Active Directory - Domain Controller Basics

Introduction

In this tutorial, you will learn how to install and configure an Active Directory Domain Controller on Windows Server 2022 using PowerShell.

Active Directory Domain Services (AD DS) is a Microsoft directory service that provides centralized authentication, authorization, and management of users, computers, and other network resources.

We will configure a new Active Directory forest with the domain test.lab, install the DNS Server role, and create basic organizational units, users, and security groups.

All configuration steps will be performed using PowerShell, without using the graphical Server Manager or Active Directory management tools.

Steps

1. Prepare Windows Server 2022 and verify the network configuration.
2. Configure a static IP address and the server hostname.
3. Verify and configure a strong local Administrator password.
4. Install Active Directory Domain Services.
5. Create a new Active Directory forest with the domain test.lab.
6. Verify the Domain Controller and configure DNS.
7. Create Organizational Units (OUs).
8. Create Active Directory users and security groups.
9. Configure group memberships.
10. Test Active Directory and DNS functionality.
11. Join a Windows client to the domain.
12. Troubleshoot common Active Directory issues.

Example Network Environment

We will use the following example configuration throughout this tutorial.

The IP addresses are examples and should be adjusted to match your network.

Important: This tutorial assumes that DC01 is the first Domain Controller in a new, isolated Active Directory environment.

The Domain Controller will also provide DNS services for test.lab.

If you already have a BIND DNS server using 192.168.10.10 and hosting test.lab, you must assign a different IP address to the Windows server and plan DNS integration carefully. Two independent authoritative DNS servers must not manage conflicting copies of the same zone.

Preparing Windows Server 2022

Before installing Active Directory, verify the operating system and network configuration.

Open Windows PowerShell as Administrator.

Check the operating system

This command displays information about the installed Windows Server operating system.

Check the network configuration

Configure a static IP address

First, inspect the current IPv4 configuration:

Disable DHCP for IPv4:

If an existing IPv4 address or default gateway conflicts with the planned configuration, remove or modify it before continuing.

Configure the static IP address:

Configure the DNS server address:

The DNS Server role will be installed during Active Directory promotion.

Changing the network configuration can interrupt remote connections. Perform these commands from the server console when necessary.

Verify the IP configuration

Configure the hostname

This changes the hostname to DC01 and restarts the server.

After restarting, open PowerShell as Administrator again.

Verify the hostname:

Configuring the Administrator Password

Before installing Active Directory, make sure the local Administrator account has a strong password that meets Windows password complexity requirements.

When creating the first Domain Controller in a new forest, the built-in local Administrator account becomes the domain Administrator account.

Therefore, it is important to configure a secure password before promoting the server to a Domain Controller.

Check the local password policy

Run:

This displays the current local account password policy, including the minimum password length, password age, and lockout settings.

To inspect the password complexity setting, export the local security policy:

Then search for the relevant settings:

The output may look similar to:

MinimumPasswordLength = 7

PasswordComplexity = 1

PasswordComplexity = 1 means password complexity is enabled.

Understand password requirements

When standard Windows password complexity rules are enabled, a password must:

• Meet the configured minimum password length.
• Not contain the user's account name or substantial parts of the user's full name.
• Contain characters from at least three of the supported character categories, such as uppercase letters, lowercase letters, numbers, and special characters.

For this tutorial, use a unique password with at least 14 characters, preferably generated by a password manager.

This is a security recommendation, not a claim that Windows Server 2022 requires 14 characters by default.

Change the Administrator password

Run the following command:

Then set the password:

If the built-in Administrator account was renamed, replace Administrator with its actual name.

You can identify the built-in account by its SID ending in -500:

Get-LocalUser |  Where-Object { $_.SID.Value -match '-500$' }

If the password does not meet the local password policy, Windows rejects the change.

Verify the Administrator account

The PasswordLastSet value should reflect the recent password change.

Important: This confirms that the password was updated, but does not reveal or independently verify the password itself. A successful Set-LocalUser operation indicates that Windows accepted the new password under the applicable policy.

Do not store Administrator passwords in plain text PowerShell scripts.

Installing Active Directory Domain Services

The next step is to install the Active Directory Domain Services role.

Install the AD DS role

Explanation

• Install-WindowsFeature – Installs Windows Server roles and features.
• -Name AD-Domain-Services – Specifies the Active Directory Domain Services role.
• -IncludeManagementTools – Installs the Active Directory management tools, including the PowerShell module.

Verify the installation

Creating a New Active Directory Forest

An Active Directory forest is the highest-level logical structure in Active Directory.

It contains one or more domains that share a common schema, configuration, and trust relationships.

We will create a new forest using test.lab as the forest root domain.

