Windows Server 2022: install & configure Active Directory Domain Services

This guide details the process of installing and configuring Active Directory Domain Services (AD DS) on Windows Server 2022, culminating in the promotion…

This guide details the process of installing and configuring Active Directory Domain Services (AD DS) on Windows Server 2022, culminating in the promotion of the server to a domain controller. It covers both graphical user interface (GUI) and PowerShell-based installation methods, followed by the essential post-installation steps to establish a functional Active Directory environment. The focus is on practical, repeatable procedures for network engineers and system administrators.

Prerequisites and Planning

Before initiating an AD DS installation, consider these foundational elements. Proper planning minimizes post-deployment issues and ensures a robust directory service.

Server Hardware: Ensure the server meets minimum hardware requirements for Windows Server 2022. For a domain controller, consider at least 2 vCPUs, 4GB RAM, and 80GB disk space, with more for larger environments or if DNS and DHCP roles are co-located.
Network Configuration: Assign a static IP address to the server. Dynamic IP addresses are unsuitable for domain controllers. For example, 192.168.1.10/24 with a gateway of 192.168.1.1. The server's primary DNS entry should initially point to itself (127.0.0.1) once AD DS is installed and DNS is integrated, or to an existing DC if joining an existing domain.
Server Naming: Assign a descriptive, easily identifiable name to the server before promoting it. Renaming a domain controller post-promotion is strongly discouraged and can lead to service disruptions. E.g., DC01-NA-CORP.
Administrator Credentials: Ensure you have local administrator privileges on the server.
Forest/Domain Naming: Choose a suitable FQDN (Fully Qualified Domain Name) for your new forest root domain, such as corp.contoso.com. Avoid using single-label domains (e.g., contoso) or non-routable TLDs (e.g., .local) in new deployments due to potential compatibility and security issues.
Forest/Domain Functional Levels: Determine the desired functional levels. For a new Windows Server 2022 forest, the recommended Forest and Domain Functional Levels will be Windows Server 2016, as Server 2022 functional levels do not yet exist at the time of writing (Windows Server 2022 domain controllers operate at the Server 2016 functional level).

Installing the AD DS Role

The AD DS role can be installed using Server Manager GUI or PowerShell. PowerShell is generally preferred for automation and repeatability.

GUI Installation via Server Manager

Open Server Manager.
Click Manage > Add Roles and Features.
Click Next on "Before You Begin".
Select Role-based or feature-based installation and click Next.
Select the target server from the server pool and click Next.
From the "Server Roles" list, check Active Directory Domain Services.
A dialog box will appear asking to "Add features that are required for Active Directory Domain Services". Click Add Features. This includes tools like AD DS Snap-ins and PowerShell modules.
Click Next.
On the "Features" page, click Next (no additional features are typically needed for AD DS itself).
On the "AD DS" page, review the information and click Next.
On the "Confirmation" page, review your selections. You can optionally check "Restart the destination server automatically if required" and then click Install.
Once the installation completes, close the wizard. A yellow triangle will appear in Server Manager indicating "Post-deployment configuration" is required.

PowerShell Installation

For a command-line approach, use the Install-WindowsFeature cmdlet. This is significantly faster and automatable.

# Install the Active Directory Domain Services role and management tools
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

# Verify the installation (optional)
Get-WindowsFeature -Name AD-Domain-Services

The -IncludeManagementTools parameter ensures that snap-ins like Active Directory Users and Computers, DNS, and Group Policy Management Console are installed, which are crucial for managing AD DS.

Promoting to a Domain Controller (Forest Creation)

After the AD DS role is installed, the server must be promoted to a domain controller. This process establishes the first domain in a new forest.

GUI Promotion via Server Manager

In Server Manager, click the yellow triangle notification icon near the top right.
Click Promote this server to a domain controller.
On the "Deployment Configuration" page:
- Select Add a new forest.
- In the "Root domain name" field, enter your chosen FQDN (e.g., corp.contoso.com).
- Click Next.
On the "Domain Controller Options" page:
- For a new forest, "Forest functional level" and "Domain functional level" will default to Windows Server 2016. These cannot be higher than the lowest version of a DC in the forest.
- Ensure Domain Name System (DNS) server and Global Catalog (GC) are checked. These are mandatory for the first domain controller.
- Enter and confirm a strong Directory Services Restore Mode (DSRM) password. This password is critical for disaster recovery operations.
- Click Next.
On the "DNS Options" page:
- You may see a warning about "A delegation for this DNS server cannot be created...". This is expected for the first DNS server in a new forest as there's no parent DNS zone to delegate from. Click Next.
On the "Additional Options" page:
- The NetBIOS domain name will be auto-populated (e.g., CORP for corp.contoso.com). You can change this if needed, but it's generally best to accept the default. Click Next.
On the "Paths" page:
- Specify the locations for the AD DS database, log files, and SYSVOL folder. Default paths (C:\Windows\NTDS and C:\Windows\SYSVOL) are usually acceptable for initial deployments, but separate drives are recommended for production environments for performance and manageability. Click Next.
On the "Review Options" page:
- Review all your selections. You can click View Script to see the PowerShell commands that will perform this promotion, which is useful for automation. Click Next.
On the "Prerequisites Check" page:
- The wizard will perform checks to ensure all requirements are met. Resolve any critical errors before proceeding. Warnings are often informational and can be bypassed. Click Install.
The server will reboot automatically after the promotion completes.

PowerShell Promotion (New Forest)

The Install-ADDSForest cmdlet is used to create a new forest and promote the server. The -InstallDNS parameter is crucial to ensure DNS services are installed and integrated with Active Directory.

