How to Configure AWS Managed Microsoft Active Directory
Tags: activedirectory, aws, communitybuilder, managedad
Published: 2024-01-08 05:08:34

AWS Managed Microsoft Active Directory (AD) provides a fully managed Active Directory service in the AWS cloud. It's designed to enable AWS resources and applications to use standard AD features without setting up and managing your own Active Directory infrastructure. 
We can create this using Directory Service window:
 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kuxaps02xs6lssxapeka.png)


Fill in the Directory DNS name, admin password for this new domain.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/aylvmo317cfdca70hkdy.png)

Next we configure where VPC and subnet that this AWS Managed Microsoft AD will launch.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6bpwch1g2ihs5in56jhk.png)
And review it for one last time:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tblr3kzqni6aka0mbyu4.png)
And then create the directory.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j0htp4gh22rjzwlqkfdp.png)

After we create the directory, we will configure directory administration EC2 instance.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j414axbgeycikdsktths.png)



![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8xpyl0nx2sx3g9h9nefo.png)

We can configure Remote access CIDR /which subnet is allowed to do RDP to this instance.




![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/oygxqor731yr7ynyb6im.png)
SSM Will help to create our resources .

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/u9ai5od8poojb7w3v8jy.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6oh1wv0k43o4ma1fmdbe.png)

Management instance will be up:


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/arux41ffmwjw7vn4lbkj.png)

We will check Management Instance properties:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/u7mnnmqx3ysl6onhwpuh.png)
If we already joined with the domain, computer name will similar as below:

 
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jpr48h3v5q3ot12wfxtd.png)

If the admin EC2 still not joined with the domain, we can do manually to join this Management intsance ec2 to leonard.example.com domain. Configure manually DNS name, and domain name in the properties.

We will install features to support AWS Managed Microsoft AD in our Management instance.
Install the feature we need for AD:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/re62gkoz9a1twuwhbbdo.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2uqko2qj7yhcv26hkgcr.png)

IAM Role that needed to run this service:



![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/e63ndbh7t3yvrra3k8ln.png)

With trust relationship as below:

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dv3dro5qoildmcylenbc.png)

Security group enabled: RDP port 


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5x6smjm26pgli1huhv2k.png)

And try log in again to Management instance  using user and password domain:


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/x5372am601lidytueiri.png)

I successfully log in and Management instance  already connected with AWS Managed Microsoft AD (domain leonard.example.com) :

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tedeuv2yhlufq124gj90.png)

We can add new user /group from this Management instance.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wme57xsuq6s47leo5547.png)
We can custom password policy. Expired password time , etc. or when someone left the company.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/20ordppan1iq3nybiq08.png)

And we can try to log in using this new username to another device that already joined domain .



Source:

https://docs.aws.amazon.com/directoryservice/latest/admin-guide/directory_microsoft_ad.html