LDAP

This guide walks through the complete process of preparing a clean Windows Server 2019 installation for secure directory services. In just a few steps, you’ll bring the server entirely up to date, install and promote Active Directory Domain Services (AD DS) to create a new forest, and enable LDAP over SSL (LDAPS) for encrypted communication.

The resulting environment provides a controlled, self-contained directory system ideal for testing and validating Metaform’s LDAP connector. By simulating a realistic Active Directory deployment — complete with user accounts, secure authentication, and SSL-encrypted LDAP bindings — developers can verify that Metaform’s connector correctly performs queries, binds, and schema lookups without relying on external infrastructure or production networks.

This configuration is advantageous for:

• Reproducing authentication and access scenarios during connector development
• Validating schema mappings and search filters against a known dataset
• Ensuring LDAPS-based encryption and credential handling work as expected

Each section includes a short “Why” paragraph that explains the purpose of the action, along with a PowerShell block that can be executed directly in an elevated session, making the entire setup reproducible and automation-friendly.

Before You Begin

Run all commands in PowerShell as Administrator on a clean Windows Server 2019 installation. Make sure the server has:

• A static IP address
• A descriptive hostname (e.g., METAFORM-DC1)
• Internet connectivity for updates and module installation

Installation

# Run as Administrator

Set-ExecutionPolicy -Scope Process RemoteSigned -Force
if ((Get-PSRepository PSGallery -ErrorAction SilentlyContinue).InstallationPolicy -ne 'Trusted') { Set-PSRepository PSGallery -InstallationPolicy Trusted }
if (-not (Get-PackageProvider NuGet -ErrorAction SilentlyContinue)) { Install-PackageProvider NuGet -Force }
if (-not (Get-Module -ListAvailable PSWindowsUpdate)) { Install-Module PSWindowsUpdate -Force }
Import-Module PSWindowsUpdate
Get-WindowsUpdate -MicrosoftUpdate
Install-WindowsUpdate -AcceptAll -AutoReboot -Verbose

# Run as Administrator

Set-ExecutionPolicy -Scope Process RemoteSigned -Force
Rename-Computer -NewName "METAFORM-DC1" -Force
Install-WindowsFeature AD-Domain-Services -IncludeManagementTools

# Run as Administrator
# Promote to Domain Controller (create a new forest)

Import-Module ADDSDeployment
$dsrm = ConvertTo-SecureString "Getnew1" -AsPlainText -Force
Install-ADDSForest `
  -DomainName "metaform.local" `
  -DomainNetbiosName "METAFORM" `
  -SafeModeAdministratorPassword $dsrm `
  -InstallDNS `
  -Force

Get-ADDomainController
dcdiag /v

Import-Module ActiveDirectory
$dsrm = ConvertTo-SecureString "Getnew1" -AsPlainText -Force
New-ADUser -Name "metaform" -Path "CN=Users,DC=metaform,DC=local" `
  -AccountPassword $dsrm -Enabled $true
Add-ADGroupMember "Domain Admins" "metaform"
Set-ItemProperty "HKLM:\System\CurrentControlSet\Control\Terminal Server" fDenyTSConnections 0
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

# Run as Administrator

# Create a self-signed cert valid for LDAPS
$cert = New-SelfSignedCertificate `
  -DnsName "METAFORM-DC1.metaform.local","localhost","127.0.0.1" `
  -CertStoreLocation "Cert:\LocalMachine\My" `
  -FriendlyName "AD LDAPS Self-Signed" `
  -KeyLength 2048 `
  -KeyExportPolicy Exportable `
  -NotAfter (Get-Date).AddYears(5) `
  -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.1")

# Verify certificate created
Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -like "*METAFORM-DC1*" }

# Allow LDAPS from specific network or any (less secure)
New-NetFirewallRule -DisplayName "Allow LDAPS" -Direction Inbound -Protocol TCP -LocalPort 636 -Action Allow
Restart-Computer -Force

Test-NetConnection localhost -Port 636

Conclusion

With these steps complete, your Windows Server 2019 host now operates as a fully functional, self-contained domain controller for the metaform.local forest. The system is fully patched, hardened, and supports both unencrypted and encrypted directory access. The configuration enables seamless integration with applications, LDAP clients, and remote management tools that rely on secure directory communication.

The following services and ports are now active and ready for use:

Your directory is now reachable through both LDAP (389) and LDAPS (636) for local and remote clients, depending on firewall rules. The self-signed certificate ensures encrypted communication is available immediately while allowing a smooth upgrade path to a trusted CA-signed certificate.

This setup provides a secure, isolated Active Directory foundation—ideal for development, testing, and integration work. Next steps might include joining client machines to the domain, configuring group policies, or integrating applications that require LDAP authentication.

Troubleshooting

Even after setup completes successfully, LDAPS connectivity can fail for several common reasons—usually related to certificates, hostname mismatches, or firewall restrictions. The following tools and checks will help you confirm that everything is functioning as intended.

# From the domain controller
Test-NetConnection localhost -Port 636

# From a remote client or another server
Test-NetConnection METAFORM-DC1.metaform.local -Port 636

Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -match "METAFORM-DC1" }

User: [email protected]
Password: Getnew1

ldapsearch -d 1 \
  -H ldap://METAFORM-DC1.metaform.local \
  -D "[email protected]" \
  -w "Getnew1" \
  -b "DC=metaform,DC=local" "(objectClass=user)"