Active Directory Domain Services: install a domain controller

Introduction

Active Directory Domain Services (AD DS) is Microsoft's directory service. It centralizes:

• User accounts and groups
• Authentication (Kerberos, NTLM)
• Group Policies (GPOs) to configure workstations and servers
• Internal DNS
• Resource permissions (shares, printers, servers)

Essential as soon as you have 5+ Windows machines to manage.

Prerequisites

• Windows Server 2019 / 2022 / 2025 (Standard or Datacenter)
• At least 2 vCPU and 4 GB RAM (8 GB recommended)
• Static IP configured
• Hostname defined (don't change after DC promotion)
• At least 40 GB disk space

Step 1: Prepare the server

Set the hostname

Rename-Computer -NewName "DC01" -Restart

Configure static IP

# View interfaces
Get-NetAdapter

# Configure (adapt InterfaceIndex)
New-NetIPAddress -InterfaceIndex 4 -IPAddress 10.0.0.10 -PrefixLength 24 -DefaultGateway 10.0.0.1
Set-DnsClientServerAddress -InterfaceIndex 4 -ServerAddresses 127.0.0.1, 8.8.8.8

⚠️ Primary DNS will point to 127.0.0.1 once AD DS is installed (the DC is its own DNS).

Step 2: Install the AD DS role

Via PowerShell

Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

Via Server Manager (GUI)

1. Server Manager → Manage → Add Roles and Features
2. Check Active Directory Domain Services
3. Next → Next → Install

Step 3: Promote server to domain controller

Via PowerShell

Install-ADDSForest `
    -DomainName "verycloud.local" `
    -DomainNetbiosName "VERYCLOUD" `
    -ForestMode "WinThreshold" `
    -DomainMode "WinThreshold" `
    -InstallDns `
    -CreateDnsDelegation:$false `
    -DatabasePath "C:\Windows\NTDS" `
    -LogPath "C:\Windows\NTDS" `
    -SysvolPath "C:\Windows\SYSVOL" `
    -NoRebootOnCompletion:$false `
    -Force

You'll be asked for a DSRM password (Directory Services Restore Mode). Save it carefully.

Via Server Manager

1. Yellow banner at top of Server Manager → Promote this server to a domain controller
2. Add a new forest → Root domain name: verycloud.local
3. Functional level: Windows Server 2016 (or newer if all your DCs support it)
4. DSRM password: a strong password
5. Click Next through to Install

Server reboots automatically.

Step 4: First domain login

At login, use:

• Username: VERYCLOUD\Administrator
• Password: existing Administrator password

Verify:

Get-ADDomain
Get-ADForest
Get-ADDomainController

Step 5: Choosing the domain name

Best practices:

• ✅ verycloud.local (internal TLD, traditional but deprecated by Microsoft)
• ✅ ad.verycloud.fr (subdomain of your real domain, recommended)
• ❌ verycloud.fr (your public domain, breaks public services)
• ❌ domain.com (impersonates an external domain)

Modern standard is ad.your-domain.fr or corp.your-domain.fr.

Step 6: Organizational Unit (OU) structure

Before creating users, structure your domain. Typical example:

verycloud.local
├── _Disabled (disabled accounts)
├── Computers
│   ├── Servers
│   │   ├── Web
│   │   ├── DB
│   │   └── Apps
│   └── Workstations
│       ├── IT
│       └── Office
├── Users
│   ├── IT
│   ├── Sales
│   └── Office
├── Groups
│   ├── Security
│   └── Distribution
└── Service Accounts

Create via PowerShell:

New-ADOrganizationalUnit -Name "Servers" -Path "OU=Computers,DC=verycloud,DC=local"
New-ADOrganizationalUnit -Name "Web" -Path "OU=Servers,OU=Computers,DC=verycloud,DC=local"
New-ADOrganizationalUnit -Name "IT" -Path "OU=Users,DC=verycloud,DC=local"

Step 7: Create users

One user

$pwd = ConvertTo-SecureString "TempPassword2024!" -AsPlainText -Force

New-ADUser `
    -Name "Mathys Founder" `
    -GivenName "Mathys" `
    -Surname "Founder" `
    -SamAccountName "mathys" `
    -UserPrincipalName "[email protected]" `
    -Path "OU=IT,OU=Users,DC=verycloud,DC=local" `
    -AccountPassword $pwd `
    -ChangePasswordAtLogon $true `
    -Enabled $true

Bulk import from CSV

CSV users.csv:

firstname,lastname,username,department
Alice,Smith,alice.smith,Sales
Bob,Jones,bob.jones,IT

Import-Csv users.csv | ForEach-Object {
    $pwd = ConvertTo-SecureString "Welcome2024!" -AsPlainText -Force
    New-ADUser `
        -Name "$($_.firstname) $($_.lastname)" `
        -GivenName $_.firstname `
        -Surname $_.lastname `
        -SamAccountName $_.username `
        -UserPrincipalName "$($_.username)@verycloud.local" `
        -Path "OU=$($_.department),OU=Users,DC=verycloud,DC=local" `
        -AccountPassword $pwd `
        -ChangePasswordAtLogon $true `
        -Enabled $true
}

Step 8: Create groups

# Security group
New-ADGroup -Name "IT-Admins" -GroupCategory Security -GroupScope Global -Path "OU=Security,OU=Groups,DC=verycloud,DC=local"

# Add members
Add-ADGroupMember -Identity "IT-Admins" -Members "mathys", "alice.smith"

# List members
Get-ADGroupMember "IT-Admins"

Step 9: Join a machine to the domain

On client / other server

Add-Computer -DomainName "verycloud.local" -Credential (Get-Credential) -Restart

Enter VERYCLOUD\Administrator as credentials.

