Stackvora.tech

Promote a Windows Server to Domain Controller

Promoting a Windows Server to a Domain Controller (DC) is a foundational step in establishing an Active Directory (AD) environment. This process involves…

Promoting a Windows Server to a Domain Controller (DC) is a foundational step in establishing an Active Directory (AD) environment. This process involves installing the Active Directory Domain Services (AD DS) role and then configuring the server to host a new domain, add it to an existing domain, or add a replica DC. This guide focuses on creating a new Active Directory forest with a single domain controller, a common starting point for new deployments.

The procedures outlined are applicable to Windows Server 2016, 2019, and 2022. While the core steps remain consistent, minor UI differences might exist between versions.

Pre-requisites and Best Practices

Before initiating the promotion process, ensure the server meets the following criteria and adhere to these best practices:

  • Static IP Address: The server must have a static IP address configured. DHCP-assigned addresses are not suitable for domain controllers. For example, 192.168.1.10/24 with a gateway of 192.168.1.1.
  • Administrator Privileges: You must be logged in with an account that has local Administrator privileges on the server.
  • Server Name: Assign a meaningful and static hostname to the server before promotion (e.g., DC01). Renaming a DC after promotion is complex and generally discouraged.
  • Operating System: Use a supported Windows Server version. Server Core installations are often preferred for DCs due to reduced attack surface, but this guide assumes a Desktop Experience installation for clarity in initial setup.
  • DNS Configuration: During the promotion, the server's primary DNS entry will typically be configured to point to itself (127.0.0.1) or another DC in the domain for DNS resolution. Do not pre-configure this unless you are adding a replica to an existing domain.
  • Dedicated Role: Dedicate the server primarily to AD DS. Avoid installing other major applications or roles on a domain controller unless absolutely necessary, to minimize performance impact and security risks.

Installing the Active Directory Domain Services Role

The first step is to install the AD DS role services on the target server. This can be done via Server Manager or PowerShell.

Using Server Manager (GUI)

  1. Open Server Manager from the Start Menu.
  2. Click Manage > Add Roles and Features.
  3. Click Next on the "Before You Begin" screen.
  4. Select Role-based or feature-based installation and click Next.
  5. Select the target server from the server pool and click Next.
  6. In the "Server Roles" list, check Active Directory Domain Services. A pop-up will appear; click Add Features to include required management tools. Click Next.
  7. On the "Features" screen, click Next.
  8. Review the "Active Directory Domain Services" description and click Next.
  9. On the "Confirmation" screen, click Install.
  10. Once the installation completes, click Close. Do not reboot yet.

Using PowerShell

Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

This command installs the AD DS role along with the necessary management tools. Wait for the installation to complete before proceeding.

Promoting the Server to a Domain Controller

After the AD DS role is installed, the server needs to be configured as a domain controller. This is where you define the Active Directory forest and domain structure.

Using Server Manager (GUI)

  1. In Server Manager, click the yellow flag notification icon near the top right.
  2. Click Promote this server to a domain controller. This will launch the Active Directory Domain Services Configuration Wizard.
  3. Deployment Configuration:
    • Select Add a new forest.
    • In the Root domain name: field, enter your desired domain name (e.g., corp.local, example.com). Choose a unique and internal-only TLD like .local or a subdomain of your public domain for best practices (e.g., ad.example.com). Click Next.
  4. Domain Controller Options:
    • Forest functional level: This determines the maximum AD DS features available. For a new forest, typically use the highest available level (e.g., Windows Server 2016 for Windows Server 2016/2019/2022 deployments).
    • Domain functional level: Similar to forest functional level, set to the highest available.
    • Ensure Domain Name System (DNS) server and Global Catalog (GC) are checked. These are mandatory for the first DC in a new forest.
    • If this were a replica DC, you'd have the option for "Read-only domain controller (RODC)". For the first DC, this is unavailable.
    • Enter a strong password for Directory Services Restore Mode (DSRM) password. This password is crucial for disaster recovery scenarios when AD DS needs to be repaired offline. Confirm the password and click Next.
  5. DNS Options: The wizard will usually warn about not being able to create a delegation for the DNS server. This is expected for a new forest's first DC; click Next.
  6. Additional Options:
    • The NetBIOS domain name will typically auto-populate based on the root domain name (e.g., CORP for corp.local). Verify and click Next.
  7. Paths:
    • Accept the default paths for the AD DS database (C:\Windows\NTDS), log files (C:\Windows\NTDS), and SYSVOL folder (C:\Windows\SYSVOL). For production environments with high I/O requirements, consider separate physical disks for the database and log files. Click Next.
  8. Review Options: Review your selections. You can click View Script to see the PowerShell commands that would perform the same configuration. Click Next.
  9. Prerequisites Check: The wizard will perform a check to ensure all prerequisites are met. Address any warnings or errors if they are critical. Typically, warnings about DNS delegation are acceptable for the first DC. Click Install.
  10. The server will begin the promotion process and automatically reboot upon completion.

Using PowerShell

# Replace 'corp.local' with your desired domain name and provide a strong DSRM password
Install-ADDSForest `
    -DomainName "corp.local" `
    -InstallDns:$true `
    -DomainMode "Win2016" ` # Use the highest functional level supported by your OS
    -ForestMode "Win2016" ` # Use the highest functional level supported by your OS
    -NoRebootOnCompletion:$false `
    -SafeModeAdministratorPassword (Read-Host -AsSecureString "Enter DSRM password")

The -DomainMode and -ForestMode parameters specify the functional levels. Adjust these to the highest supported by your Windows Server version (e.g., Win2016 for Windows Server 2016, 2019, or 2022). The -NoRebootOnCompletion:$false ensures the server reboots automatically, which is required for the promotion to complete. You will be prompted to enter the DSRM password securely.

Post-Promotion Verification

After the server reboots and you log in (now as a domain administrator, e.g., corp\Administrator), perform verification steps to ensure Active Directory and DNS are functioning correctly.

Initial Checks

  • DNS Configuration: Verify the server's primary DNS entry now points to its own IP address (127.0.0.1) or the loopback address. You can check this via Network Adapter settings.
  • Services: Open services.msc and ensure services like Active Directory Domain Services, DNS Server, and Kerberos Key Distribution Center are running.
  • Administrative Tools: In Server Manager, verify that new administrative tools are available under Tools, such as "Active Directory Users and Computers," "Active Directory Sites and Services," and "DNS."

Command-Line Verification

# Verify domain controller health
dcdiag /v

# Verify replication (for multi-DC environments, though useful for first DC to ensure replication sources are clean)
repadmin /replsummary

# Verify SRV records in DNS
nltest /dsgetdc:corp.local
nslookup -type=SRV _ldap._tcp.dc._msdcs.corp.local

dcdiag /v provides a verbose output of various tests performed on the domain controller. Look for "Passed" messages for critical tests. repadmin /replsummary will show replication status; for a single DC, it primarily checks for internal consistency. nltest /dsgetdc:corp.local confirms the server can locate itself as a DC for the domain. nslookup checks for the presence of essential Service Location (SRV) records in DNS, which clients use to find domain services.

Common Pitfalls and Troubleshooting

  • Incorrect IP Configuration: Promoting a server with a DHCP-assigned IP will lead to failures during DNS configuration and AD DS installation. Always use static IPs.
  • DNS Resolution Issues: If DNS is misconfigured prior to promotion (e.g., pointing to an external DNS server instead of none or another internal DC), the wizard might fail. Let the promotion process handle the initial DNS configuration for the first DC.
  • Insufficient Permissions: Attempting the promotion with an account lacking local Administrator rights will result in permission errors.
  • Firewall Blocking Ports: Ensure essential AD DS ports are open if a firewall is active. Key ports include TCP/UDP 53 (DNS), TCP/UDP 88 (Kerberos), TCP 389 (LDAP), TCP 636 (LDAPS), TCP 3268 (Global Catalog), TCP 3269 (Global Catalog over SSL), and TCP 445 (SMB/CIFS, Netlogon). Windows Firewall typically configures these automatically for the AD DS role.
  • DSRM Password Lost: While not a promotion stopper, losing the DSRM password can severely hinder disaster recovery. Store it securely.
  • Functional Level Mismatch: Setting a forest or domain functional level lower than necessary (e.g., Windows Server 2008 R2 on a new Windows Server 2022 deployment) limits features. Always choose the highest supported by your environment.
  • Server Reboot Failure: If the server does not reboot automatically after promotion, manually reboot it. The AD DS role is not fully active until after the reboot.

Back to the knowledge base · Ask the AI assistant