Import the deployment module

This module provides the PowerShell commands required to install and configure Active Directory Domain Services.

Configure the DSRM password

Directory Services Restore Mode (DSRM) is used for certain Active Directory recovery operations.

The DSRM password is separate from the domain Administrator password.

Use a strong, unique password and store it securely.

Check installation prerequisites

This checks whether the server meets the requirements for creating a new Active Directory forest.

WinThreshold corresponds to the Windows Server 2016 functional level, which is the highest supported functional level on Windows Server 2022.

Promote the server to a Domain Controller

Explanation

• Install-ADDSForest – Creates a new Active Directory forest and promotes the server to a Domain Controller.
• -DomainName – Specifies the Active Directory domain name.
• -DomainNetBIOSName – Defines the short domain name.
• -InstallDNS – Installs and configures the DNS Server role.
• -ForestMode – Specifies the forest functional level.
• -DomainMode – Specifies the domain functional level.
• -SafeModeAdministratorPassword – Configures the DSRM recovery password.
• -Force – Suppresses confirmation prompts without bypassing prerequisite checks.

During promotion, Windows creates the Active Directory database, configures DNS, and initializes the Domain Controller.

The server restarts automatically after successful promotion.

Log in after the restart

After the restart, sign in with the domain Administrator account:

TEST\Administrator

Alternatively:

Administrator@test.lab

Use the Administrator password configured in Step 5.

Verifying the Active Directory Installation

After restarting, open PowerShell as Administrator.

Import the Active Directory module

Verify the domain

Expected information includes:

DNSRoot    : test.lab

NetBIOSName : TEST

PDCEmulator : DC01.test.lab

Verify the forest

This displays the forest configuration, domains, global catalog servers, and functional level.

Verify the Domain Controller

Verify the AD DS service

Configuring and Verifying DNS

Active Directory uses DNS to locate Domain Controllers and services such as LDAP and Kerberos.

The DNS Server role was installed automatically during Domain Controller promotion.

Verify the DNS role

The installation state should be Installed.

Check the DNS service

List DNS zones

The output should include:

test.lab

_msdcs.test.lab

These zones contain DNS records required for Active Directory.

Configure DNS forwarders

Forwarders allow the DNS server to resolve external domains.

Verify the configuration:

Test forward DNS resolution

Verify Active Directory SRV records

The result should identify dc01.test.lab as a Domain Controller providing LDAP services.

Test external DNS resolution

Creating Organizational Units (OUs)

Organizational Units are containers used to organize Active Directory objects such as users, computers, and groups.

They also allow administrators to apply Group Policies to specific objects.

Verify the Organizational Units

Creating Active Directory Users

We will create two example user accounts.

Enter an initial user password

Choose a password that satisfies the domain password policy.

Create the first user

Create the second user

Explanation

• New-ADUser – Creates an Active Directory user.
• -Name – Specifies the user object's name.
• -GivenName – Defines the first name.
• -Surname – Defines the last name.
• -SamAccountName – Specifies the Windows logon name.
• -UserPrincipalName – Specifies the domain logon name.
• -Path – Defines the Organizational Unit.
• -AccountPassword – Sets the initial password.
• -ChangePasswordAtLogon – Requires a password change at first login.
• -Enabled – Enables the account.

Verify the users

Creating Active Directory Security Groups

Security groups allow administrators to manage access permissions centrally.

Instead of assigning permissions to individual users, permissions can be assigned to groups.

Create a security group

Explanation

• New-ADGroup – Creates an Active Directory group.
• -Name – Specifies the group name.
• -SamAccountName – Defines the group account name.
• -GroupCategory Security – Creates a security group.
• -GroupScope Global – Creates a global group.
• -Path – Defines the OU where the group is created.

Add users to the group

Verify group membership

The output should contain John Doe and Alice Smith.

Joining a Windows 11 Client to the Active Directory Domain

Introduction

After configuring the Active Directory Domain Controller on Windows Server 2022, the next step is to join a Windows 11 client to the existing domain test.lab.

Joining a computer to Active Directory allows domain users to sign in with their domain credentials and enables centralized management through Group Policy.

In this section, we will configure a Windows 11 client and join it to the domain using PowerShell.

Supported Windows 11 Editions

Not every Windows 11 edition supports joining a traditional Active Directory domain.

Important: Windows 11 Home cannot join a traditional Active Directory domain. Use Windows 11 Pro, Enterprise, Education, or another supported edition.

Windows 11 Installation

During the initial Windows 11 installation, select the appropriate organizational setup option:

1. Install a supported Windows 11 edition, such as Windows 11 Pro.
2. Select Set up for work or school when prompted.
3. Choose Sign-in options → Domain join instead, if this option is available.
4. Create a local administrator account with a strong password.
5. Complete the Windows installation.