# Define variables for clarity
$DomainName = "corp.contoso.com"
$DSRMPassword = ConvertTo-SecureString "Your_Strong_DSRM_Password123!" -AsPlainText -Force

# Promote the server to a new forest root domain controller
Install-ADDSForest `
    -DomainName $DomainName `
    -InstallDNS `
    -NoRebootOnCompletion:$false `
    -DomainMode "Win2016" ` # For Server 2022, functional levels default to Win2016
    -ForestMode "Win2016" `
    -CreateDNSDelegation:$false ` # For the first DC in a new forest
    -DatabasePath "C:\Windows\NTDS" ` # Customize paths as needed
    -LogPath "C:\Windows\NTDS" `
    -SysvolPath "C:\Windows\SYSVOL" `
    -Force ` # Suppress confirmation prompts
    -SafeModeAdministratorPassword $DSRMPassword

Note: The -NoRebootOnCompletion:$false parameter ensures the server reboots automatically, which is mandatory after DC promotion. The -Force parameter suppresses confirmation prompts, making it suitable for scripting. Replace "Your_Strong_DSRM_Password123!" with a truly strong password.

Post-Installation Verification and Configuration

After the server reboots and you log in, perform these steps to ensure AD DS is functioning correctly and to complete initial configurations.

Verify AD DS Health

Check Server Manager: Verify that the AD DS and DNS roles are listed and healthy.
Event Viewer: Check the "Directory Service" and "DNS Server" logs for any critical errors or warnings. Key event IDs to look for include:
- 1000 (NTDS General): AD DS started.
- 1119 (NTDS General): Global Catalog enabled.
- 4013 (DNS Server): DNS server started.
- 4015 (DNS Server): DNS server has loaded zone.
Network Configuration: Confirm that the server's primary DNS server IP address is set to its own static IP (or 127.0.0.1).
Service Status: Verify that essential services are running:
```
Get-Service -Name "NTDS", "DNS", "Netlogon", "KDC"
```
All services should show a Running status.
dcdiag: Run a diagnostic check to confirm all aspects of the DC are healthy.
```
dcdiag /v /c /d /e /s:<DC_Name>
```
Replace <DC_Name> with your server's hostname. Look for "Passed" results for all tests.

Initial Active Directory Management

Active Directory Users and Computers (ADUC): Open dsa.msc. Verify that your new domain (e.g., corp.contoso.com) is listed. Create a test Organizational Unit (OU) and a test user account to confirm functionality.
DNS Management: Open dnsmgmt.msc. Verify that a Forward Lookup Zone for your domain (e.g., corp.contoso.com) exists and contains records for your domain controller (e.g., _ldap._tcp.dc._msdcs.corp.contoso.com SRV record).
Group Policy Management: Open gpmc.msc. Confirm the Default Domain Policy and Default Domain Controllers Policy exist and are linked.

Configure DHCP (Optional, but Recommended)

If this domain controller will also provide DHCP services, install and configure the DHCP role. This is common in smaller environments.

# Install DHCP server role and management tools
Install-WindowsFeature -Name DHCP -IncludeManagementTools

# Authorize the DHCP server in Active Directory (replace with your DC name if not current server)
Add-DhcpServerInDC -DnsName "DC01-NA-CORP.corp.contoso.com" -IPAddress 192.168.1.10

# Create a new DHCP scope (example)
Add-DhcpServerv4Scope -Name "CorpLAN" `
    -StartRange 192.168.1.100 `
    -EndRange 192.168.1.200 `
    -SubnetMask 255.255.255.0 `
    -State Active `
    -LeaseDuration 8.00:00:00

# Set DHCP scope options (DNS Servers, Router/Gateway)
Set-DhcpServerv4OptionValue -ScopeId 192.168.1.0 `
    -OptionId 6 -Value "192.168.1.10" # Point clients to the new DC for DNS

Set-DhcpServerv4OptionValue -ScopeId 192.168.1.0 `
    -OptionId 3 -Value "192.168.1.1" # Default gateway

# Verify DHCP authorization and scope
Get-DhcpServerv4Binding -ComputerName "DC01-NA-CORP"
Get-DhcpServerv4Scope -ComputerName "DC01-NA-CORP"

Ensure client machines are configured to obtain IP addresses automatically and test connectivity and name resolution.

Common Pitfalls and Troubleshooting

DNS Configuration Issues: The most common cause of AD DS problems. Ensure the DC's primary DNS points to itself (127.0.0.1 or its static IP) after promotion. External DNS servers should only be configured as forwarders within the DNS role, not directly on the DC's network adapter.
DSRM Password Forgotten: Without the DSRM password, recovering Active Directory in a catastrophic failure is significantly harder. Store it securely.
Insufficient Permissions: Ensure the account performing the promotion has local administrator rights.
Firewall Blocking: Windows Firewall, by default, allows necessary AD DS and DNS traffic. If a third-party firewall is installed, ensure ports 53 (TCP/UDP), 88 (TCP/UDP), 135 (TCP), 137-139 (TCP/UDP), 389 (TCP/UDP), 445 (TCP), 464 (TCP/UDP), 3268-3269 (TCP), and 49152-65535 (TCP, for dynamic RPC ports) are open.
Duplicate NetBIOS Names: If promoting a server with an existing NetBIOS name that conflicts with the proposed AD domain's NetBIOS name, the promotion will fail. Rename the server or choose a different domain name.
Time Synchronization: Domain controllers rely heavily on accurate time synchronization. Ensure the DC can synchronize its time with a reliable external source (e.g., time.windows.com) or an authoritative internal source. Use w32tm /query /source to check the time source.