1. Overview and core concepts

Active Directory Domain Services (AD DS) is the Windows Server role that stores users, computers and groups, authenticates logons with Kerberos, and pushes settings through Group Policy. This KB takes an administrator from a bare Windows Server to a managed, hardened domain; each task gives the GUI path and the PowerShell equivalent.

Example values used throughout (replace with your own): domain corp.example.com, NetBIOS name CORP, first domain controller DC01 at 10.0.0.10, second DC02 at 10.0.0.11.

AD logical structure (forest, domains, OUs, DCs) and physical structure (sites)

Read the picture in two layers: the logical layer (forest, domains, OUs) decides who administers what and where policy applies; the physical layer (sites) tells AD which DCs are close to each other so logons and replication stay local.

2. Planning and prerequisites

Decide the forest name, IP plan and DC count before installing anything: a domain name is very hard to change later. Plan for at least two DCs per domain so one failure never stops logons.

2.1 Server sizing

2.2 Naming rules

• DNS domain name: use a subdomain of a public domain you own, such as corp.example.com or ad.example.com. Avoid .local and other made-up top-level domains; they clash with mDNS and cannot get public certificates.
• NetBIOS name: 15 characters or fewer, no dots, for example CORP.
• DC host names: short and predictable, for example DC01, DC02. Rename the server before promoting it.

2.3 Network and DNS

• Give every DC a static IP, subnet mask and gateway.
• On the first DC, set preferred DNS to another DC (once one exists) and alternate DNS to 127.0.0.1. On a brand-new forest, point it at itself.
• Clients and member servers must use the DCs as their DNS servers — never a public resolver directly. Add public resolvers as forwarders on the DCs instead.
• Open the required ports between sites: DNS 53, Kerberos 88, NTP 123, RPC 135, LDAP 389, SMB 445, LDAPS 636, GC 3268/3269, and the dynamic RPC range 49152–65535.

2.4 Pre-installation checklist

• ☐ Windows Server installed, fully patched and activated
• ☐ Server renamed (e.g. DC01) and restarted
• ☐ Static IP and DNS settings applied
• ☐ Time zone and clock correct
• ☐ Domain name, NetBIOS name and functional level agreed
• ☐ DSRM (Directory Services Restore Mode) password chosen and stored in a password vault
• ☐ Backup solution ready for System State

PowerShell to rename the server and set a static IP (run as Administrator):

Rename-Computer -NewName “DC01” -Restart

# After restart: find the adapter name
Get-NetAdapter

New-NetIPAddress -InterfaceAlias “Ethernet” -IPAddress 10.0.0.10 -PrefixLength 24 -DefaultGateway 10.0.0.1
Set-DnsClientServerAddress -InterfaceAlias “Ethernet” -ServerAddresses 127.0.0.1

3. Installing the AD DS role

Installing the role only copies the binaries; the server is not a domain controller until you promote it in section 4. The install takes about 5 minutes and needs no restart.

3.1 Using Server Manager (GUI)

1. Sign in as a local Administrator and open Server Manager.
2. Click Manage → Add Roles and Features.
3. On Before You Begin, click Next.
4. On Installation Type, choose Role-based or feature-based installation and click Next.
5. On Server Selection, select this server (DC01) from the pool and click Next.
6. On Server Roles, tick Active Directory Domain Services. In the pop-up, click Add Features to include the management tools, then click Next (see the mock-up below).
7. On Features, click Next — the required features are already selected.
8. On AD DS, read the notes and click Next.
9. On Confirmation, optionally tick Restart the destination server automatically if required, then click Install.
10. On Results, wait for the progress bar to finish. Click Promote this server to a domain controller to go straight to section 4, or close the wizard and use the yellow flag in Server Manager later.

Simplified mock-up of Server Manager → Add Roles and Features → Server Roles

You do not need to tick DNS Server here: the promotion wizard installs and configures DNS for you.

