← All tutorials

Active Directory

Set up your company's first Active Directory domain

Turn a Windows Server into a domain controller, so your company has one central place for logins.

Intermediate15 min read6 steps

  1. PrepareName and fixed IP
  2. InstallAD DS role
  3. PromoteCreate the domain
  4. VerifyCheck it is healthy

What you need

  • Windows Server, licensed for your business, with client access licences as required
  • A PowerShell window opened as Administrator
  • A company domain name you control (corp.example.com is used here as a placeholder)

  1. Choose your domain name carefully

    Use a subdomain of a domain you own, such as corp.yourcompany.com. Avoid made-up endings like .local, and avoid using your public website address directly. Renaming a domain later is difficult, so decide before you start.

  2. Give the server a name and a fixed IP address

    A domain controller must keep the same address, because every computer will rely on it for DNS. Change the addresses below to suit your network. Check your adapter name first with Get-NetAdapter.

    New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 192.168.10.10 -PrefixLength 24 -DefaultGateway 192.168.10.1
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses 127.0.0.1
Rename-Computer -NewName "DC01" -Restart

  3. Install the Active Directory role

    This adds the software and the management tools. It does not create the domain yet.

    Install-WindowsFeature AD-Domain-Services -IncludeManagementTools

  4. Create the domain

    This promotes the server to a domain controller and installs DNS. You will be asked for a Directory Services Restore Mode password, and the server restarts when it finishes.

    Install-ADDSForest `
  -DomainName "corp.example.com" `
  -DomainNetbiosName "CORP" `
  -InstallDns `
  -SafeModeAdministratorPassword (Read-Host -AsSecureString "DSRM password")

    Keep the restore password in a secure place. You need it to recover the directory after a serious failure.

  5. Confirm the domain is healthy

    Sign in again using the domain administrator account, then run these checks. Read any failures in the dcdiag output before you add users.

    Get-ADDomain
Get-ADDomainController
dcdiag /q

  6. Back up the domain controller

    Everyone's login now depends on this server. Back up its system state regularly, and keep the backup on a separate disk. As the company grows, add a second domain controller so one failure does not stop everyone from signing in.

    Install-WindowsFeature Windows-Server-Backup
wbadmin start systemstatebackup -backupTarget:E:

Want this set up for your business?

We can plan, build and hand it over to your team.

Discuss your setup ↗
Next tutorialAdd users, join computers and apply security rules →