Create Domain in Windows Server: Step-by-Step

This guide walks you through creating an Active Directory domain on Windows Server, turning a standalone server into a domain controller that centralizes user accounts, group policies, and authentication for your network. You’ll need a Windows Server machine (2016, 2019, or 2022) with a static IP address, administrative access, and a clear idea of your domain name (e.g., corp.example.com).

What You’ll Need

• A Windows Server installation (Desktop Experience or Server Core) with the latest updates applied.
• A static IP address configured on the server’s network adapter — a DHCP-assigned address will break DNS later.
• Administrator credentials (local or domain) to install roles and promote the server.
• A chosen DNS domain name that you own or control (e.g., ad.example.com). Avoid using a single-label name like corp as it can cause issues.
• Optional: a second DNS server or forwarder for internet resolution — the domain controller will provide DNS for the domain, but you’ll need to configure forwarding to an external DNS like 8.8.8.8 or your ISP’s.

Step-by-Step

1. Set a static IP address: Open Control Panel > Network and Sharing Center > Change adapter settings. Right-click your Ethernet adapter, select Properties, then Internet Protocol Version 4 (TCP/IPv4). Enter a static IP, subnet mask, default gateway, and set the preferred DNS server to the server’s own IP address (e.g., 192.168.1.10). This ensures the server can resolve its own name.
2. Rename the server (optional but recommended): In Server Manager, click Local Server, then click the computer name. Click Change and enter a descriptive name like DC01. Restart if prompted.
3. Install Active Directory Domain Services: Open Server Manager, click Add roles and features. Click Next through the wizard until Server Roles. Check Active Directory Domain Services. When prompted, click Add Features to include required management tools. Click Next, then Install. Wait for installation to complete.
4. Promote the server to a domain controller: In Server Manager, you’ll see a yellow flag icon with a warning. Click it and select Promote this server to a domain controller.
5. Choose deployment configuration: In the wizard, select Add a new forest (since this is a new domain). Enter the root domain name (e.g., corp.example.com). Click Next.
6. Set forest and domain functional levels: Choose the functional level that matches your environment (e.g., Windows Server 2016). Leave the Domain Controller capabilities as default (DNS server checked). Enter a Directory Services Restore Mode (DSRM) password — this is critical for recovering the server later. Click Next.
7. DNS options: If you see a warning that a delegation for the DNS server cannot be created, that’s normal for a new forest — click Next.
8. NetBIOS name: The wizard will suggest a NetBIOS name (e.g., CORP). Accept it or change it, then click Next.
9. Paths: Accept the default locations for the database, log files, and SYSVOL (or change them to a dedicated drive for performance). Click Next.
10. Review and install: Review your selections, then click Install. The server will restart automatically after promotion. This can take 10–15 minutes.
11. Verify the installation: After reboot, log in with the domain administrator account (e.g., CORP\Administrator). Open Server Manager, click Tools, and select Active Directory Users and Computers. You should see your domain structure, including the Domain Controllers OU and your server listed as a domain controller.
12. Configure DNS forwarding (recommended): Open Server Manager > Tools > DNS. Right-click your server name, select Properties, go to the Forwarders tab, and add a public DNS like 8.8.8.8 or your ISP’s DNS. This allows clients to resolve external names.

Common Mistakes

• Using a dynamic IP: If the server’s IP changes, clients won’t find the domain controller. Always set a static IP before promoting.
• Single-label domain name: Using a name like corp instead of corp.example.com can cause DNS and Kerberos issues. Always use a subdomain of a domain you control.
• Forgetting the DSRM password: If you lose this, you can’t restore the domain controller from backup. Store it securely.
• Skipping DNS configuration: Clients must point to this server for DNS. If they use a router or ISP DNS, they won’t resolve domain resources.
• Installing AD DS on a server with a conflicting DNS server: If the server’s DNS points to another DNS server, it may not register the SRV records correctly. Always point the server’s DNS to itself during promotion.

Tips

• Plan your domain name carefully: Changing a domain name later is painful. Use a subdomain of your public domain (e.g., ad.example.com) to avoid conflicts with your public website.
• Use a dedicated drive for AD data: For performance, place the database, logs, and SYSVOL on a separate disk from the OS if possible.
• Enable time synchronization: Set the domain controller to sync time with an external NTP source (e.g., time.windows.com) to prevent Kerberos authentication failures.
• Take a snapshot before promotion: If you’re using a virtual machine, snapshot the server before promoting. If something goes wrong, you can revert.
• Add a second domain controller: For redundancy, promote another server to a replica domain controller soon after, especially if this is your only DC.

Troubleshooting

• Promotion fails with DNS errors: Check that the server’s DNS points to itself (run ipconfig /all). Also ensure the server can ping its own IP and hostname. If the error mentions delegation, that’s normal for a new forest — proceed.
• Clients can’t join the domain: Verify clients can ping the domain controller by name and IP. Check that the client’s DNS is set to the domain controller’s IP. Flush DNS with ipconfig /flushdns on the client.
• Server doesn’t restart after promotion: Wait at least 15 minutes. If it hangs, check the event viewer for critical errors. You may need to manually restart, but ensure the promotion completed.
• Can’t log in after promotion: Use the domain format DOMAIN\Administrator (e.g., CORP\Administrator). If you can’t remember the password, you may need to boot into DSRM and reset it.
• DNS SRV records missing: Open DNS Manager, expand _msdcs, _sites, etc. If records are missing, run ipconfig /registerdns on the DC and restart the Net Logon service (net stop netlogon && net start netlogon).

Frequently Asked Questions

Do I need a separate DNS server?

No. The AD DS installation automatically installs DNS on the domain controller. You just need to configure forwarding for external resolution.

Can I change the domain name later?

Technically, you can rename a domain, but it’s complex and risky. It’s much easier to choose a correct name upfront.

What is the DSRM password used for?

It’s the administrator password for the Directory Services Restore Mode, which is used to repair or restore Active Directory in emergencies. Store it safely.

How many domain controllers do I need?

At least one for a small network, but two or more are recommended for redundancy. If one fails, the other continues to authenticate users.

Can I promote a server with a dynamic IP?

No. A domain controller must have a static IP address. If it changes, clients won’t find the domain.

Will this work on Windows Server Core?

Yes, you can install AD DS on Server Core using PowerShell, but you’ll need to use command-line tools for management. The steps are similar, but you won’t have the GUI wizards.

Related

• RCS iPhone Not Working? Fixes That Actually Work
• iPhone Antennas: What They Are & Do You Need One?
• Install Windows 11 on New SSD Without USB