3.2 Using PowerShell

# Install the role and the management tools (ADUC, ADAC, GPMC, AD PowerShell module)
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

# Confirm it installed
Get-WindowsFeature -Name AD-Domain-Services, RSAT-AD-Tools | Format-Table Name, InstallState

Expected result: InstallState shows Installed for both entries.

4. Promoting the first domain controller (new forest)

Promotion creates the forest, the domain database, DNS zones and the SYSVOL share, then restarts the server as DC01. Choose Add a new forest for your first DC; the diagram shows when to choose the other two options.

Deployment Configuration: which option to choose

4.1 Wizard walkthrough

Start the wizard from the yellow flag in Server Manager → Promote this server to a domain controller.

After the restart, sign in as CORP\Administrator (the former local Administrator password still works).

4.2 PowerShell equivalent

Import-Module ADDSDeployment

$dsrm = Read-Host -AsSecureString “DSRM password”

# Dry run first: reports problems without changing anything
Test-ADDSForestInstallation -DomainName “corp.example.com” -SafeModeAdministratorPassword $dsrm

Install-ADDSForest `
  -DomainName “corp.example.com” `
  -DomainNetbiosName “CORP” `
  -ForestMode “WinThreshold” `
  -DomainMode “WinThreshold” `
  -InstallDns:$true `
  -DatabasePath “C:\Windows\NTDS” `
  -LogPath “C:\Windows\NTDS” `
  -SysvolPath “C:\Windows\SYSVOL” `
  -SafeModeAdministratorPassword $dsrm `
  -Force

WinThreshold is the Windows Server 2016 functional level, which works with 2016, 2019, 2022 and 2025 DCs. Raise it later (section 5.4) once every DC runs a newer version.

4.3 Verify the promotion

Get-ADDomain | Select-Object DNSRoot, NetBIOSName, DomainMode, PDCEmulator
Get-ADForest | Select-Object Name, ForestMode, SchemaMaster
Get-Service ADWS, KDC, Netlogon, DNS | Format-Table Name, Status
Get-SmbShare -Name SYSVOL, NETLOGON
dcdiag /q          # no output = no errors

All four services should be Running and both shares should exist.

5. Post-installation configuration

Do these six tasks on the day you build the first DC; each one is far harder to fix after users and computers have joined.

5.1 DNS: forwarders, reverse zone, scavenging

GUI: Server Manager → Tools → DNS.

1. Right-click the server → Properties → Forwarders → Edit → add your upstream resolvers (ISP or e.g. 1.1.1.1).
2. Right-click Reverse Lookup Zones → New Zone → Primary zone, Store the zone in Active Directory, To all DNS servers in this domain → IPv4 → network ID 10.0.0 → Allow only secure dynamic updates.
3. Right-click the server → Set Aging/Scavenging for All Zones → tick Scavenge stale resource records (7 days no-refresh + 7 days refresh is the default).

Set-DnsServerForwarder -IPAddress 1.1.1.1, 8.8.8.8
Add-DnsServerPrimaryZone -NetworkId “10.0.0.0/24” -ReplicationScope Domain -DynamicUpdate Secure
Set-DnsServerScavenging -ScavengingState $true -ScavengingInterval 7.00:00:00 -ApplyOnAllZones

5.2 Time synchronisation

Kerberos fails when clocks differ by more than 5 minutes. Only the DC holding the PDC Emulator role should sync with an external source; every other machine follows the domain hierarchy automatically.

# Run on the PDC Emulator only
w32tm /config /manualpeerlist:”0.pool.ntp.org,0x8 1.pool.ntp.org,0x8″ /syncfromflags:manual /reliable:yes /update
Restart-Service w32time
w32tm /query /status

If the DC is a virtual machine, turn off the hypervisor’s time synchronisation for it (keep it on for other VMs).

5.3 Enable the AD Recycle Bin

Lets you restore deleted users, groups and OUs with all their attributes. It cannot be turned off once enabled.

