Learn Active Directory - Installing Active Directory Domain Services

#Introduction

In episode 4, you understood how critical DNS is to AD. Now all that theory gets proven: it's time to install Active Directory Domain Services (AD DS) and promote the first server into a domain controller. This is where the ad.example.com domain you planned in episode 0 is truly born.

A principle to remember: installing AD DS is two separate steps. First, install the AD DS role (copying the service binaries). Second, promote the server into a domain controller (configuring and running the services). Both steps can be combined via a wizard, but understanding the separation helps during troubleshooting.

#Installation Prerequisites

Before pressing the install button, make sure this checklist is met:

• Windows Server installed — Server 2016, 2019, or 2022, with a valid license.
• Static IP address — a domain controller must never use DHCP for its own IP.
• DNS configured correctly — for the first promotion, the server points to itself as DNS, or to an existing DNS server when adding subsequent DCs.
• NetBIOS name decided — a single-label name for compatibility, e.g. AD, generated automatically from the domain name.
• Administrator rights — this process needs domain or local administrator credentials.
• Time synchronized — Kerberos is highly sensitive to clock skew; align with a trusted time source.
• Server is not a member of another domain — for the first DC in a forest, the server must be standalone.

Violating any of the above almost certainly results in a confusing mid-process failure — especially static IP and DNS.

#Installation Methods

AD DS installation can be done three ways:

• Server Manager GUI: run Add Roles and Features, select Active Directory Domain Services, then click "Promote this server to a domain controller".
• PowerShell: a combination of Install-WindowsFeature and Install-ADDSForest — an automatable, replicable approach.
• Server Core: installation without the full GUI; all configuration via PowerShell.

This episode focuses on the PowerShell path because it's automatable, consistent, and forces you to understand the parameters being run. The GUI and PowerShell flows lead to the same result.

#Installing the AD DS Role

Open PowerShell as administrator and install the role along with its management tools:

Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

The -IncludeManagementTools parameter matters for the lab: it installs consoles like ADUC and DNS Manager on the same server. To confirm the role is truly installed, check its status:

Get-WindowsFeature AD-Domain-Services

If the Install State line reads Installed, the role binaries are ready. The server isn't a domain controller yet — that's the next step's job.

#Promoting the First Domain Controller

Promotion is the decisive moment: the server will hold a new domain and a new forest at once, forming ad.example.com complete with DNS. The command used is Install-ADDSForest, with key parameters:

• DomainName: the DNS domain name, e.g. ad.example.com.
• DomainNetbiosName: the NetBIOS name, e.g. AD.
• ForestMode / DomainMode: functional levels; WinThreshold means Windows Server 2016 level (suitable for 2016+ and retains modern features).
• InstallDns: installs and configures the DNS server together with the promotion.
• SafeModeAdministratorPassword: the DSRM (Directory Services Restore Mode) password, a recovery credential that must be stored securely.

Install-ADDSForest `
    -DomainName "ad.example.com" `
    -DomainNetbiosName "AD" `
    -ForestMode "WinThreshold" `
    -DomainMode "WinThreshold" `
    -InstallDns `
    -SafeModeAdministratorPassword (ConvertTo-SecureString "Str0ng!DsrmPass" -AsPlainText -Force) `
    -Force

Note that DNS points to the server itself (episode 4): during promotion, the server will create the ad.example.com zone and the _msdcs zone complete with all SRV records. Once the command finishes, the server automatically restarts as the first domain controller in the forest.

By default, the AD database and logs are stored in C:\Windows\NTDS, and the policy share folder in C:\Windows\SYSVOL. These locations can be changed at promotion time if the server uses separate disks — a common practice in large production environments.

#DCPromo: Then vs Now

In the old days, DC promotion used a tool called DCPROMO.EXE — a separate wizard that had to be run, and in older versions required an answer file for automation. This approach was disconnected from the role installation and felt rigid.

Now, Microsoft has integrated it: install the AD DS role via Server Manager or PowerShell, then promote via the "Promote this server to a domain controller" wizard or the Install-ADDS* cmdlets. One important consistency: the GUI and PowerShell now run the same functions — the GUI wizard actually calls the cmdlets behind the scenes. Understanding PowerShell means understanding what the wizard does.

#Post-Installation Tasks

The domain is up, but the work isn't done. Several tasks are mandatory right after promotion:

• Verify DNS records: make sure the zone and SRV records are registered correctly in DNS Manager.
• Check replication: a new forest has no replication partners yet, but confirm there are no errors in the Directory Service event log.
• Configure sites: move subnets to the right site if you have a multi-location lab (episode 3).
• Synchronize time: configure the correct time source so Kerberos stays stable.
• Back up system state: do the first AD backup right after the DC comes up — before the next big change.

#Verifying the Installation

Comprehensive verification uses dcdiag, which runs dozens of tests against DC health:

dcdiag /c

Scan the output for lines flagging failures. To confirm FSMO role holders are on the correct DC:

netdom query fsmo

And to enter the AD database utility (ntdsutil), run the following command then explore its subcommands:

ntdsutil

These three tools — dcdiag, netdom query fsmo, and ntdsutil — will become your loyal companions in the upcoming troubleshooting episodes.

#Conclusion

In episode 5 you built your first domain controller: met the prerequisites, installed the AD DS role, promoted the server to the first DC in the forest with Install-ADDSForest, understood the difference between old and new DCPromo, and verified the installation with dcdiag, netdom, and ntdsutil.

Key takeaways:

• Installing AD DS is two steps: installing the role, then promoting.
• The most commonly violated prerequisites: static IP and DNS.
• Install-ADDSForest creates the domain, forest, and DNS all at once.
• The DSRM password must be stored securely; verification with dcdiag is mandatory.

In the next episode, we'll add a second domain controller — the key to fault tolerance and workload distribution — from why one DC is never enough, to promoting an additional DC that joins the existing domain, to verifying replication with repadmin. Your first domain is born; now it's time to make it resilient!