Install AD DS and Create a New Domain
Installing Active Directory Domain Services on Windows Server 2025 is straightforward. Planning the first domain controller requires more attention.
The server name, IP configuration, DNS settings, and Active Directory domain name all become part of the infrastructure that users and computers depend on.
A mistake made during the initial deployment can be much harder to correct after workstations, user accounts, Group Policy, and business applications have joined the domain.
This guide explains how to install Active Directory Domain Services on Windows Server 2025, create a new forest, promote the server to a domain controller, configure DNS, and verify the deployment.
The steps focus on a new Active Directory environment with the first domain controller.
If you are adding Windows Server 2025 to an existing Active Directory domain, do not create a new forest. Instead, join the server to the existing domain and promote it as an additional domain controller.
Before starting, complete the basic operating system deployment using our Windows Server 2025 Installation Guide.
What Are We Building?
For this guide, we will use the following example configuration:
Server name: DC01
Operating system: Windows Server 2025
Server role: Domain Controller and DNS Server
Active Directory domain: ad.example.com
Server IP address: 192.168.10.10
These values are examples.
Use the domain name, server name, and IP configuration appropriate for your network.
After the deployment, the server will provide:
- Active Directory Domain Services
- Domain authentication
- Active Directory-integrated DNS
- User and computer management
- Group Policy infrastructure
- SYSVOL and NETLOGON
The first domain controller becomes critical infrastructure.
Avoid using it as a general-purpose application or file server simply because CPU, memory, or storage capacity is available.
Active Directory, AD DS, and Domain Controllers
Before installing the role, it helps to understand the terminology.
Active Directory Domain Services
Active Directory Domain Services, or AD DS, is the Windows Server directory service.
It stores information about objects such as:
- Users
- Computers
- Groups
- Organizational Units
AD DS also provides authentication and directory services for domain members.
Active Directory Domain
A domain is a logical Active Directory structure containing users, computers, and other directory objects.
For example:
ad.example.com
A domain user may sign in as:
j.smith@ad.example.com
or use the traditional domain format:
AD\j.smith
Domain Controller
A domain controller is a Windows Server running AD DS and hosting Active Directory directory data.
Domain controllers process authentication requests and provide directory services to domain members.
Active Directory Forest
The forest is the top-level Active Directory structure.
A forest can contain one or more domains.
For many small and medium-sized organizations, a single forest with one domain is enough.
Do not create separate domains for Finance, Sales, HR, and other departments unless there is a real technical or administrative requirement.
Organizational Units can usually provide the required structure inside one domain.
Plan the Active Directory Domain Name
Choose the Active Directory domain name before promoting the first domain controller.
Do not create a temporary production domain with the assumption that it can easily be renamed later.
Once users, computers, applications, and Group Policy begin depending on the domain, changing the namespace becomes significantly more complicated.
A common approach is to use a subdomain of a DNS domain the organization controls.
For example, if the business owns:
example.com
Active Directory may use:
ad.example.com
or:
corp.example.com
The public website can continue using:
www.example.com
while the internal Active Directory namespace uses a dedicated subdomain.
Using the same DNS name for the public website and Active Directory is possible, but it creates additional DNS management considerations.
For a new environment, plan the namespace around:
- Existing DNS domains
- Internal applications
- Identity requirements
- Certificates
- Future infrastructure
Document the domain name before deployment.
Prepare Windows Server 2025
Before installing AD DS, verify that Windows Server is healthy.
Check that:
- Windows Server 2025 is installed.
- The correct edition is running.
- Applicable updates are installed.
- Required restarts are complete.
- Network connectivity works.
- Server storage is healthy.
- The server meets the hardware requirements.
For hardware and compatibility planning, review the Windows Server 2025 System Requirements Guide.
Do not promote a server to a domain controller while troubleshooting disk errors, failed Windows updates, or unstable network connectivity.
Resolve operating system problems first.
Configure a Static IP Address
A domain controller should use a stable network configuration.
For our example:
IP address: 192.168.10.10
Subnet prefix: 24
Default gateway: 192.168.10.1
Use values appropriate for your network.
The server IP address should:
- Belong to the correct subnet.
- Not conflict with another device.
- Follow the network addressing plan.
DNS configuration also requires attention.
Active Directory uses DNS so clients can locate domain controllers and directory services.
After the first domain controller and DNS server are configured, domain clients should use the internal Active Directory-aware DNS infrastructure.