GUI: Active Directory Administrative Center → select the domain → Tasks pane → Enable Recycle Bin.

Enable-ADOptionalFeature -Identity “Recycle Bin Feature” -Scope ForestOrConfigurationSet -Target “corp.example.com”

5.4 Functional levels

Check with Get-ADForest | Select ForestMode and Get-ADDomain | Select DomainMode. Raise them only after every DC runs the matching Windows Server version or newer; raising cannot be undone in most cases.

GUI: Active Directory Domains and Trusts → right-click the domain → Raise Domain Functional Level.

5.5 Sites and subnets

Rename the default site and map every office subnet, so clients log on to their nearest DC.

GUI: Active Directory Sites and Services → Sites → rename Default-First-Site-Name to HQ → right-click Subnets → New Subnet → 10.0.0.0/16 → select HQ.

Get-ADReplicationSite -Identity “Default-First-Site-Name” | Rename-ADObject -NewName “HQ”
New-ADReplicationSubnet -Name “10.0.0.0/16” -Site “HQ”

New-ADReplicationSite -Name “Branch”
New-ADReplicationSubnet -Name “10.20.0.0/16” -Site “Branch”
New-ADReplicationSiteLink -Name “HQ-Branch” -SitesIncluded HQ, Branch -Cost 100 -ReplicationFrequencyInMinutes 15

5.6 Group Policy Central Store and KDS root key

• Central Store: copy the latest ADMX templates to \\corp.example.com\SYSVOL\corp.example.com\Policies\PolicyDefinitions so every admin edits GPOs with the same templates.
• KDS root key: needed for group Managed Service Accounts (gMSA). Create it once per forest:

Add-KdsRootKey -EffectiveImmediately   # usable after AD replication, up to 10 hours

6. Designing Organizational Units

Build OUs around how you administer and apply policy, not around the org chart: an OU exists to delegate rights or to link a GPO. Keep the tree shallow (three to four levels) and create everything under one top-level OU.

Recommended OU structure for corp.example.com

6.1 Design rules

• Never put objects in the built-in CN=Users and CN=Computers containers: they are not OUs, so GPOs cannot be linked to them.
• Keep users and computers in separate OUs.
• Separate privileged admin accounts (Admins OU) from normal staff accounts.
• Turn on Protect object from accidental deletion for every OU (the default when created in ADUC or ADAC).

6.2 Create the OUs

GUI: Active Directory Users and Computers (ADUC) → right-click the domain → New → Organizational Unit → type the name → OK. Repeat inside each parent.

$root = “DC=corp,DC=example,DC=com”
New-ADOrganizationalUnit -Name “_CORP” -Path $root
$corp = “OU=_CORP,$root”

“Admins”,”Staff”,”Computers”,”Servers”,”Groups”,”Services” | ForEach-Object {
    New-ADOrganizationalUnit -Name $_ -Path $corp
}
“Finance”,”HR”,”IT” | ForEach-Object { New-ADOrganizationalUnit -Name $_ -Path “OU=Staff,$corp” }
“Desktops”,”Laptops” | ForEach-Object { New-ADOrganizationalUnit -Name $_ -Path “OU=Computers,$corp” }

6.3 Redirect the default containers

New computers joined to the domain and users created by older tools land in the default containers. Redirect them to your OUs so policy applies from the first boot:

redircmp “OU=Desktops,OU=Computers,OU=_CORP,DC=corp,DC=example,DC=com”
redirusr “OU=Staff,OU=_CORP,DC=corp,DC=example,DC=com”

6.4 Delegate control

Give helpdesk staff only the rights they need, on only the OUs they manage.

1. In ADUC, right-click OU=Staff → Delegate Control.
2. Add the group GG-Helpdesk (never individual users).
3. Tick Reset user passwords and force password change at next logon and, if needed, Create, delete, and manage user accounts.
4. Click Next → Finish.

