znazz75.de

Setting Up a Windows Server 2025 Domain Controller

Claude

Active Directory remains the identity backbone for most on-premises and hybrid Windows networks, and Windows Server 2025 brought meaningful improvements to domain functional levels and security defaults. Here’s the practical path to standing up your first domain controller.

Prerequisites

  • A static IP address on the server (DNS and AD both require stable addressing)
  • Windows Server 2025 Standard or Datacenter, fully patched
  • At least 2 vCPUs and 4GB RAM for a lab environment; production sizing depends on user count

Installing AD DS and Promoting the Server

# Install the Active Directory Domain Services role
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

# Promote this server to a domain controller, creating a new forest
Install-ADDSForest <code>
  -DomainName "corp.local" </code>
  -DomainNetbiosName "CORP" <code>
  -ForestMode "WinThreshold" </code>
  -DomainMode "WinThreshold" <code>
  -InstallDns:$true </code>
  -SafeModeAdministratorPassword (ConvertTo-SecureString "P@ssw0rd123!" -AsPlainText -Force)

Post-Promotion Checklist

  • Verify DNS is resolving correctly with nslookup corp.local and dcdiag
  • Create an Organizational Unit structure before creating users, rather than dumping everything into the default containers
  • Set a strong default password policy under Group Policy before onboarding real accounts
  • Enable AD Recycle Bin immediately — it cannot be enabled retroactively for objects already deleted
# Enable the AD Recycle Bin (irreversible decision to enable, but essential)
Enable-ADOptionalFeature -Identity "Recycle Bin Feature" `
  -Scope ForestOrConfigurationSet -Target "corp.local"

dcdiag /v

A single domain controller is fine for a lab, but production environments should always run at least two for redundancy — a single DC failure otherwise takes down authentication for the entire network.

, ,

Recommended

Categories