Installing a Windows Server with AD DS Role (Domain Controller)

A domain controller is not a product you install: it is an ordinary Windows server to which you add a role, and which you then promote. This lab starts from a freshly installed Windows Server and ends on a working SDE.LOCAL domain, ready to receive organizational units, groups and accounts.

SummaryWhat you will be able to do by the end

• Pin down a server’s network identity so it can carry a directory.
• Install the Active Directory Domain Services (AD DS) role.
• Promote the server and create a new forest.
• Understand what the wizard decides behind the scenes: built-in DNS, functional levels, DSRM, SYSVOL.
• Verify that the promotion actually succeeded.

Why the order of the steps matters

Three phases follow one another, and the order is not negotiable.

Phase	What you do	Why now
1	Static IP address and machine name	Both values get written into the directory at promotion time
2	Install the AD DS role	Drops the binaries, creates nothing
3	Promote to domain controller	Creates the forest, the domain, the database and DNS

The key point is that phase 3 carves in what phase 1 defined. A domain controller publishes its name and address in its own DNS records, and clients use those records to find it. Renaming the machine or changing its address afterwards is not a one-click fix: it requires dedicated procedures, or even demoting and re-promoting the server.

DefinitionDomain controller and DNS server are inseparable

Active Directory has no way of locating its services other than DNS. A client looking for a domain controller queries SRV records such as _ldap._tcp.dc._msdcs.sde.local. That is why the promotion wizard installs the DNS role automatically, and why the server becomes its own resolver: without it, nothing in the domain could be found.

That dependency is exactly what dictates the first step.

Step 1: pin down the server’s network identity

A domain controller must be reachable at a predictable address, under a name that will never change again. So both get settled before anything is installed.

1. Open the network adapter list

   Open the Run dialog with Win + R, type ncpa.cpl and confirm to jump straight to the network adapter list.

   

2. Open the IPv4 properties

   Open the properties of the Ethernet adapter and double-click Internet Protocol Version 4 (TCP/IPv4) to edit its settings.

   

3. Switch to static addressing

   Select the option to use a static configuration and enter the IP address, subnet mask and default gateway. Leave the DNS fields empty for now.

   

   The values used in this lab:

   Setting	Value	Role
   IP address	172.16.1.50	the address clients will query
   Subnet mask	255.255.255.0	delimits the server’s local network
   Default gateway	172.16.1.254	exit towards other networks
   Preferred DNS server	empty for now	filled in automatically at promotion

   ExplanationWhy leave DNS empty

   The promotion installs the DNS role on this very machine, then points its adapter at 127.0.0.1. Entering the ISP resolver or a router address here would produce a server that looks for its own domain on the outside, fails to find it, and takes several minutes to start its directory services. The empty field is the correct setting, not an oversight.

   WarningNever DHCP for a domain controller

   A DHCP lease can change address on renewal. The domain’s DNS records would then be wrong, and no client would find the controller any more. Static addressing is not a preference here, it is a constraint.

4. Locate the current machine name

   Open Server Manager, select Local Server and locate the current computer name in the properties pane.

   

5. Open the rename dialog

   Open the System Properties on the Computer Name tab and click Change... to rename the server.

   

6. Name the server and restart

   Type the new machine name (here SRV-AD), confirm with Ok, and restart when prompted so the change takes effect.

   

   TipPick a name that ages well

   A machine’s NetBIOS name is limited to 15 characters and must contain no space and no accented character. Prefer a convention describing the function or the site rather than the hardware: SRV-AD or SRV-CHA stay accurate after a server swap, DELL-R740 does not.

The server identity is stable. The role binaries can now be dropped in.

Step 2: install the AD DS role

This step creates nothing: it merely installs the required components. The domain will only exist after the next step. Microsoft separated the two on purpose, so a server can be prepared without committing a single change to the directory.

1. Launch the wizard

   Launch the Add Roles and Features Wizard from Server Manager. The first page recaps the prerequisites, so read it and click Next.

   

2. Choose the installation type

   Keep the default Role-based or feature-based installation option and continue. The other choice, Remote Desktop Services installation, covers an entirely different scenario.

   

3. Select the destination server

   Select the local server (SRV-AD) from the server pool as the installation target and continue. The pool can hold several remotely managed machines, so check that the selected row really carries the name and address set in step 1.

   

4. Tick the role then confirm

   In the role list, tick Active Directory Domain Services. The wizard immediately offers to add the matching management features, accept them: those are the consoles you will work with afterwards. Move on to the confirmation page and start the installation.

   Note

   Nothing happens on the directory side when this installation finishes. The server has simply become capable of carrying a domain.

The binaries are in place, the server is waiting to be promoted.

Step 3: promote the server to domain controller

This is where everything gets created: the forest, the domain, the directory database, the DNS zone and the SYSVOL share. The wizard asks a series of questions, each of which locks in a lasting choice.

1. Start the promotion

   Once the role is installed, open the notification flag in Server Manager and click Promote this server to a domain controller.

   

2. Create a new forest

   In the deployment configuration, choose Add a new forest and enter the root domain name, here SDE.LOCAL.

   

   The three options match three distinct situations:

   Option	When to use it
   Add a new forest	first domain controller, no existing directory: our case
   Add a new domain to an existing forest	create a subsidiary under a directory already in place
   Add a domain controller to an existing domain	add a second controller for redundancy

   TipChoosing the suffix

   .local was long the convention for internal domains. It does however clash with mDNS and rules out public certificates. On a fresh deployment, a subdomain of a name you own, such as ad.example.com, avoids both pitfalls. This lab keeps SDE.LOCAL for consistency with the screenshots and with the rest of the series.

3. Set the functional levels and the DSRM password

   Set the forest and domain functional levels (here Windows Server 2016), keep the DNS server and global catalog options, and provide a Directory Services Restore Mode password.

   

   ExplanationWhat a functional level locks in

   The functional level defines the minimum Windows Server version accepted for future controllers in the domain, and in exchange unlocks that version’s directory features. It is easy to raise later, and practically impossible to lower. So pick the highest version every controller you have, and every one you plan, can handle.

   ImportantThe DSRM password is not the administrator's

   Directory Services Restore Mode boots the controller with the directory offline, to repair or restore the database. This password is the only way in, and it follows neither the domain password policy nor the Administrator account password. File it in your password manager on installation day: the day you need it, the directory will be precisely what is broken.

   NoteRODC, the greyed-out box

   Read only domain controller is unavailable here, and that is expected: an RODC replicates from a writable controller, so it cannot be the very first one in the forest.

4. Ignore the DNS delegation warning

   On the DNS Options page, the wizard warns that no DNS delegation can be created. Leave the delegation option unchecked and continue.

   

   Note

   This warning always shows up when creating a new forest: there is no parent zone yet to delegate SDE.LOCAL to. It is expected, not a symptom of an error.

5. Check the NetBIOS name

   Verify the NetBIOS domain name proposed by the wizard, here SDE, and adjust it only if needed.

   

   Tip

   That short name is what will appear in front of credentials, as SDE\Administrateur, and in older clients that ignore DNS names. The wizard derives it from the first segment of the domain. Unlike the DNS name, it is fixed at creation time.

6. Keep the default paths

   Keep the default locations for the AD DS database, log files and SYSVOL folder.

   

   DefinitionThe three paths, and what they hold

   The database (ntds.dit) holds every directory object, accounts and groups included. The log files record transactions before they are written to the database, which is what allows it to be rebuilt after an abrupt shutdown. SYSVOL is a share replicated across all controllers, hosting group policies and logon scripts. That last one is what the next lab uses to map users’ network drives.

7. Review the summary

   Review the summary of selections to confirm the new forest and domain settings before proceeding. This is the last screen before irreversible changes.

   

8. Start the installation

   The wizard runs the prerequisites check. Once every item passes, click Install to begin the promotion.

   

   Note

   Yellow warnings on this page are normal, in particular the one about default security settings or DNS delegation. Only a red error actually blocks the installation.

9. Let the server reboot

   When the installation finishes, the server signs out and reboots automatically to complete the promotion.

   

Verify and carry on

After the reboot, the sign-in screen shows the domain account (SDE\Administrateur) instead of a local one: the server now belongs to the domain it hosts itself.

That is the first sign, but not proof enough. The four checks below confirm the promotion actually succeeded.

To check	Command or console	Expected result
The server is its own DNS	ipconfig /all	DNS server at 127.0.0.1 or the server’s address
The domain resolves	nslookup sde.local	the controller’s address, here 172.16.1.50
The service records exist	nltest /dsgetdc:sde.local	the controller is returned with its capabilities
The directory answers	dsa.msc	the Users and Computers console opens on SDE.LOCAL

TipIf nslookup fails right after the reboot

Directory services and the DNS zone sometimes take a minute or two to settle on first boot. Wait, then run the command again before concluding there is a configuration error.

The SDE.LOCAL domain is up, but it is empty: no organizational unit, no group, no user. That is the subject of the next article in the series, which builds a complete organization on this controller and names it SRV-CHA in a three-site topology: Active Directory multi-sites, network shares and user rights management.