7. Managing users, groups and computers

Day-to-day administration happens in three tools: Active Directory Users and Computers (ADUC) for quick edits, Active Directory Administrative Center (ADAC) for the Recycle Bin and fine-grained password policies, and the ActiveDirectory PowerShell module for anything repeated or bulk. Install them on an admin workstation with RSAT rather than working on the DC.

7.1 User accounts

Create a user (GUI): ADUC → browse to OU=Finance,OU=Staff,OU=_CORP → right-click New → User → enter First name, Last name, User logon name (alice.smith) → Next → set an initial password, tick User must change password at next logon → Next → Finish.

# Create one user
New-ADUser -Name “Alice Smith” -GivenName Alice -Surname Smith `
  -SamAccountName alice.smith -UserPrincipalName alice.smith@corp.example.com `
  -Path “OU=Finance,OU=Staff,OU=_CORP,DC=corp,DC=example,DC=com” `
  -AccountPassword (Read-Host -AsSecureString “Initial password”) `
  -ChangePasswordAtLogon $true -Enabled $true

# Bulk create from a CSV with columns: First,Last,Sam,OU
Import-Csv .\newusers.csv | ForEach-Object {
  New-ADUser -Name “$($_.First) $($_.Last)” -GivenName $_.First -Surname $_.Last `
    -SamAccountName $_.Sam -UserPrincipalName “$($_.Sam)@corp.example.com” -Path $_.OU `
    -AccountPassword (ConvertTo-SecureString “Temp-Pass-2026!” -AsPlainText -Force) `
    -ChangePasswordAtLogon $true -Enabled $true
}

Common user tasks:

Leaver process: disable the account, remove group memberships, move it to a Disabled OU, and delete it after your retention period (for example 30–90 days).

7.2 Groups

Group type is either Security (can be granted permissions) or Distribution (email lists only). Follow the AGDLP pattern:

AGDLP: Accounts → Global groups → Domain Local groups → Permissions

New-ADGroup -Name “GG-Finance-Staff” -GroupScope Global -GroupCategory Security `
  -Path “OU=Groups,OU=_CORP,DC=corp,DC=example,DC=com”
New-ADGroup -Name “DL-FinShare-Modify” -GroupScope DomainLocal -GroupCategory Security `
  -Path “OU=Groups,OU=_CORP,DC=corp,DC=example,DC=com”

Add-ADGroupMember -Identity “GG-Finance-Staff” -Members alice.smith, bob.jones
Add-ADGroupMember -Identity “DL-FinShare-Modify” -Members “GG-Finance-Staff”
Get-ADGroupMember “DL-FinShare-Modify” -Recursive | Select Name

Then grant DL-FinShare-Modify the Modify permission on the folder’s Security tab.

7.3 Computer accounts

Join a PC to the domain (GUI): on the client, Settings → System → About → Domain or workgroup (or sysdm.cpl → Change) → select Domain → corp.example.com → enter domain credentials → restart. The client’s DNS must point to the DCs.

# On the client
Add-Computer -DomainName corp.example.com -OUPath “OU=Desktops,OU=Computers,OU=_CORP,DC=corp,DC=example,DC=com” -Credential CORP\admin.alice -Restart

# On an admin workstation: pre-stage, find stale, repair trust
New-ADComputer -Name “PC-FIN-042” -Path “OU=Desktops,OU=Computers,OU=_CORP,DC=corp,DC=example,DC=com”
Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -ComputersOnly
Test-ComputerSecureChannel -Repair -Credential CORP\admin.alice   # run on the broken client

8. Group Policy

Group Policy Objects (GPOs) push settings to computers and users; link each GPO to the OU that holds the objects it should affect. Manage them in Group Policy Management Console (GPMC): Server Manager → Tools → Group Policy Management.