⚠️ Verify that:

1. Client DNS points to 10.0.0.10 (your DC)
2. Network connectivity works (ping DC01)

Step 10: Group Policies (GPOs)

GPOs push configurations to all domain-joined workstations/servers.

Open GPMC

gpmc.msc

Example: force screensaver after 10 min

1. Forest: verycloud.local → Domains → verycloud.local
2. Right-click Default Domain Policy → Edit
3. User Configuration → Policies → Administrative Templates → Control Panel → Personalization
4. Enable screen saver: Enabled
5. Screen saver timeout: 600 (seconds)
6. Password protect the screen saver: Enabled

Example: lock Control Panel

1. User Configuration → Policies → Administrative Templates → Control Panel
2. Prohibit access to Control Panel: Enabled

Force application on a client

gpupdate /force
gpresult /r

Step 11: Second domain controller (redundancy)

⚠️ Crucial in prod: if you have only one DC and it dies, no authentication works anymore.

On a second Windows server:

# Install role
Install-WindowsFeature AD-Domain-Services -IncludeManagementTools

# Promote to additional DC
Install-ADDSDomainController `
    -DomainName "verycloud.local" `
    -InstallDns `
    -Credential (Get-Credential) `
    -SafeModeAdministratorPassword (Read-Host -AsSecureString) `
    -Force

Step 12: AD Backup

# Install Windows Server Backup
Install-WindowsFeature Windows-Server-Backup

# Create backup policy
$Policy = New-WBPolicy
$Vol = Get-WBVolume -VolumePath "C:"
Add-WBVolume -Policy $Policy -Volume $Vol
Add-WBSystemState -Policy $Policy
Add-WBBareMetalRecovery -Policy $Policy
$BackupTarget = New-WBBackupTarget -VolumePath "E:"
Add-WBBackupTarget -Policy $Policy -Target $BackupTarget
Set-WBSchedule -Policy $Policy -Schedule "02:00"
Set-WBPolicy -Policy $Policy

Step 13: DNS forwarders (external resolution)

So domain clients can resolve internet names:

Add-DnsServerForwarder -IPAddress 1.1.1.1, 8.8.8.8
Get-DnsServerForwarder

Step 14: Secure AD

Rename built-in Administrator account

Rename-LocalUser -Name "Administrator" -NewName "vc_admin"

Disable Guest

Disable-LocalUser -Name "Guest"

Password policy

Set-ADDefaultDomainPasswordPolicy `
    -Identity verycloud.local `
    -ComplexityEnabled $true `
    -MinPasswordLength 12 `
    -MaxPasswordAge 90.00:00:00 `
    -MinPasswordAge 1.00:00:00 `
    -PasswordHistoryCount 12 `
    -LockoutThreshold 5 `
    -LockoutDuration 00:30:00

Logon auditing

GPMC.msc → Default Domain Controllers Policy → Advanced Audit Policy → Account Logon → all Success and Failure.

Troubleshooting

"Cannot find the domain controller"

Misconfigured client DNS. Check:

nslookup verycloud.local

Must return your DC IP. Otherwise, adjust client DNS to point to DC.

"The trust relationship between this workstation and the primary domain failed"

Machine account out of sync. Rejoin the domain:

Test-ComputerSecureChannel -Credential (Get-Credential) -Repair

Replication between DCs doesn't work

repadmin /showrepl
repadmin /syncall /AdeP

SYSVOL space full

Check:

dfsrdiag pollad

Useful commands

# Domain and forest
Get-ADDomain
Get-ADForest
Get-ADDomainController -Filter *

# Users
Get-ADUser -Filter * | Measure-Object        # Count
Get-ADUser -Identity mathys -Properties *    # Details
Search-ADAccount -LockedOut                  # Locked accounts
Search-ADAccount -PasswordExpired            # Expired passwords

# Groups
Get-ADGroup -Filter *
Get-ADGroupMember "Domain Admins"

# Computers
Get-ADComputer -Filter * | Format-Table Name, OperatingSystem

# Last logon
Get-ADUser -Filter * -Properties LastLogonDate | 
    Sort LastLogonDate -Descending | 
    Select Name, LastLogonDate -First 20

# Inactive accounts (90 days)
Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -UsersOnly

# Force replication
repadmin /syncall /AdeP

# AD health check
dcdiag /v

Conclusion

Your Active Directory is operational. Benefits:

• Centralized authentication for the entire fleet
• Config deployment via GPO
• Complete logon auditing
• Foundation for Microsoft services (Exchange, SharePoint, Intune)

Going further:

• Set up AD Connect to sync with Microsoft Entra ID (Azure AD)
• Configure LAPS (Local Admin Password Solution) for local admin passwords
• Implement Privileged Access Management (PAM) for admins
• Migrate to Microsoft Entra Domain Services for cloud-only

Resources

• Official documentation: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-domain-services
• Active Directory Best Practices: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory
• VeryCloud guide — PowerShell Remoting: /docs/article/winrm
• VeryCloud guide — Task Scheduler: /docs/article/task-scheduler