Do not configure domain computers to use only public DNS resolvers for Active Directory name resolution.
A computer may access websites successfully while still being unable to locate the domain.
Rename the Windows Server
Rename the server before installing Active Directory.
A clear domain controller name makes administration and troubleshooting easier.
For example:
DC01
A future second domain controller may be named:
DC02
Avoid leaving the automatically generated Windows Server name.
To rename the server:
- Open Server Manager.
- Select Local Server.
- Select the current computer name.
- Open the computer name settings.
- Select Change.
- Enter the new server name.
- Confirm the change.
- Restart Windows Server.
After restart, sign in and confirm the new server name.
The domain controller name will later appear in Active Directory, DNS, event logs, and administrative tools.
Choose it before promotion.
Verify Network and Time Settings
Before installing AD DS, review the server configuration.
Open an elevated Command Prompt and run:
ipconfig /all
Verify:
- IP address
- Subnet
- Default gateway
- DNS configuration
Also check:
- Date
- Time
- Time zone
Active Directory authentication depends on accurate time.
Large time differences between domain systems can cause Kerberos authentication problems.
The first domain controller also becomes important to the domain time hierarchy.
Do not continue until the basic network and time configuration is correct.
Install Active Directory Domain Services
Open Server Manager.
Select:
Manage
Then:
Add Roles and Features
The Add Roles and Features Wizard opens.
Select the Installation Type
Choose:
Role-based or feature-based installation
Select Next.
Select the Server
Choose:
Select a server from the server pool
Select the Windows Server 2025 system you prepared.
For our example:
DC01
Select Next.
Select Active Directory Domain Services
On the Server Roles page, select:
Active Directory Domain Services
Windows Server asks whether the required features should be added.
Select:
Add Features
Continue through the wizard.
Review the AD DS information and select:
Install
Wait for the role installation to complete.
At this stage, AD DS components are installed.
The server is not yet a domain controller.
The next step is domain controller promotion.
Promote Windows Server 2025 to a Domain Controller
After the AD DS role installation, Server Manager displays a post-deployment notification.
Select the notification flag.
Choose:
Promote this server to a domain controller
The AD DS Configuration Wizard opens.
Three deployment options are available:
- Add a domain controller to an existing domain
- Add a new domain to an existing forest
- Add a new forest
Because this guide creates a completely new Active Directory environment, select:
Add a new forest
If your organization already has an Active Directory domain, do not select this option.
Use the existing domain deployment path instead.
Create a New Active Directory Forest
Enter the root domain name.
For our example:
ad.example.com
Review the name carefully.
Check for:
- Spelling mistakes
- Incorrect subdomain
- Wrong company domain
The Active Directory namespace becomes part of the long-term infrastructure.
Do not use a temporary domain name for a production deployment.
Select Next.
Configure Domain Controller Options
The Domain Controller Options page contains several important settings.
Forest and Domain Functional Levels
Windows Server 2025 introduces a Windows Server 2025 forest and domain functional level.
Functional levels affect Active Directory capabilities and supported domain controller versions.
For a completely new environment using only Windows Server 2025 domain controllers, the Windows Server 2025 functional level may be appropriate.
If older Windows Server domain controllers must remain in the environment, review compatibility before selecting the functional level.
Do not choose a functional level without considering the domain controller lifecycle.
DNS Server
For the first domain controller in a new forest, the DNS Server option is normally selected.
Active Directory relies on DNS.
Keep DNS selected unless the environment has a specifically designed DNS architecture that supports AD DS requirements.
Global Catalog
The first domain controller in a new forest is configured as a Global Catalog server.
This is part of the normal first domain controller deployment.
Read-Only Domain Controller
The first domain controller cannot be deployed as a Read-Only Domain Controller.
A writable domain controller is required to create the forest.
Configure the DSRM Password
The wizard asks for a Directory Services Restore Mode password.
This is the DSRM password.
DSRM is used in specific Active Directory recovery and maintenance scenarios.
Create a strong password and store it in the organization’s approved credential management system.
Do not use:
- A normal user password
- A shared help desk password
- The same password used across multiple servers
The DSRM credential may not be used during normal administration.
That makes it easy to forget.
Document where the recovery team can securely retrieve it.
For broader recovery planning, see the Windows Server 2025 Backup and Recovery Guide.
