This procedure describes how to set up an Active Directory Domain Controller on a Raspberry Pi 4 Model B running Raspberry Pi OS. It includes some additional items that are not essential, e.g. booting from SSD, backup, restore, Airprint server.
I have done this both to remind me how I did it and also to instruct you should you wish to do the same.
I have tested this procedure a number of times at the time of writing but there is no guarantee that it will not require modification as time goes by. It is offered without any form of warranty. Use it at your own risk.
This is a list of hardware that I have used to build my system and produce this procedure. It is meant only as a guide, not as an obligatory parts list.
Open the case and screw the Pi 4 circuit board onto the base.
Stick the heatsinks onto the top of the four larger chips - the large square silver one, the black oblong one to its right, and the two smaller black sqare ones to its right. The bottom of the heatsinks are fitted with double sided sticky tape; you will have to remove the blue protective film.
Screw the fan to the case lid, ensuring that it is oriented correctly. Connect the fan cable so that the red wire connects to pin 4 and the black to pin 6 of the GPIO header. If there is a third control wire then connect it to pin 8.
Screw the lid onto the case.
Connect the micro-HDMI end of the cable to the micro-HDMI socket next to the USB-C port on the Pi. Connect the other end of the cable to the monitor.
Connect the keyboard to one of the black USB ports on the Pi.
Connect the mouse to the other black USB port.
Connect the Pi to your router using an Cat5e ethernet cable. I always think that it is better to start with a wired connection even if eventually I want to connect wirelessly.
Do NOT connect the power supply yet.
Ensure that the Pi is powered down.
Using the Raspberry Pi Imager on your PC/MAC/Linux box, install "Raspberry Pi OS with desktop" on to the micro-SD card. Once complete, insert the micro-SD card into the Pi.
Ensure that the monitor is powered up. Connect the power supply to the USB-C port on the Pi and then connect the power supply to the mains.
The Pi will then perform its first boot, which will eventually load the desktop and present you with a Welcome Wizard.
On this first screen click on the Next button.
The next screen allows you to set Country, Language and Timezone. Click on the Next button.
The next screen allows you to change the password for the default 'pi' user. You can do this later if you prefer. Click on the Next button.
The next screen allows you to remove a black border around your screen, if you have one. Click on the Next button.
The next screen allows you to select your wifi network. If you have a wired connection then skip this step.
The next screen allows you to update the software on your micro-SD card. You can skip this step but I would recommend doing it at this point.
The next screen prompts you to restart your Pi so that all settings will take effect. I recommend doing this.
Once the Pi has rebooted and is back at the desktop, select Menu (the icon of a raspberry in a circle) -> Preferences -> Mouse and keyboard Settings.
In the Mouse tab, the settings should be useable unless you are left-handed, in which case you can swap the buttons over here.
In the Keyboard tab, click on the Keyboard Layout... button. Set the Model, Layout and Variant for your particular keyboard and then click the OK button.
Click the OK button to exit the Mouse and Keyboard Settings dialog.
Select Menu -> Preferences -> Raspberry Pi Configuration.
In the System tab, set Hostname to your chosen name for this Pi, e.g. 'Pi4DC'. Set Auto login to Disabled for a bit of security. Set Splash Screen to Disabled unless you like eye candy.
In the Interfaces tab set SSH and VNC to Enabled. Click on the OK button to exit the Raspberry Pi Configuration dialog.
The next screen prompts you to restart your Pi so that all settings will take effect. I recommend doing this.
Wait until the Pi has rebooted and is back at the desktop.
If you have a printer on your network then ensure that it is powered up and is ready, otherwise skip this section.
Select Menu -> Preferences -> Print Settings.
In the Print Settings dialog, click on the Add button.
In the Devices box, select Network Printer.
If your printer is not already shown then select Find Network Printer.
Select your printer in the Devices box.
In the Connection box, select your preferred driver.
Click on the Forward button.
Select any options and then click on the Forward button.
Select Print Test Page and confirm that the test page is printed.
Ensure that the printer is shared.
