Standing up the first domain controller for a new Active Directory environment is a one-time but consequential task — get the naming and IP configuration right at this stage and everything built on top of it (Group Policy, user accounts, DNS) goes smoothly.
Active Directory Domain Services (AD DS) is Microsoft’s directory service for centrally managing users, computers, and security policy across a Windows network from one place.
Before You Begin
Assign the server a static IP address before starting — a domain controller with a changing IP breaks DNS and client authentication.
Step 1 — Install the Active Directory Domain Services role
Wait for installation to finish
This installs the role binaries but does not yet promote the server — that’s the next step.
Step 2 — Promote the server to a domain controller
Set the Directory Services Restore Mode password
This is a separate, critical recovery password — store it securely, it’s needed for disaster recovery scenarios.
Step 3 — Verify DNS and replication
Confirm the DNS Server role installed
The promotion wizard installs DNS automatically for a new forest — verify it in Server Manager.
Point the server's own DNS to itself
The domain controller’s network adapter should use its own IP as the primary DNS server after promotion.
Useful Commands
Install-WindowsFeature AD-Domain-Services -IncludeManagementToolsPromoting a server to a domain controller triggers an automatic restart. Schedule this for a maintenance window, and never do this on a server already running other critical production roles without planning for the reboot.
Watch the Video
Prefer watching? This tutorial covers the same steps.
A ground-up walkthrough for promoting a fresh Windows Server install into your network's first Active Directory domain controller.
Watch on YouTube →Frequently Asked Questions
Can I add a second domain controller later for redundancy?
Yes — and it’s strongly recommended for anything beyond a lab environment. A second DC (using “Add a domain controller to an existing domain” instead of “Add a new forest”) provides redundancy if the first one fails.
Do I need a static IP before promoting the server?
Yes — set it before promotion. Changing a domain controller’s IP afterward is possible but adds unnecessary risk and DNS cleanup for a first-time setup.
Conclusion
Getting the static IP, forest name, and DNS role right during this first promotion avoids the most common early Active Directory headaches — everything else (OUs, Group Policy, user accounts) builds cleanly on top of a correctly configured first domain controller.
Related Articles