Review the DNS Delegation Warning
The wizard may display a warning that a DNS delegation cannot be created.
This does not automatically mean the Active Directory installation has failed.
DNS delegation depends on the parent DNS namespace and existing DNS infrastructure.
For example, when creating:
ad.example.com
a parent DNS zone for:
example.com
may contain a delegation to the DNS servers responsible for the ad.example.com namespace.
Whether this is required depends on the DNS design.
In a new internal environment, the warning may be expected.
Review the surrounding DNS architecture rather than changing settings only to remove the warning.
Review the NetBIOS Domain Name
The wizard proposes a NetBIOS domain name.
For:
ad.example.com
the proposed NetBIOS name may be:
AD
This name can appear in the traditional sign-in format:
AD\Administrator
Review the proposed name and confirm that it does not conflict with an existing environment.
The full DNS domain name and NetBIOS domain name are different.
For example:
DNS domain: ad.example.com
NetBIOS domain: AD
Both may appear during Active Directory administration.
Review AD DS Database and SYSVOL Paths
The wizard displays paths for:
- AD DS database
- Log files
- SYSVOL
For many smaller deployments, the default locations are suitable.
Larger environments may follow specific storage and infrastructure standards.
Do not move the database or SYSVOL to another volume simply because an old deployment guide recommends separate disks.
Modern physical and virtual storage architectures vary.
Use a storage design based on:
- Infrastructure standards
- Performance requirements
- Recovery planning
Review the paths and continue.
Complete the Prerequisites Check
The AD DS Configuration Wizard performs a prerequisites check.
Review all results.
The wizard may display:
- Informational messages
- Warnings
- Blocking errors
Warnings should be reviewed.
Blocking errors must be resolved before promotion can continue.
If all required prerequisite checks pass, select:
Install
The domain controller promotion begins.
Windows Server restarts during or after the process.
Sign In to the New Active Directory Domain
After restart, the server is a domain controller in the new Active Directory domain.
The sign-in screen now reflects the domain environment.
For our example, the domain Administrator account may appear as:
AD\Administrator
Sign in using the appropriate administrative credentials.
Open Server Manager.
The AD DS and DNS roles should now be visible.
Do not immediately begin creating production users.
First verify the domain controller.
Verify Active Directory
Open:
Server Manager
Then:
Tools
You should now see Active Directory management tools such as:
- Active Directory Users and Computers
- Active Directory Domains and Trusts
- Active Directory Sites and Services
- Group Policy Management
- DNS
Open Active Directory Users and Computers.
Verify that the domain appears.
For our example:
ad.example.com
Review the directory structure.
The domain should be accessible without errors.
Verify Active Directory DNS
Open:
Server Manager
Then:
Tools
Then:
DNS
Expand the DNS server.
Review the Forward Lookup Zones.
The Active Directory DNS zone should exist.
For example:
ad.example.com
Active Directory creates DNS records that help computers locate domain controllers and directory services.
Do not test Active Directory DNS only by opening a public website.
A server may resolve internet domains while internal Active Directory DNS is misconfigured.
Test the internal domain.
You can use:
nslookup ad.example.com
Also review the DNS Server event log for recurring errors.
Run dcdiag
Windows Server includes the dcdiag diagnostic tool.
Open an elevated Command Prompt.
Run:
dcdiag
The tool performs a series of domain controller tests.
Review the results.
Pay attention to failed tests involving:
- DNS
- Directory services
- Network connectivity
- SYSVOL
Do not ignore recurring errors on a newly deployed domain controller.
It is easier to resolve infrastructure problems before users and computers depend on the domain.
Verify SYSVOL and NETLOGON
Run:
net share
Review the available shares.
A functioning domain controller should normally display:
SYSVOL
and:
NETLOGON
SYSVOL stores domain files used by Active Directory services such as Group Policy.
NETLOGON supports domain-related operations.
If these shares are missing after promotion, investigate the domain controller before moving it into production.
Review:
- Event Viewer
- AD DS status
- DNS configuration
Do not continue deployment assuming the problem will resolve itself.
Create a Basic Organizational Unit Structure
Active Directory uses Organizational Units, or OUs, to organize directory objects and support administration and Group Policy.
A simple structure may look like:
Company
- Users
- Workstations
- Servers
- Service Accounts
Do not create dozens of OUs before understanding how they will be used.
