Installing Active Directory Domain Services on Windows Server

What is Active Directory Domain Services (ADDS)?#

Active Directory Domain Services (ADDS) is a server role in Windows Server that functions as the backbone of identity and access management (IAM) for enterprise networks. It stores information about network resources and data—such as users, computers, and other devices—in a hierarchical database structure.

At its core, ADDS serves two critical purposes:

1. Authentication & Authorization: It acts as a centralized gatekeeper, verifying who a user is (Authentication via Kerberos) and determining what resources they are allowed to access (Authorization).

2. Centralized Management: Through Group Policy Objects (GPO), administrators can enforce security policies, install software, and configure settings across thousands of computers simultaneously from a single console.

In summary: If a network were a building, ADDS would be the security team at the front desk holding the master key and the rulebook for every employee and room inside.

Reference#

Microsoft Learn: Active Directory Domain Services Overview.

TechTarget: What is Active Directory?

Microsoft Learn: Hardware requirements for Windows Server.

Microsoft Learn: Install Active Directory Domain Services.

Prerequisites: Before You Begin#

Before promoting a server to a Domain Controller (DC), ensure your environment meets the following requirements to ensure stability and prevent future connectivity issues.

1. Static IP Address (Critical)

A Domain Controller functions as a server for authentication and DNS for other clients. Therefore, its IP address must never change.

• Action: Assign a static IPv4 address to the network adapter.

• DNS Settings: For the first Domain Controller in a new forest, point the Preferred DNS server to its own IP address (or 127.0.0.1).

2. Meaningful Hostname

By default, Windows assigns a random hostname (e.g., WIN-XYZ123). Changing this before installation is mandatory for easier management and identification.

Recommendation: Use a standard naming convention (e.g., DC01-JKT, SRV-AD-01).

3. Local Administrator Account

Ensure the local Administrator account has a strong, complex password. During the promotion process, this account will become the first Domain Administrator account.

4. System Updates

Ensure your Windows Server 2022 is fully updated with the latest cumulative updates from Microsoft to patch any security vulnerabilities before exposing it as a trusted identity server.

Pro Tip: Disable IPv6 on the network adapter if you do not plan to use it, to simplify network troubleshooting and DNS resolution logs.

Installation#

Windows Server offers two primary methods to install Active Directory: via PowerShell (for automation and speed) or Server Manager (GUI). While PowerShell allows you to install the role with a single command (Install-WindowsFeature AD-Domain-Services -IncludeManagementTools), we will focus on the Server Manager method for better visualization of the process.

Add Roles and Features Wizard

Open Server Manager, Click Manage > Add Roles and Features

Select Installation Type

Upon launching the wizard, you will be asked to choose an installation type. Keep the default selection: Role-based or feature-based installation.

• Why? This option is used when you want to install roles (like ADDS, DNS, DHCP) on a specific server—whether it is the local machine you are currently logged into or another server managed via Server Manager.

• Note: The second option (Remote Desktop Services installation) is strictly for deploying Virtual Desktop Infrastructure (VDI) environments and is not used for setting up a Domain Controller.

Click Next to proceed.

Note: Ensure you have renamed your server before this step. The screenshot above shows a default hostname, but yours should follow your naming convention (e.g., DC01).

Identify where the Active Directory role will be installed.

1. Selection Method: Ensure that "Select a server from the server pool" is selected.
2. Verify Server Details: Under the Server Pool list, select your local server.

Click Next to continue.

Select Server Roles

This is the step where you define the server's primary function.

1. Select the Role: Look for Active Directory Domain Services in the list and check the box.

2. Understand the Role: As the description on the right indicates, AD DS stores information about users, computers, and other devices on the network.

⚠️ Troubleshooting Tip: If you see a yellow warning banner at the top saying "The destination server has a pending restart," (as seen in the screenshot), it is highly recommended to restart the server before proceeding. This usually happens after installing Windows Updates or changing system configurations. A clean restart ensures the installation process won't be interrupted.

Click Add Features to continue.

In the Features list, you generally do not need to manually select any additional items.

1. Review Defaults: You will notice that Group Policy Management is already checked. This was automatically selected in the previous step (via the pop-up) because it is an essential tool for administering Active Directory.

2. Keep it Clean: adhere to the "Least Privilege" and minimal installation principle. Do not install extra features unless you have a specific need for them. Keeping the server lightweight improves security and performance.

Click Next to continue.

Click Next to continue.

Click Install to continue.

Click Close to continue.

Restart the Server.

Post-Deployment Configuration.

Once the feature installation is complete, you will notice a yellow notification flag near the top right corner of the Server Manager dashboard.

1. Open Notifications: Click on the flag icon.

2. Initiate Promotion: You will see a message stating "Configuration required for Active Directory Domain Services". Click the blue link labeled "Promote this server to a domain controller".

