared VPC to create. As the VPC will be shared across multiple projects, make sure to pick a name that is easy to recognize.
Subnet ranges for the following subnets:
- Managed Microsoft AD subnet: Must be at least /24 in size.
- Management subnet: Needs to accommodate all management servers. A subnet range sized /28 or larger is recommended.
- Resource subnet: Size this subnet so it can accommodate all the servers you plan to deploy in the initial region.
Make sure your subnets do not overlap with any on-premises subnets and allow sufficient room for growth.

Costs

The tutorial uses billable components of Google Cloud, including Compute Engine, Cloud DNS, and Google Cloud Observability. See the Pricing calculator to calculate the costs of completing this tutorial. Be sure to include any other resources specific to your deployment.

Setting up VPC networking

Creating the VPC host project

A VPC host project is used to create a Shared VPC and manage network-related configuration, such as subnets, firewall rules, and routes.

In the Google Cloud console, open the Manage resources page.
Open the Manage resources page
In the Organization drop-down list at upper left, select your organization.
Click Create Project and enter the following settings:
1. Project Name: The ID you chose as the project name.
2. Billing account: Your billing account.
3. Location: The folder to create the project in.
Click Create.

Protecting the project against accidental deletion

Deleting a project also deletes any Managed Microsoft AD domains deployed inside it. In addition to using IAM policies to limit access to the project, you should protect the project against accidental deletion.

In the Google Cloud console, open Cloud Shell. Cloud Shell gives you access to the command line in Google Cloud console, and includes Google Cloud CLI and other tools you need for Google Cloud administration. Cloud Shell can take several minutes to provision.
Activate Cloud Shell
Initialize variables to contain your organization name and the project ID of the VPC host project:
```
ORG_NAME=[ORG-NAME] \
VPCHOST_PROJECT_ID=[PROJECT-ID]
```
Replace [ORG-NAME] by the name of your organization and [PROJECT-ID] with the ID of the VPC host project. For example:
```
ORG_NAME=example.com
VPCHOST_PROJECT_ID=ad-host-123
```

Run the following command to look up the ID of your organization, replacing ORG-NAME with the name of your organization (such as example.com):

ORG_ID=$(gcloud organizations list \
  --filter="DISPLAY_NAME=$ORG_NAME" \
  --format=value\(ID\)) && \
echo "ID of $ORG_NAME is $ORG_ID"

Enforce compute.restrictXpnProjectLienRemoval policy for your organization:

gcloud resource-manager org-policies enable-enforce \
  --organization $ORG_ID compute.restrictXpnProjectLienRemoval

Deleting the default VPC

Compute Engine creates a default VPC in each project you create. This VPC is configured in auto mode, which means a subnet is pre-allocated for each region and automatically assigned a subnet range.

If you are planning to connect the VPC to an on-premises network, the predefined IP ranges that Compute Engine uses in auto mode are unlikely to suit your needs; they might overlap with existing IP ranges, or be inadequately sized. You should delete the default VPC and replace it with a custom mode VPC.

Return to your existing Cloud Shell session.

Enable the Compute Engine API in the VPC host project:

gcloud services enable compute.googleapis.com --project=$VPCHOST_PROJECT_ID

Delete all firewall rules associated with the default VPC:

gcloud compute firewall-rules list \
  --filter="network=default" \
  --project=$VPCHOST_PROJECT_ID \
  --format=value\(name\) | \
xargs gcloud compute firewall-rules delete \
  --project=$VPCHOST_PROJECT_ID

Delete the default VPC:

gcloud compute networks delete default --project=$VPCHOST_PROJECT_ID

Creating the Shared VPC and subnets

With the default VPC deleted, you can now create the custom VPC (you'll turn this into into a shared VPC later).

Return to your existing Cloud Shell session.
Create variables for the VPC name, initial region, and subnet ranges:
```
SHAREDVPC_NAME=[NAME] \
SUBNET_REGION=[REGION] \
SUBNET_RANGE_MANAGEMENT=[MANAGEMENT-RANGE] \
SUBNET_RANGE_RESOURCES=[RESOURCES-RANGE] \
SUBNET_RANGE_MANAGEDAD=[MANAGED-AD-RANGE] \
SUBNET_RANGE_ONPREMAD=[ONPREM-AD-RANGE]
```
Replace the placeholder variables with the following:
- [NAME] with a name, such as ad-network-env-test.
- [REGION] with the region to deploy the Active Directory domain controllers in. You can extend the VPC and your domain to cover additional regions at any time.
- [MANAGEMENT-RANGE] with the subnet range to use for the management subnet.
- [RESOURCES-RANGE]with the subnet range to use for the resource subnet.
- [MANAGED-AD-RANGE] with the subnet range to use for the Managed Microsoft AD subnet.
- [ONPREM-AD-RANGE] with the subnet range to use for the on-prem AD subnet.
For example:
```
SHAREDVPC_NAME=ad-network \
SUBNET_REGION=us-central1 \
SUBNET_RANGE_MANAGEMENT=10.0.0.0/24 \
SUBNET_RANGE_RESOURCES=10.0.1.0/24 \
SUBNET_RANGE_MANAGEDAD=10.0.2.0/24 \
SUBNET_RANGE_ONPREMAD=192.168.0.0/24
```

Enable the VPC host project to host a Shared VPC:

gcloud compute shared-vpc enable $VPCHOST_PROJECT_ID

Create a new custom mode VPC network:

gcloud compute networks create $SHAREDVPC_NAME \
    --subnet-mode=custom \
    --project=$VPCHOST_PROJECT_ID

Create the management and resource subnet, and enable Private Google Access so that Windows can be activated without granting the VMs direct internet access.

gcloud compute networks subnets create $SUBNET_REGION-management \
  --network=$SHAREDVPC_NAME \
  --range=$SUBNET_RANGE_MANAGEMENT \
  --region=$SUBNET_REGION \
  --enable-private-ip-google-access \
  --project=$VPCHOST_PROJECT_ID && \
gcloud compute networks subnets create $SUBNET_REGION-resources \
  --network=$SHAREDVPC_NAME \
  --range=$SUBNET_RANGE_RESOURCES