Close the Print Settings dialog.
Right click on the Network (the flashing up and down arrows) icon and select Wireless & Wired Network Settings.
Set Configure to 'interface' and 'eth0'.
Automatically configure empty options should be checked.
Set IPv4 Address to 192.168.0.2 (or whatever your chosen address is). This will give the Pi a static IP address, which is necessary for it to become an AD DC.
Set Router to 192.168.0.1 (or whatever is the IP address of your router).
Click on the Apply button to apply the changes.
Click the Close button to exit the Wireless & Wired Network Settings dialog.
Select Menu -> Shutdown and then select Reboot.
Wait for the Pi to reboot and display the desktop.
I have a 4-port HDMI-USB KVM to which I have connected a) a Pi 3 running Ubuntu Mate, b) a Windows 10 Pro desktop and c) a Windows 10 Pro laptop. All three of these devices work well with the KVM. Try as I may, I could not get my Pi 4 to play nicely with the KVM; the mouse and keyboard stubbornly refused to be detected by the Pi 4. After more than a few hours of trying different cables, unplugging other devices and separately powering the KVM, I decided to admit defeat and go for headless operation via SSH/VNC.
SSH and VNC have already been enabled on the Pi so there is nothing further to do there.
Because I want the Pi 4 to boot with no monitor attached, we need to make a couple of tweaks to the config file in order to make the (non-existent) display default to 1920x1080.
Ensure that the Pi is running and displaying the desktop.
Click on the Terminal icon to open a terminal window. Type the following command followed by Return.
sudo nano /boot/config.txt
The config.txt file is opened in the Nano text editor.
Make the following changes to the file. Note that these lines should not begin with a # character.
hdmi_force_hotplug=1 hdmi_group=2 hdmi_mode=82 hdmi_ignore_edid=0xa5000080
Press ctrl-x followed by 'y' followed by Return. The changes to the file are saved.
In the same terminal window, type the following command followed by Return.
sudo reboot now
Wait for the Pi to reboot and display the desktop.
Install a RealVNC-compatible VNC viewer on your PC/MAC/Linux box and test that you can successfully connect to the Pi.
Install Putty on your PC/MAC/Linux box and test that you can successfully connect via SSH to the Pi.
Booting from SSD is significantly faster than booting from micro-SD card, and, what is more, no micro-SD card need be present.
You need to be aware that not all USB to SATA adapters work with the Pi. There is a list of known working and known problematic adapters at James Chambers website. I was unaware of this list when I bought this one, however, I checked in the comments/reviews before purchasing to ensure that someone had reported it working with a Pi 4 and no-one had reported it not working.
Ensure that the Pi has booted from the micro-SD card without the SSD connected and the desktop is displayed.
Connect the SSD to one of the blue USB ports on the Pi.
If a Removeable Medium Is Inserted dialog is displayed, click on the Cancel button.
Select Menu -> Accessories -> SD Card Copier.
Set Copy From Device to the micro-SD card (/dev/mmcblk0).
Set Copy To Device to the SSD (/dev/sda).
Click on the Start button to copy the operating system to the SSD. This will take a few minutes to complete. Click on the OK button to dismiss the message box. Click on the Close button to exit the SD Card Copier dialog.
Click on the Terminal icon to open a terminal window. Type the following command followed by Return.
sudo raspi-config
In the Raspberry Pi Software Configuration Tool opening screen, use the up and down arrow keys to move the highlight up and down; use the Tab key to move the highlight from the list to the buttons.
Select System Options and then <Select>.
Select Network at Boot and then <Select>.
Select <Yes> and then <OK>.
Select Advanced Options and then <Select>.
Select Boot Order and then <Select>.
Select USB Boot and then <OK> and then <OK> again.
Select <Finish> and then <No> to exit the Raspberry Pi Software Configuration Tool.
In the same terminal window, type the following command followed by Return.
sudo shutdown now
Once the Pi has fully shutdown, disconnect power from the Pi.
Remove the micro-SD card from the Pi.
Mark this micro-SD card as "Raspberry Pi OS install prior to copying to SSD".