8.1 How GPOs are applied

Computer settings apply at startup, user settings at sign-in, and both refresh every 90 minutes (plus a random 0–30 minutes). DCs refresh every 5 minutes. When two GPOs set the same option, the one applied last wins:

Group Policy processing order (LSDOU) and its two exceptions

8.2 Create and link a GPO

1. In GPMC, expand Forest → Domains → corp.example.com → Group Policy Objects.
2. Right-click Group Policy Objects → New, name it descriptively, e.g. C-Workstations-ScreenLock (C = computer settings, U = user settings).
3. Right-click the new GPO → Edit. Set what you need, for example Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → Security Options → Interactive logon: Machine inactivity limit = 900 seconds.
4. Close the editor (changes save automatically).
5. Right-click the target OU (OU=Computers,OU=_CORP) → Link an Existing GPO → choose the GPO.
6. Optional: under the GPO’s Scope tab, change Security Filtering from Authenticated Users to a specific group.
7. On a client, run gpupdate /force, then gpresult /r to confirm the GPO appears under Applied Group Policy Objects.

New-GPO -Name “C-Workstations-ScreenLock” | New-GPLink -Target “OU=Computers,OU=_CORP,DC=corp,DC=example,DC=com”
Set-GPRegistryValue -Name “C-Workstations-ScreenLock” `
  -Key “HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System” `
  -ValueName “InactivityTimeoutSecs” -Type DWord -Value 900

Invoke-GPUpdate -Computer PC-FIN-042 -Force      # remote refresh
Get-GPResultantSetOfPolicy -ReportType Html -Path C:\Temp\rsop.html

8.3 Common policies to set

Only the Default Domain Policy (or another GPO linked at the domain root) can set the domain password policy for normal accounts; password settings linked to OUs are ignored for domain accounts.

8.4 Back up and restore GPOs

Backup-GPO -All -Path “D:\GPOBackups”
Restore-GPO -Name “C-Workstations-ScreenLock” -Path “D:\GPOBackups”

9. Adding domain controllers and replication

Every domain needs at least two writable DCs; add a second one (DC02) as soon as the first is healthy. Each DC holds a full copy of the domain and replicates changes to the others automatically.

9.1 Promote an additional DC

Prepare DC02 as in section 2 (rename, static IP 10.0.0.11), with preferred DNS = 10.0.0.10 (DC01). Then install the role (section 3) and run the promotion wizard:

1. Deployment Configuration: choose Add a domain controller to an existing domain, domain corp.example.com, and supply credentials of a Domain Admin.
2. Domain Controller Options: tick DNS server and Global Catalog, pick the correct Site (HQ), and enter a DSRM password. For an insecure branch office, tick Read only domain controller (RODC) instead.
3. Additional Options: Replicate from: Any domain controller, or choose a specific DC. Install from media (IFM) is useful over slow links.
4. Accept the defaults for paths, review, and click Install. The server restarts.
5. After restart, set DC02’s DNS to preferred 10.0.0.10, alternate 127.0.0.1, and update DC01 to prefer 10.0.0.11.

Install-WindowsFeature AD-Domain-Services -IncludeManagementTools

Install-ADDSDomainController `
  -DomainName “corp.example.com” `
  -SiteName “HQ” `
  -InstallDns:$true `
  -NoGlobalCatalog:$false `
  -Credential (Get-Credential CORP\Administrator) `
  -SafeModeAdministratorPassword (Read-Host -AsSecureString “DSRM password”) `
  -Force

9.2 How replication works

9.3 Check and force replication

repadmin /replsummary            # one-line health per DC; look for 0 failures
repadmin /showrepl DC02          # inbound partners and last success time
repadmin /syncall /AdeP          # push all partitions to all DCs now
Get-ADReplicationFailure -Target corp.example.com -Scope Domain

# Domains upgraded from Windows Server 2003/2008 may still use FRS for SYSVOL
dfsrmig /getglobalstate          # must report ‘Eliminated’

GUI: Active Directory Sites and Services → Sites → HQ → Servers → DC02 → NTDS Settings → right-click a connection → Replicate Now.