OU design should support:
- Group Policy
- Delegated administration
- Logical system organization
It does not need to reproduce the complete company organizational chart.
To create an OU:
- Open Active Directory Users and Computers.
- Right-click the domain.
- Select New.
- Select Organizational Unit.
- Enter the OU name.
Start with a simple structure.
Expand it when administrative requirements justify additional OUs.
Create a Test Domain User
Create a test user before joining production computers.
Open Active Directory Users and Computers.
Select the appropriate Users OU.
Right-click and select:
New
Then:
User
For example:
First name: John
Last name: Smith
User logon name: j.smith
The user may sign in as:
j.smith@ad.example.com
Set an appropriate initial password.
Do not add the test account to Domain Admins.
A standard domain user is enough to test authentication and domain membership.
Configure DNS on Domain Clients
Domain clients must use DNS that can locate the Active Directory domain.
Suppose the domain controller and DNS server use:
192.168.10.10
The Windows client should use the appropriate internal DNS server.
Do not configure the client to use only a public DNS resolver.
The computer may have working internet access but fail to join:
ad.example.com
Active Directory uses DNS service records to locate domain controllers.
Public DNS servers do not contain these private Active Directory records.
Configure domain computers to use the internal DNS infrastructure.
Internet DNS requests can then be resolved through the configured internal DNS resolution path.
Join a Windows Computer to the Domain
After configuring the client DNS, verify network connectivity.
Open the Windows domain membership settings.
Choose to join a domain.
Enter:
ad.example.com
Provide credentials authorized to join computers to the domain.
After the domain join completes, restart the workstation.
At the sign-in screen, use the test domain user.
For example:
j.smith@ad.example.com
After sign-in, verify that the user can authenticate successfully.
On the domain controller, open Active Directory Users and Computers.
Locate the new computer object.
The computer can then be moved into the appropriate Workstations OU according to the Active Directory structure.
Plan a Second Domain Controller
A production Active Directory environment should not depend indefinitely on one domain controller.
The first server may provide:
- Active Directory
- Authentication
- DNS
If that server becomes unavailable, the environment may lose critical identity services.
A second domain controller can provide directory and DNS service redundancy.
For example:
DC01
and:
DC02
The second server should be joined to the existing domain.
Install the AD DS role.
Then select:
Add a domain controller to an existing domain
during promotion.
Do not select:
Add a new forest
A new forest creates a separate Active Directory environment.
After adding a second domain controller, verify replication and DNS health.
Multiple domain controllers provide redundancy.
They do not replace backups.
Back Up Active Directory
Active Directory requires a recovery plan.
A second domain controller is not a backup.
Active Directory replication can distribute both wanted and unwanted directory changes.
For example, if an important object is deleted, the deletion may replicate to other domain controllers.
System state backup on a domain controller includes Active Directory-related components.
Broader server recovery may also require full server or bare-metal recovery planning.
Document:
- Which domain controllers are protected
- Backup frequency
- Backup destination
- Retention
- Recovery procedures
- DSRM credential storage
For detailed planning, read the Windows Server 2025 Backup and Recovery Guide.
Test recovery procedures before an Active Directory failure occurs.
Secure the Domain Controller
A domain controller should remain focused on identity and required infrastructure services.
Avoid using it for:
- Everyday web browsing
- Office applications
- General file storage
- Unrelated business applications
Review privileged Active Directory groups.
Pay particular attention to:
- Domain Admins
- Enterprise Admins
- Schema Admins
Do not use highly privileged accounts for everyday workstation activity.
Before moving the domain controller into production, review the Windows Server 2025 Security Hardening Guide.
Security should be part of the deployment process rather than a project scheduled after the domain is already in production.
Common Active Directory Setup Mistakes
Using an Unplanned Domain Name
Choose the Active Directory namespace before creating the forest.
Do not use a temporary production domain.
Leaving the Default Random Server Name
Rename the Windows Server before domain controller promotion.
Using an Unstable IP Configuration
Domain controllers and DNS servers require predictable network configuration.
Creating a New Forest for a Second Domain Controller
A second domain controller should normally be added to the existing domain.
A new forest creates a separate Active Directory environment.
Configuring Clients with Public DNS Only
Domain clients need DNS that can locate Active Directory domain controllers.
Use the internal DNS infrastructure.
Ignoring DNS Errors
Active Directory depends on DNS.
Investigate recurring DNS problems.