3. What happens next? This action will close the installation wizard and open the Active Directory Domain Services Configuration Wizard, where the actual setup of your domain begins.

ADDS Configuration Wizard

Deployment Configuration

Since this is the first Domain Controller in environment, you are creating a brand new forest.

1. Select Deployment Operation: Choose "Add a new forest".

   • Note: The other two options are used when you want to add a server to an existing domain (e.g., for redundancy or a branch office), which is not the case here.

2. Root Domain Name : Enter the Fully Qualified Domain Name (FQDN) for your internal network.

   • In this example, we use company.local.

   • This name will serve as the DNS suffix for all computers joined to the domain (e.g., pc1.company.local).

3. Next: Click Next to verify the name availability (NetBIOS name check) and proceed.

Pro Tip on Naming: For lab environments, .local is perfectly fine. However, for production networks, especially those with macOS/Linux devices, it is recommended to use a subdomain of a valid public domain (e.g., corp.yourdomain.com) to avoid potential DNS conflicts.

Domain Controller Options

Configure the core capabilities of your new Domain Controller:

1. Functional Levels:

   • Leave both Forest and Domain functional levels at Windows Server 2016.

   • Note: Even though you are running Windows Server 2022, "Windows Server 2016" is the highest functional level available for this version. This is normal and ensures backward compatibility.

2. Specify Capabilities:

   • Domain Name System (DNS) server: Keep this checked. Active Directory relies heavily on DNS to locate resources. Since this is the first server, it should host the DNS zone.

   • Global Catalog (GC): This is checked by default and grayed out. The first Domain Controller in a forest must be a Global Catalog server.

3. DSRM Password (Crucial):

   • Type a strong password for the Directory Services Restore Mode (DSRM).

   • Warning: This is NOT your regular admin password. This password is used only if you need to boot the server into Safe Mode to repair a corrupted Active Directory database. Write this down and store it securely.

Click Next to proceed.

Fact: Microsoft did not create a new Functional Level for Windows Server 2019 or 2022. The AD database structure (Schema) in these versions is still compatible with the 2016 level.

DSRM Password = "Lifesaver" Password. Many senior admins often forget their DSRM password because it's rarely used (perhaps only once every 5 years during disaster recovery).

Best Practice: We recommend that readers document this password physically or in a company password manager. If AD crashes and backups fail, this password is the only way to perform an authorized restore.

DNS Options

In this step, you will likely encounter a warning banner stating: "A delegation for this DNS server cannot be created...".

1. Don't Panic: This warning is completely normal and expected when installing a new Forest Root Domain (especially with a .local extension).

2. Why it appears: The wizard is trying to contact a "parent" DNS server to authorize this new domain. Since you are creating a private, standalone network from scratch, no such parent exists.

3. Action: You can safely ignore this warning. The wizard will automatically install and configure the local DNS server to handle name resolution for your domain.

4. Proceed: Click Next to continue.

NetBIOS Domain Name

The wizard will automatically generate a NetBIOS domain name based on the Root Domain Name you entered earlier.

1. Automatic Generation: Since you used company.local, the system truncates the suffix and suggests COMPANY as the short domain name.

2. Usage: This name is used for backward compatibility with older applications and is what you will see on the login screen (e.g., COMPANY\Administrator).

3. Verification: Unless you have a specific naming conflict on your network, accept the default suggestion and click Next.

Paths

Here, you define where Active Directory stores its critical files:

1. Database folder: Holds the actual directory database (specifically the NTDS.DIT file).

2. Log files folder: Stores transaction logs used to recover the database in case of a crash.

3. SYSVOL folder: A shared folder containing Group Policy Objects (GPO) and login scripts. This folder is automatically replicated to every Domain Controller in the domain.

Recommendation: For standard installations, keep the default paths (C:\Windows...) and click Next.

Click Next to continue.

Prerequisites Check

The wizard performs a final scan to ensure the server is ready to be promoted.

1. The Green Checkmark: Look for the message "All prerequisite checks passed successfully" at the top of the window. This indicates you are good to go.

2. Review Warnings: You will see a few yellow warning icons in the results box:

   • Cryptography Algorithms: This warning informs you that Windows Server 2022 has security defaults that are too high for very old systems (like Windows NT 4.0). This is a good thing for security.

   • DNS Delegation: As discussed earlier, this is expected for a new private domain.

   • Action: These warnings are informational and do not block the installation.

3. Execute: Click Install to begin the promotion process.

⚠️ Important: Once you click Install, the process will take several minutes. When it finishes, the server will automatically reboot to apply the changes. Do not interrupt this process.

Usually after you click install it will restart automatically. After that you see that ADDS is installed on Windows Server.