将 Azure 云服务角色连接到 Azure 中托管的自定义 AD 域控制器Connecting Azure Cloud Services Roles to a custom AD Domain Controller hosted in Azure

我们先在 Azure 中设置一个虚拟网络 (VNet)。We will first set up a Virtual Network (VNet) in Azure. 然后将 Active Directory 域控制器(托管在 Azure 虚拟机上)添加到该 VNet。We will then add an Active Directory Domain Controller (hosted on an Azure Virtual Machine) to the VNet. 接下来,将现有云服务角色添加预先创建的 VNet,然后将它们连接到域控制器。Next, we will add existing cloud service roles to the pre-created VNet, then connect them to the Domain Controller.

在开始之前,请特别注意以下几点:Before we get started, couple of things to keep in mind:

  1. 本教程使用 Powershell,因此请确保已安装 Azure Powershell 并已准备就绪。This tutorial uses Powershell, so make sure you have Azure Powershell installed and ready to go. 有关设置 Azure Powershell 的帮助,请参阅如何安装和配置 Azure PowerShellTo get help with setting up Azure Powershell, see How to install and configure Azure PowerShell.

  2. AD 域控制器和 Web/辅助角色实例需要在 VNET 中。Your AD Domain Controller and Web/Worker Role instances need to be in the VNET.

请遵循以下分步指南。如果遇到任何问题,请在本文末尾留言。Follow this step-by-step guide and if you run into any issues, leave us a comment at the end of the article. 我们将回复你(没错,我们真的会阅读留言)。Someone will get back to you (yes, we do read comments).

由云服务引用的网络必须为经典虚拟网络The network that is referenced by the cloud service must be a classic virtual network.

创建虚拟网络Create a Virtual Network

可以使用 Azure 门户或 PowerShell 在 Azure 中创建虚拟网络。You can create a Virtual Network in Azure using the Azure portal or PowerShell. 在本教程中,使用 PowerShell。For this tutorial, PowerShell is used. 要使用 Azure 门户创建虚拟网络,请参阅创建虚拟网络To create a virtual network using the Azure portal, see Create a virtual network. 本文介绍创建虚拟网络(资源管理器),但必须创建用于云服务的虚拟网络(经典)。The article covers creating a virtual network (Resource Manager), but you must create a virtual network (Classic) for cloud services. 为此,请在门户中选择“创建资源”,在“搜索”框中键入“虚拟网络”,然后按 Enter。To do so, in the portal, select Create a resource, type virtual network in the Search box, and then press Enter. 在搜索结果的“所有内容”中,选择“虚拟网络”。In the search results, under Everything, select Virtual network. 在“选择部署模型”下,选择“经典”,然后选择“创建”。Under Select a deployment model, select Classic, then select Create. 然后可以执行本文中的步骤。You can then follow the steps in the article.

#Create Virtual Network

$vnetStr =
@"<?xml version="1.0" encoding="utf-8"?>
<NetworkConfiguration xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.microsoft.com/ServiceHosting/2011/07/NetworkConfiguration">
  <VirtualNetworkConfiguration>
    <VirtualNetworkSites>
      <VirtualNetworkSite name="[your-vnet-name]" Location="China North">
        <AddressSpace>
          <AddressPrefix>[your-address-prefix]</AddressPrefix>
        </AddressSpace>
        <Subnets>
          <Subnet name="[your-subnet-name]">
            <AddressPrefix>[your-subnet-range]</AddressPrefix>
          </Subnet>
        </Subnets>
      </VirtualNetworkSite>
    </VirtualNetworkSites>
  </VirtualNetworkConfiguration>
</NetworkConfiguration>
"@;

$vnetConfigPath = "<path-to-vnet-config>"
Set-AzureVNetConfig -ConfigurationPath $vnetConfigPath

创建虚拟机Create a Virtual Machine

完成虚拟网络的设置后,需要创建 AD 域控制器。Once you have completed setting up the Virtual Network, you will need to create an AD Domain Controller. 在本教程中,我们会在 Azure 虚拟机上设置 AD 域控制器。For this tutorial, we will be setting up an AD Domain Controller on an Azure Virtual Machine.

为此,请在 PowerShell 中使用以下命令创建虚拟机:To do this, create a virtual machine through PowerShell using the following commands:

# Initialize variables
# VNet and subnet must be classic virtual network resources, not Azure Resource Manager resources.