10. FSMO roles

Five operations must be done by exactly one DC at a time; the first DC holds all five. Keep them together on a well-protected, well-backed-up DC unless you have a specific reason to split them.

10.1 See who holds the roles

netdom query fsmo

# or
Get-ADForest | Select-Object SchemaMaster, DomainNamingMaster
Get-ADDomain | Select-Object PDCEmulator, RIDMaster, InfrastructureMaster

GUI: ADUC → right-click domain → Operations Masters (RID, PDC, Infrastructure); Active Directory Domains and Trusts → right-click the root → Operations Master (Domain Naming); Active Directory Schema snap-in (register with regsvr32 schmmgmt.dll) → Operations Master (Schema).

10.2 Transfer (planned) or seize (emergency)

Transfer when both DCs are online — for example before decommissioning DC01:

Move-ADDirectoryServerOperationMasterRole -Identity DC02 `
  -OperationMasterRole SchemaMaster, DomainNamingMaster, PDCEmulator, RIDMaster, InfrastructureMaster

Seize only when the current holder is permanently gone. Add -Force to the same command. A DC whose roles were seized must never come back online: wipe it, then remove its leftover metadata in Active Directory Sites and Services (delete the server object) or with ntdsutil → metadata cleanup.

After moving the PDC Emulator role, repeat the external time configuration from section 5.2 on the new holder.

11. Backup and recovery

Back up the System State of at least two DCs every day and keep copies offline: a backup older than the tombstone lifetime (180 days by default) cannot be restored. Test a restore in an isolated lab at least once a year.

11.1 Set up System State backups

1. Install the feature: Install-WindowsFeature Windows-Server-Backup.
2. Open Windows Server Backup (wbadmin.msc) → Backup Schedule → Custom → Add Items → tick System state → choose a daily time → pick a dedicated backup disk or network share.

# One-off System State backup to drive E:
wbadmin start systemstatebackup -backupTarget:E: -quiet

# List existing backups
wbadmin get versions

11.2 Choose the right recovery method

11.3 Boot into Directory Services Restore Mode (DSRM)

bcdedit /set safeboot dsrepair
shutdown /r /t 0
:: sign in as .\Administrator with the DSRM password, run wbadmin start systemstaterecovery …
bcdedit /deletevalue safeboot

Reset the DSRM password periodically with ntdsutil → set dsrm password → reset password on server null.

12. Security hardening

Most domain compromises start with a stolen admin credential, so the biggest gains come from limiting where privileged accounts are used. Give every admin two accounts (a normal one for email and browsing, and an adm- one for admin work) and keep those admin accounts within their tier:

Administrative tier model

12.1 Hardening checklist

12.2 Event IDs worth alerting on

13. Monitoring, health checks and troubleshooting

A five-minute daily check catches most problems before users notice: run the script below on an admin workstation each morning and investigate any failure it reports. Almost every AD fault is ultimately a DNS, time or replication fault, so check those three first.

13.1 Daily health check

$dcs = (Get-ADDomainController -Filter *).HostName

foreach ($dc in $dcs) {
  Write-Host “=== $dc ===” -ForegroundColor Cyan
  dcdiag /s:$dc /q                       # silent unless a test fails
  Get-Service -ComputerName $dc ADWS, KDC, Netlogon, NTDS, DNS, DFSR |
    Where-Object Status -ne Running
}
repadmin /replsummary
w32tm /monitor /domain:corp.example.com
Get-PSDrive -PSProvider FileSystem | Select Name, Free   # run on each DC: watch free disk space

Also review weekly: the Directory Service, DNS Server and DFS Replication event logs on each DC (Event Viewer → Applications and Services Logs), and any backup failures.

13.2 Common problems and fixes

13.3 Useful diagnostic commands

14. Quick reference

The commands below cover the tasks admins run most often. All PowerShell cmdlets come from the ActiveDirectory, ADDSDeployment, GroupPolicy and DnsServer modules, installed with RSAT.

Management consoles