Reconnect power to the Pi.
Gasp in amazement at how quickly the Pi reboots and displays the desktop.
Finally, we want to stop the Pi from continually polling for an SD card while it is running because it just wastes CPU. Click on the Terminal icon to open a terminal window. Type the following command followed by Return.
sudo nano /boot/config.txt
The config.txt file is opened in the Nano text editor.
There is a group of lines that start with "#dtparam"; add the following line immediately after those. Note that it does not start with a '#' character.
dtparam=sd_poll_once
Press ctrl-x followed by 'y' followed by Return. The changes to the file are saved.
In the same terminal window, type the following command followed by Return.
sudo reboot now
Once the Pi has rebooted, make a backup; then you can create the active directory domain controller.
The Pi should have booted from the SSD or micro-SD card with no other media present and displaying the desktop.
Connect an 8GB or greater USB memory stick the remaining blue USB port on the Pi.
Select Menu -> Accessories -> SD Card Copier.
Set Copy From Device to the boot device.
Set Copy To Device to the USB memory stick.
Click on the Start button to copy the operating system to the USB memory stick. This will take a few minutes to complete. Click on the OK button to dismiss the Copy Complete box. Click on the Close button to exit the SD Card Copier dialog.
Remove the USB memory stick from the blue USB port on the Pi.
Mark this memory stick with thedescription and time and date of the backup.
Shutdown the Pi and disconnect the power from it.
Insert the USB memory stick containing the backup into a blue USB port on the Pi.
Remove any other media (SSD / USB memory stick / micro-SD card).
Reconnect power to the Pi.
Wait for the Pi to reboot and display the desktop.
Connect the USB device to which you want to restore the backup.
Select Menu -> Accessories -> SD Card Copier.
Set Copy From Device to the USB memory stick from which you booted.
Set Copy To Device to the USB device to which you want to restore the backup.
Click on the Start button to copy the boot device. This will take a few minutes to complete. Click on the OK button to dismiss the Copy Complete box. Click on the Close button to exit the SD Card Copier dialog.
Shutdown the Pi and disconnect the power from it.
Remove the USB memory stck containing the backup.
Reconnect power to the Pi.
Wait for the Pi to reboot from the device with the restored backup and display the desktop.
Before we can proceed we need to decide on/make a note of a few things.
| AD DC Hostname | Pi4DC | refer to Menu -> Preferences -> Raspberry Pi Configuration -> System |
| AD DNS Domain Name | gander.bag | if possible, use something that does not exist on the web |
| Kerberos Realm | GANDER.BAG | as above but in capitals |
| NETBios domain name | GANDER | just the first bit of the above |
| IP Address | 192.168.0.2 | refer to IPv4 Address in Wireless & Wired Network Settings |
| Forwarder DNS Server | 192.168.0.1 | refer to Router in Wireless & Wired Network Settings |
| Server Role | Domain Controller | |
| Samba administrator password | ******** | you decide |
Click on the Terminal icon to open a terminal window. Type the following command followed by Return.
sudo -i wget -O - http://apt.van-belle.nl/louis-van-belle.gpg-key.asc | apt-key add - echo "deb http://apt.van-belle.nl/debian buster-samba413 main contrib non-free" | tee -a /etc/apt/sources.list.d/van-belle.list apt-get update apt-get upgrade
When asked "Do you want to continue? [Y/n]", type Y and then <ENTER>.
apt-get install samba krb5-config krb5-user winbind smbclient
When asked whether to "Modify smb.conf to use WINS settings from DHCP?", press <ENTER>.
When prompted for the "Default Kerberos version 5 realm", press <ENTER>.
In the same terminal window, type the following command followed by Return.
nano /etc/hosts
Comment the 127.0.1.1 line.
#127.0.1.1 Pi4DC
Add the following line to the end of the file.
192.168.0.2 Pi4DC.gander.bag Pi4DC
Press ctrl-x followed by 'y' followed by Return. The changes to the file are saved.