$vnetname = '<your-vnet-name>'
$subnetname = '<your-subnet-name>'
$vmsvc1 = '<your-hosted-service>'
$vm1 = '<your-vm-name>'
$username = '<your-username>'
$password = '<your-password>'
$affgrp = '<your- affgrp>'

# Create a VM and add it to the Virtual Network

New-AzureQuickVM -Windows -ServiceName $vmsvc1 -Name $vm1 -ImageName $imgname -AdminUsername $username -Password $password -AffinityGroup $affgrp -SubnetNames $subnetname -VNetName $vnetname

将虚拟机提升为域控制器Promote your Virtual Machine to a Domain Controller

要将虚拟机配置为 AD 域控制器,需要登录 VM 并对其进行配置。To configure the Virtual Machine as an AD Domain Controller, you will need to log in to the VM and configure it.

若要登录 VM,你可以通过 PowerShell 获取 RDP 文件;请使用以下命令:To log in to the VM, you can get the RDP file through PowerShell, use the following commands:

# Get RDP file
Get-AzureRemoteDesktopFile -ServiceName $vmsvc1 -Name $vm1 -LocalPath <rdp-file-path>

登录 VM 后,请根据如何设置客户 AD 域控制器中的分步指导,将虚拟机设置为 AD 域控制器。Once you are signed in to the VM, set up your Virtual Machine as an AD Domain Controller by following the step-by-step guide on How to set up your customer AD Domain Controller.

将云服务添加到虚拟网络Add your Cloud Service to the Virtual Network

接下来,需要将云服务部署添加到新的 VNet。Next, you need to add your cloud service deployment to the new VNet. 为此,请使用 Visual Studio 或选择的编辑器将相关节添加到 cscfg,以修改云服务 cscfg。To do this, modify your cloud service cscfg by adding the relevant sections to your cscfg using Visual Studio or the editor of your choice.

<ServiceConfiguration serviceName="[hosted-service-name]" xmlns="http://schemas.microsoft.com/ServiceHosting/2008/10/ServiceConfiguration" osFamily="[os-family]" osVersion="*">
    <Role name="[role-name]">
    <Instances count="[number-of-instances]" />
  </Role>
  <NetworkConfiguration>

    <!--optional-->
    <Dns>
      <DnsServers><DnsServer name="[dns-server-name]" IPAddress="[ip-address]" /></DnsServers>
    </Dns>
    <!--optional-->

<!--VNet settings
    VNet and subnet must be classic virtual network resources, not Azure Resource Manager resources.-->
<VirtualNetworkSite name="[virtual-network-name]" />
<AddressAssignments>
    <InstanceAddress roleName="[role-name]">
    <Subnets>
        <Subnet name="[subnet-name]" />
    </Subnets>
    </InstanceAddress>
</AddressAssignments>
<!--VNet settings-->

  </NetworkConfiguration>
</ServiceConfiguration>

接下来,请生成云服务项目并将它部署到 Azure。Next build your cloud services project and deploy it to Azure. 有关将云服务包部署到 Azure 的帮助,请参阅如何创建和部署云服务To get help with deploying your cloud services package to Azure, see How to Create and Deploy a Cloud Service

将 Web/辅助角色连接到域Connect your web/worker roles to the domain

在 Azure 上部署云服务项目后,请使用 AD 域扩展将角色实例连接到自定义 AD 域。Once your cloud service project is deployed on Azure, connect your role instances to the custom AD domain using the AD Domain Extension. 若要将 AD 域扩展添加到现有云服务部署并加入自定义域,请在 PowerShell 中执行以下命令:To add the AD Domain Extension to your existing cloud services deployment and join the custom domain, execute the following commands in PowerShell:

# Initialize domain variables


$domain = '<your-domain-name>'
$dmuser = '$domain\<your-username>'
$dmpswd = '<your-domain-password>'
$dmspwd = ConvertTo-SecureString $dmpswd -AsPlainText -Force
$dmcred = New-Object System.Management.Automation.PSCredential ($dmuser, $dmspwd)


# Add AD Domain Extension to the cloud service roles


Set-AzureServiceADDomainExtension -Service <your-cloud-service-hosted-service-name> -Role <your-role-name> -Slot <staging-or-production> -DomainName $domain -Credential $dmcred -JoinOption 35

这就是所有的操作。And that's it.

云服务应已加入自定义域控制器。Your cloud services should be joined to your custom domain controller. 如果你想要深入了解用于配置 AD 域扩展的其他选项,请使用 PowerShell 帮助。If you would like to learn more about the different options available for how to configure AD Domain Extension, use the PowerShell help. 下面是一些示例:A couple of examples follow:

help Set-AzureServiceADDomainExtension
help New-AzureServiceADDomainExtensionConfig