How to Install Active Directory Domain Services on Windows Server 2025

Before installing AD DS, configure your server's network settings properly. Open the Network and Sharing Center and set a static IP address.

Navigate to Control Panel > Network and Internet > Network and Sharing Center > Change adapter settings. Right-click your network adapter and select Properties.

Select Internet Protocol Version 4 (TCP/IPv4) and click Properties. Configure these settings:

IP address: 192.168.1.10 (example)
Subnet mask: 255.255.255.0
Default gateway: 192.168.1.1
Preferred DNS server: 127.0.0.1
Alternate DNS server: 8.8.8.8

Setting the preferred DNS to 127.0.0.1 (localhost) is crucial because your server will become the DNS server for the domain.

Open Server Manager from the taskbar or Start menu. Click Manage in the top-right corner and select Add Roles and Features.

The Add Roles and Features Wizard opens. Click Next on the Before You Begin page, then select Role-based or feature-based installation and click Next.

Select your target server from the server pool (it should be highlighted by default) and click Next.

In the Server Roles page, scroll down and check Active Directory Domain Services. A popup appears asking to add required features - click Add Features to include the management tools.

Click Next through the Features page (no additional features needed), then Next on the AD DS information page.

Review your selections on the Confirmation page and click Install. The installation takes 2-3 minutes.

In Server Manager, click the notification flag (yellow triangle with exclamation mark) and select Promote this server to a domain controller.

The Active Directory Domain Services Configuration Wizard launches. On the Deployment Configuration page, select Add a new forest since you're creating a new domain.

Enter your root domain name in the Root domain name field. Use a proper FQDN format like contoso.com or company.local. Avoid single-label names or .local if you plan internet integration.

Root domain name: contoso.com

Click Next to proceed to domain controller options.

On the Domain Controller Options page, configure the functional levels and services:

Set both Forest functional level and Domain functional level to Windows Server 2025. This enables all the latest AD features and security enhancements.

Ensure Domain Name System (DNS) server is checked. This automatically installs and configures DNS, which is required for AD DS.

Leave Global Catalog (GC) checked - the first domain controller in a forest must be a GC.

Enter a strong Directory Services Restore Mode (DSRM) password. This is used for offline AD maintenance:

DSRM Password: ComplexPassword123!
Confirm Password: ComplexPassword123!

Click Next to continue.

On the DNS Options page, you may see a warning about DNS delegation. For a new forest, this is normal and expected. The warning states that a delegation cannot be created because the authoritative parent zone cannot be found.

Leave Create DNS delegation unchecked and click Next.

On the Additional Options page, the wizard automatically generates a NetBIOS domain name based on your FQDN. For contoso.com, it suggests CONTOSO.

NetBIOS domain name: CONTOSO

You can modify this if needed, but the default is usually appropriate. The NetBIOS name must be 15 characters or less and contain only letters, numbers, and hyphens.

Click Next to proceed.

On the Paths page, specify locations for the AD database, log files, and SYSVOL folder. The default locations are:

Database folder: C:\Windows\NTDS
Log files folder: C:\Windows\NTDS
SYSVOL folder: C:\Windows\SYSVOL

For production environments, consider separating these components:

• Database: Place on a fast drive (SSD preferred)
• Logs: Place on a separate drive from the database for performance
• SYSVOL: Can remain on the system drive

For this tutorial, accept the defaults and click Next.

The Review Options page displays a summary of your configuration. Review all settings carefully:

Forest name: contoso.com
Domain name: contoso.com
NetBIOS name: CONTOSO
Functional levels: Windows Server 2025
DNS Server: Yes
Global Catalog: Yes

Click Next to run the prerequisites check. This critical step validates your server configuration and identifies potential issues.

The prerequisites check examines:

• Network configuration and DNS settings
• Disk space and file system requirements
• Security permissions and policies
• Existing domain conflicts

If the check passes, you'll see green checkmarks. Any warnings (yellow) should be reviewed but don't prevent installation. Errors (red) must be resolved before proceeding.

After the prerequisites check passes, click Install to begin the domain controller promotion process.

The installation progress shows several phases:

• Configuring Active Directory Domain Services
• Installing DNS Server role
• Creating domain database and log files
• Configuring security policies
• Preparing for reboot

The process takes 10-15 minutes depending on your hardware. The server will automatically reboot 1-2 times during promotion.

After the final reboot, log in with your domain administrator credentials:

Username: CONTOSO\Administrator
Password: [Your original local admin password]

Open Active Directory Users and Computers from the Start menu or Server Manager Tools menu. You should see your domain structure with default organizational units:

• Builtin
• Computers
• Domain Controllers
• ForeignSecurityPrincipals
• Managed Service Accounts
• Users

Verify DNS configuration by opening DNS Manager. You should see forward and reverse lookup zones for your domain:

Forward Lookup Zones:
  - contoso.com
  - _msdcs.contoso.com

Reverse Lookup Zones:
  - 192.168.1.x Subnet (if configured)

Test domain functionality with PowerShell commands:

Get-ADDomain
Get-ADForest
Get-ADDomainController

These commands should return information about your newly created domain without errors.

Complete your AD DS setup with essential security configurations. First, configure Windows Firewall rules for AD DS services:

Enable-NetFirewallRule -DisplayGroup "Active Directory Domain Services"
Enable-NetFirewallRule -DisplayGroup "DNS Service"

Create additional organizational units for better management:

New-ADOrganizationalUnit -Name "Corporate Users" -Path "DC=contoso,DC=com"
New-ADOrganizationalUnit -Name "Servers" -Path "DC=contoso,DC=com"
New-ADOrganizationalUnit -Name "Workstations" -Path "DC=contoso,DC=com"

Configure Group Policy settings by opening Group Policy Management from Server Manager Tools. Create a baseline security policy for your domain.

Set up regular AD backups using Windows Server Backup:

Install-WindowsFeature Windows-Server-Backup
wbadmin enable backup -addtarget:E: -schedule:02:00 -include:C:\Windows\NTDS,C:\Windows\SYSVOL