Using the Domain Controller as an Application Server
Keep unrelated business applications on appropriate member servers.
Giving Every Administrator Domain Admin Rights
Use the minimum permissions required for the administrative task.
Assuming a Second Domain Controller Is a Backup
Replication provides service redundancy.
Maintain a separate Active Directory recovery strategy.
Windows Server 2025 Active Directory Setup Checklist
Before installing AD DS:
- Windows Server 2025 installed
- Applicable updates installed
- Server health verified
- Active Directory domain name planned
- Server renamed
- Stable IP configuration assigned
- Network connectivity tested
- Date and time verified
- Hardware requirements reviewed
During deployment:
- AD DS role installed
- Correct deployment operation selected
- Root domain name verified
- Functional levels reviewed
- DNS Server option reviewed
- DSRM password created
- DSRM password stored securely
- NetBIOS domain name reviewed
- AD DS paths reviewed
- Prerequisites check completed
After promotion:
- Domain Administrator sign-in verified
- Active Directory Users and Computers opened
- DNS zone verified
dcdiagreviewed- SYSVOL verified
- NETLOGON verified
- Event logs reviewed
- Basic OU structure created
- Test domain user created
- Client DNS configured
- Test computer joined to the domain
- Second domain controller planned
- Active Directory backup reviewed
- Domain controller security reviewed
Frequently Asked Questions
How do I install Active Directory on Windows Server 2025?
Install the Active Directory Domain Services role through Server Manager, then use the AD DS Configuration Wizard to promote the server to a domain controller.
What is the difference between AD DS installation and domain controller promotion?
Installing AD DS adds the required Windows Server role components. Promotion configures the server as a domain controller in a new or existing Active Directory environment.
Does a domain controller need a static IP address?
A domain controller should use a stable, planned network configuration so domain clients and infrastructure services can reliably locate it.
Does Active Directory require DNS?
Yes. Active Directory Domain Services uses DNS so clients can locate domain controllers and directory services.
Should DNS be installed on the first domain controller?
For a new Active Directory forest, the first domain controller is commonly configured with the DNS Server role.
What domain name should I use for Active Directory?
Choose a namespace based on the organization’s DNS and identity design. Using a subdomain of a DNS domain the organization controls is a common approach.
What is the DSRM password?
The Directory Services Restore Mode password is used in specific Active Directory recovery and maintenance scenarios.
What is the Windows Server 2025 functional level?
Windows Server 2025 introduces a Windows Server 2025 forest and domain functional level. Review domain controller compatibility before selecting the functional level.
Why can my computer access the internet but not join the domain?
DNS is a common cause. The computer may resolve public websites but fail to locate Active Directory domain controllers because it is not using the correct internal DNS server.
Do I need two domain controllers?
Production environments should consider multiple domain controllers to reduce dependence on one directory server. The exact design depends on infrastructure and recovery requirements.
Is a second domain controller a backup?
No. A second domain controller provides replication and service redundancy. Active Directory still requires backup and recovery planning.
How can I check domain controller health?
Review DNS, Event Viewer, SYSVOL and NETLOGON, and run diagnostic tools such as dcdiag.
Final Thoughts
Installing Active Directory on Windows Server 2025 begins with planning.
Choose the Active Directory domain name.
Rename the server.
Configure a stable IP address.
Verify DNS and network settings.
Then install the Active Directory Domain Services role and promote the server using the correct deployment option.
For a new environment, create a new forest.
For an existing Active Directory domain, add the server as an additional domain controller rather than creating another forest.
After promotion, verify the deployment.
Check Active Directory Users and Computers.
Review DNS.
Run dcdiag.
Confirm SYSVOL and NETLOGON.
Create a simple OU structure and test a standard domain user.
Configure a Windows client to use the correct internal DNS server and verify that it can join the domain.
Then plan a second domain controller and a documented Active Directory recovery process.
The first domain controller becomes a central part of the organization’s identity infrastructure.
Treat it as critical infrastructure from the beginning.
For a new server deployment, follow the Windows Server 2025 Installation Guide.
For hardware planning, review the Windows Server 2025 System Requirements Guide.
Before moving the domain controller into production, use the Windows Server 2025 Security Hardening Guide.
For Active Directory recovery planning, continue with the Windows Server 2025 Backup and Recovery Guide.
You can also return to the Complete Windows Server Licensing Guide for broader Windows Server deployment and licensing planning.