In the same terminal window, type the following commands followed by Return.
nano /etc/dhcpcd.conf
At the end of the file, replace any section beginning with 'interface eth0' with the following lines.
interface eth0 static ip_address=192.168.0.2/24 static routers=192.168.0.1 static domain_name_servers=192.168.0.2 static domain_search=gander.bag
Press ctrl-x followed by 'y' followed by Return. The changes to the file are saved.
In the same terminal window, type the following commands followed by Return.
rm /etc/samba/smb.conf rm /etc/krb5.conf rm /var/run/samba/*.tdb rm /var/run/samba/*.ldb rm /var/lib/samba/*.tdb rm /var/lib/samba/*.ldb rm /var/cache/samba/*.tdb rm /var/cache/samba/*.ldb rm /var/lib/samba/private/*.tdb rm /var/lib/samba/private/*.ldb samba-tool domain provision --use-rfc2307 --interactive
When prompted respond as shown.
Realm [GANDER.BAG]: <ENTER>
Domain [GANDER]: <ENTER>
Server Role (dc, member, standalone) [dc]: <ENTER>
DNS backend (SAMBA_INTERNAL, BIND9_FLATFILE, BIND9_DLZ, NONE) [SAMBA_INTERNAL]: <ENTER>
DNS forwarder IP address (write 'none' to disable forwarding) [192.168.0.1]: <ENTER>
Administrator password: ********
Retype password: ********
In the same terminal window, type the following commands followed by Return.
cp /var/lib/samba/private/krb5.conf /etc/krb5.conf systemctl disable --now smbd nmbd winbind systemd-resolved systemctl unmask samba-ad-dc.service systemctl enable --now samba-ad-dc.service samba-tool domain level show reboot now
Wait until the Pi reboots and displays the desktop.
Click on the Terminal icon to open a terminal window. Type the following command followed by Return.
# These next 3 lines should show no error host -t SRV _ldap._tcp.gander.bag host -t SRV _kerberos._udp.gander.bag host -t A Pi4DC.gander.bag read -p 'The previous 3 commands should show no error. Press Enter to continue.' sudo -i kinit Administrator klist read -p 'The previous 2 commands should show no error. Press Enter to continue.' # Now we try to connect to the Pi server using smbclient smbclient -L Pi4DC.gander.bag -U 'administrator' read -p 'You should see netlogon and sysvol listed above. Press Enter to continue.' # Create Users and Groups # Customise this to your own need # Remove expiry of admin password samba-tool user setexpiry Administrator --noexpiry # Create some users. Replace ******** with actual passwords samba-tool user create bob ******** samba-tool user create carol ******** samba-tool user create ted ******** samba-tool user create alice ******** # Create any groups you need samba-tool group add nasboss samba-tool group add nasusers # Add users to groups samba-tool group addmembers nasboss bob samba-tool group addmembers nasusers carol,ted,alice samba-tool group addmembers 'Domain Admins' carol, ted
At this point you could reboot your Pi and you should have a fully functioning active directory domain controller, or you could add Airprint functionality to it by continuing.
If you added your printer to the Pi when you installed the operating system, and your printer does not support Airprint then you can add that facility now very easily.
# If you are not already running elevated then execute the next line sudo -i cupsctl --remote-any systemctl restart cups nano /etc/samba/smb.conf
Add the following lines to the bottom of the file
# CUPS printing. [printers] comment = All Printers browseable = no path = /var/spool/samba printable = yes guest ok = no read only = yes create mask = 0700
Press ctrl-x followed by 'y' followed by Return. The changes to the file are saved.
In the same terminal window, type the following commands followed by Return.
nano /etc/nsswitch.conf
Change the following line
hosts: files mdns4_minimal [NOTFOUND=return] dns
to
hosts: files dns
Press ctrl-x followed by 'y' followed by Return. The changes to the file are saved.
In the same terminal window, type the following commands followed by Return.
apt install avahi-daemon reboot now
Wait until the Pi reboots and displays the desktop.
You now have an active directory domain controller that enables you to print from your iPhone / iPad. Happy days!