Active Directory Domain Services (AD DS) is the heart of any Windows-based enterprise network — the service that makes centralized management of users, computers, and security policies possible. In this tutorial, we'll walk through standing up a brand-new domain from scratch.
Prerequisites
Before starting, the server needs a static IP address — a Domain Controller should never pull its own IP from DHCP, since any address change afterward would break the whole network. The hostname should also already be changed to something meaningful, since renaming a server after it's promoted to Domain Controller is a real headache.
Step 1: Install the AD DS role
From Server Manager, go to Add Roles and Features. Under Server Roles, check Active Directory Domain Services. The system will automatically suggest a few dependent features (like .NET Framework) — click Add Features to install them together. Continue through to Install.
Step 2: Promote the server to a Domain Controller
After installation finishes, click the yellow warning next to AD DS in Server Manager and choose Promote this server to a domain controller. In the wizard:
Since this is the network's first server, choose Add a new forest.
Enter a domain name — e.g., company.local (using a .local suffix for internal networks is common and recommended).
Next, choose the Forest/Domain Functional Level matching the server versions on your network.
Set a password for Directory Services Restore Mode (DSRM) — this password is only used in emergencies (recovering from AD failure), so write it down somewhere safe.
The system will automatically install DNS Server as part of this process too (since AD DS fully depends on DNS) — this warning is normal, just click Next.
Step 3: Finish and restart
At the end of the wizard, the system runs a Prerequisites Check. If there are no serious warnings, click Install. The server will automatically restart, and once it's back up, it will be a fully functioning Domain Controller.
Step 4: Verify the installation
After the restart, log in with a domain account (e.g., COMPANY\Administrator). From Server Manager, open Active Directory Users and Computers — if you see the default domain structure (Users, Computers, Domain Controllers), the installation succeeded.
For a more thorough test, run this from the command line:
dcdiag
This runs a comprehensive health check on the Domain Controller, and if everything shows "Passed," your domain is ready to use.
Next step: joining clients
After this, client computers can join the new domain via System Properties > Change — from this point on, centralized management of users and Group Policy becomes possible across the whole organization.
Properly installing AD DS is the first and most important step on the path to enterprise Windows infrastructure management — exactly what's covered in full, hands-on detail in my MCSA courses.
Blog