The Domain join instead option does not automatically join the computer to Active Directory. It allows you to complete the installation using a local account before joining the domain.

If Windows 11 is already installed, reinstalling is not necessary.

Example Network Configuration

We will use the following network configuration:

The Windows 11 client must be connected to the same network as the Domain Controller or have appropriate routing and firewall access.

Preparing the Windows 11 Client

Sign in using the local administrator account and open PowerShell as Administrator.

Verify the Windows Edition

This command displays information about the installed Windows version.

Configure the Hostname

After restarting, verify the hostname:

Configuring DHCP and DNS

The Windows 11 client will obtain its IP address and default gateway automatically from a DHCP server.

However, the DNS server will be configured manually to point to the Active Directory Domain Controller.

Check the Network Adapter

For this tutorial, the network adapter is named Ethernet.

Verify DHCP Configuration

If DHCP is disabled, enable it:

If a static IPv4 address or default route remains configured, remove the conflicting settings before renewing DHCP.

Configure the Active Directory DNS Server

Set the DNS server manually:

This configures the Windows 11 client to use the Domain Controller as its DNS server.

Important: The DNS server 192.168.10.10 must be able to resolve the Active Directory domain test.lab.

Do not add public DNS servers such as 8.8.8.8 or 1.1.1.1 as alternative DNS servers. They cannot resolve the internal Active Directory service records.

Optional: Configure an Additional DNS Server

If your network contains a second internal DNS server that can correctly resolve test.lab and its Active Directory service records, you can configure both DNS servers:

In this example:

• 192.168.10.10 – Primary Active Directory DNS server.
• 192.168.10.11 – Secondary internal DNS server, if available and correctly configured.

Important: 192.168.10.11 is only an example. Do not add it unless such a DNS server actually exists and supports Active Directory DNS resolution.

Windows may use either configured DNS server depending on availability and resolver behavior. Both servers must therefore provide consistent results for the Active Directory domain.

Renew the DHCP Lease

The IP address and default gateway will continue to be assigned automatically by DHCP.

The manually configured DNS server addresses remain configured.

Verify the Network Configuration

Testing Connectivity to the Domain Controller

Before joining the domain, verify network connectivity and DNS resolution.

Test Network Connectivity

This tests connectivity to the Domain Controller using ICMP.

A failed ping does not necessarily indicate a network problem because ICMP may be blocked by a firewall.

Test Forward DNS Resolution

Test Reverse DNS Resolution

This assumes the reverse DNS zone and PTR record were configured in the previous tutorial.

Verify Active Directory SRV Records

The result should identify dc01.test.lab as an available Domain Controller.

Test LDAP Connectivity

Test Kerberos Connectivity

These tests verify TCP connectivity. A successful domain join also depends on DNS, SMB, RPC, and other required services.

Verify Time Synchronization

Kerberos authentication requires the client and Domain Controller clocks to be sufficiently synchronized.

Check the Windows Time service:

If stopped start the service:

Check if it is running now:

Joining the Windows 11 Client to Active Directory

Once the network configuration and DNS resolution are working, the client can join the domain.

Enter Domain Administrator Credentials

Enter the domain Administrator password when prompted.

Join the Domain

Explanation

• Add-Computer – Joins a Windows computer to an Active Directory domain.
• -DomainName – Specifies the Active Directory domain.
• -Credential – Provides an account authorized to join computers to the domain.
• -Restart – Restarts the computer after joining the domain.
• -Verbose – Displays additional information during the operation.

The Windows 11 client will restart after successfully joining the domain.

Alternative: Join Directly into an Organizational Unit

If the Computers Organizational Unit from the previous tutorial already exists, you can place the computer account directly into that OU.

Use the following command instead of the previous domain join command:

This creates the computer account in the specified OU, assuming the account has the required permissions.

Logging in with an Active Directory User

After restarting the client, the Windows sign-in screen appears.

Select Other user if necessary.

Sign in using an existing Active Directory account:

TEST\jdoe

Alternatively:

jdoe@test.lab

Enter the user's Active Directory password.

If the user was configured to change the password at first login, Windows will prompt for a new password.

Windows then creates a local user profile for the domain account.

Verifying Domain Membership

After signing in, open PowerShell.

Check Domain Membership

Verify the Logged-in User

Verify the Domain Secure Channel

This confirms that the computer's secure channel with Active Directory is working.

Verify Domain Controller Discovery

The output should identify DC01 as an available Domain Controller.

Verify the Computer Account in Active Directory

Run the following command on the Windows Server 2022 Domain Controller: