As you get started. Make sure your VPC configurations for Inbound and Outbound traffic are correct.
If you are using a VPN. Make sure the AWS CIDR and your Local CIDR's are there. The local CIDR range is also your local AWS CIDR, not just your on-premise CIDR block range.
1. In order to establish a connection between your on-premises Active Directory and the AWS Cloud AWS Managed Microsoft Active Directory you must setup both the on-premise server (LOCALDOMAIN.COM) and your AWS Domain (AWSDOMAIN.LOCAL).
2. Create an AWS EC2 VM that will be joined to your awsdomain.local domain. After you have created the VM. Login to the VM and add the DNS addresses that are listed for AWSDOMAIN.LOCAL in the AWS Directory Service. Do an ipconfig /all to make sure that the DNS IP addresses are correct or nslookup will fail.
3. FYI. You cannot RDP into the AWS DC's for the AWS Managed Microsoft AD. You have to use the Server Manager Tools on the server that is joined to the the AWSDomain.Local.
4. Join the machine to your AWS Domain. The default username is "admin" and not "administrator". Then reboot the computer.
Right-click on Conditional Forwarder and then select New Conditional Forwarder
5. Configure your domain that will be used for the trust so that it can talk from your domain.
6. Run PowerShell or CMD Prompt as an administrator and run ipconfig /flushdns
7. Now ping the domain (FYI. It takes a few minutes. Relax). ping the domain name (e.g. ping awsisyourfriend.local) and you should get the ip address back that you put as the IP addresses of the master servers (domain IP's). DNS Settings are here with the arrow.
Image sanitized.
8. After you are able to ping the DNS IP addresses. Do an nslookup awsisyourfriend.local. Now you will get a response something like
C:\Windows\system32>nslookup awsisyourfriend.local
Server: dc.onpremisedomain.com
Address: 172.55.8.8
Non-authoritative answer:
Name: awsisyourfriend.local
Addresses: 8.8.8.8
8.8.4.4
9. Next. Open your Active Directory Domains and Trusts and start the setup of the trust.
Note: URL if you have time. https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_tutorial_setup_trust_create.html
Pics below for us that need to Get it Done!
10. Type the domain
11. Click Forest Trust
12. Two-Way
13. This Domain Only
12. Do the AWS Side now.
If you are using a VPN. Make sure the AWS CIDR and your Local CIDR's are there. The local CIDR range is also your local AWS CIDR, not just your on-premise CIDR block range.
1. In order to establish a connection between your on-premises Active Directory and the AWS Cloud AWS Managed Microsoft Active Directory you must setup both the on-premise server (LOCALDOMAIN.COM) and your AWS Domain (AWSDOMAIN.LOCAL).
2. Create an AWS EC2 VM that will be joined to your awsdomain.local domain. After you have created the VM. Login to the VM and add the DNS addresses that are listed for AWSDOMAIN.LOCAL in the AWS Directory Service. Do an ipconfig /all to make sure that the DNS IP addresses are correct or nslookup will fail.
3. FYI. You cannot RDP into the AWS DC's for the AWS Managed Microsoft AD. You have to use the Server Manager Tools on the server that is joined to the the AWSDomain.Local.
4. Join the machine to your AWS Domain. The default username is "admin" and not "administrator". Then reboot the computer.
Right-click on Conditional Forwarder and then select New Conditional Forwarder
5. Configure your domain that will be used for the trust so that it can talk from your domain.
6. Run PowerShell or CMD Prompt as an administrator and run ipconfig /flushdns
7. Now ping the domain (FYI. It takes a few minutes. Relax). ping the domain name (e.g. ping awsisyourfriend.local) and you should get the ip address back that you put as the IP addresses of the master servers (domain IP's). DNS Settings are here with the arrow.
Image sanitized.
8. After you are able to ping the DNS IP addresses. Do an nslookup awsisyourfriend.local. Now you will get a response something like
C:\Windows\system32>nslookup awsisyourfriend.local
Server: dc.onpremisedomain.com
Address: 172.55.8.8
Non-authoritative answer:
Name: awsisyourfriend.local
Addresses: 8.8.8.8
8.8.4.4
9. Next. Open your Active Directory Domains and Trusts and start the setup of the trust.
Note: URL if you have time. https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_tutorial_setup_trust_create.html
Pics below for us that need to Get it Done!
10. Type the domain
11. Click Forest Trust
12. Two-Way
13. This Domain Only
14. Forest-wide authentication
15. Trust Password (NOTE: This is the password that you set up with the creation of the AWS Managed Microsoft AD).
16. Do not confirm the Outgoing or Incoming Trust (select No)
11. Now the on-premises side of the AD Domain Trust (Two-Way) is done.
13. Note: You cannot create the trust from within the Windows OS on AWS. You must do it through the AWS Console. If you attempt to do it from the OS. You will get an error that says Access Denied!
14. If you have done everything correctly. You will get rewarded with a "Verified" green check mark!
AWS Articles:
