Introduction
Active Directory is an essential service for business networks and organizations of all sizes, as it simplifies the management of users and network resources. It uses a centralized database to store information about the network, including users, computers, printers, and other resources.
It allows administrators to manage users and groups, assign access rights and permissions to network resources, and control who can access them. Group Policies can also be used to apply settings centrally to multiple computers and users across the network.
Active Directory is primarily used with Microsoft Windows operating systems. However, the Lightweight Directory Access Protocol also has a free and open-source implementation developed by the OpenLDAP project.
This article explains how to install and configure Active Directory on Windows Server 2016 and later versions. The examples use Windows Server 2022 and cover three different methods: CMD, Windows PowerShell, and the GUI.
Initial steps and configuration
Before installing the Active Directory role, we recommend creating a backup of the server. You can create a Snapshot so that you can quickly roll back the changes if necessary. We also recommend assigning a static IP address to the Active Directory server and configuring the DNS server for the domain. In this example, the same server will be used to provide DNS name resolution for Active Directory.
Open Command Prompt as an administrator. To do this, click Start, type "CMD" in the search bar, right-click "Command Prompt", and select "Run as administrator".
Once Command Prompt is open, you first need to identify the name of the network interface you want to configure. Run the following command to list the available interfaces and their current settings:
netsh interface ipv4 show configOnce you have identified the interface name, IP address, subnet mask, and default gateway, configure them statically:
netsh interface ipv4 set address name="Interface_Name" static IP_Address 255.255.254.0 Default_Gateway*You can copy the information displayed by the "show config" command by selecting it and right-clicking. To paste it, simply right-click again.
If you are connected through Remote Desktop, you may experience a temporary loss of connectivity while the new network settings are applied.
Next, configure the server itself as the DNS server for the interface:
netsh interface ipv4 set dns name="Interface_Name" static 127.0.0.1You may see a message indicating that the DNS server does not exist. You can ignore it, as the DNS role will be installed later. You should also disable IPv6 on the interface:
netsh interface ipv6 set interface "Interface_Name" disableOpen PowerShell as an administrator. To do this, click Start, type "PowerShell" in the search bar, right-click "Windows PowerShell", and select "Run as administrator".
Once PowerShell is open, you first need to identify the name of the network interface you want to configure. Run the following command to list the available interfaces and their current settings:
Get-NetIPConfigurationOnce you have identified the interface name, IP address, subnet mask, and default gateway, configure them statically:
Remove-NetIPAddress -InterfaceAlias "Interface_Name" ; New-NetIPAddress -InterfaceAlias "Interface_Name" -IPAddress Server_IP_Address -PrefixLength 23 -DefaultGateway GatewayIf you are connected through Remote Desktop, you may experience a temporary loss of connectivity while the new network settings are applied. Remember to select "A" (Yes to All) when prompted. Then configure the server itself as the DNS server for the interface:
Set-DnsClientServerAddress -InterfaceAlias "Interface_Name" -ServerAddresses 127.0.0.1You should also disable IPv6 on the interface:
Disable-NetAdapterBinding -Name "Interface_Name" -ComponentID ms_tcpip6Finally, restart the network adapter to apply the new settings:
Restart-NetAdapter -InterfaceAlias "Interface_Name"In Control Panel, go to "Control Panel\Network and Internet\Network Connections" and right-click the network interface you want to configure. First, clear the Internet Protocol Version 6 (TCP/IPv6) checkbox. Then select Internet Protocol Version 4 (TCP/IPv4) and click Properties:
Enter the server's IP address, subnet mask, and default gateway manually. You can obtain this information by running ipconfig in Command Prompt. Under DNS server settings, enter 127.0.0.1 (localhost) to use the server itself as the DNS server:
Click OK and close the network interface properties window.
If you are connected through Remote Desktop, you may experience a temporary loss of connectivity while the new network settings are applied. If connectivity is not restored, you can use the Emergency Console to access the server locally and review the configuration.
Installing the Active Directory and DNS Server roles
Once the network interface has been configured, you can install the required server roles using any of the following methods:
In the same Command Prompt window used in the previous section, run the following command to install the "DNS Server" role:
dism /online /enable-feature /featurename:DNS-Server-Full-Role /allTo install the "Active Directory Domain Services" role, run:
dism /online /enable-feature /featurename:DirectoryServices-DomainController /allIf you also want to install the graphical management tools for DNS Server and Active Directory, run:
dism /online /enable-feature /featurename:DNS-Server-Tools /alldism /online /enable-feature /featurename:DirectoryServices-DomainController-Tools /allThe DNS server must now be configured. However, you will first need to restart the server. The next section explains how to configure DNS.
In the same PowerShell window used in the previous section, run the following command to install the "DNS Server" role:
Install-WindowsFeature -Name DNS -IncludeManagementToolsTo install the "Active Directory Domain Services" role, run:
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementToolsRemove the option to include the management tools if you do not plan to use the GUI or if you are using Windows Server Core. The DNS server must now be configured. However, you will first need to restart the server. The next section explains how to configure DNS.
Open Server Manager, refresh it, and add the "Active Directory Domain Services" and "DNS Server" roles, as shown below:
Once the roles have been installed, Server Manager will display a notification prompting you to promote the server to a domain controller.
Configuring the DNS server
Before promoting the server to a domain controller, you must configure the DNS server and create the DNS zone that will be used by Active Directory.
First, create the DNS zone for the Active Directory domain by running the following command in Command Prompt (remember to replace example.lan with your own domain):
dnscmd /zoneadd example.lan /primaryYou should also configure DNS forwarders so that the server can resolve external domain names. The following command adds Cloudflare's primary and secondary DNS servers:
dnscmd /resetforwarders 1.1.1.1 1.0.0.1Next, enable dynamic updates for the zone:
dnscmd /Config example.lan /AllowUpdate 1Finally, verify that name resolution is working by running an nslookup query, for example:
nslookup clouding.ioOnce the DNS server has been configured, you can promote the server to a domain controller.
First, create the DNS zone for the Active Directory domain by running the following command in PowerShell (remember to replace example.lan with your own domain):
Add-DnsServerPrimaryZone -Name "example.lan" -ZoneFile example.lan.dns -PassThru -DynamicUpdate NonsecureAndSecureYou should also configure DNS forwarders so that the server can resolve external domain names. The following command adds Cloudflare's primary DNS server:
Set-DnsServerForwarder -IPAddress "1.1.1.1"To add Cloudflare's secondary DNS server, run:
Add-DnsServerForwarder -IPAddress "1.0.0.1"Once the DNS server has been configured, you can promote the server to a domain controller.
Open the DNS Manager console, right-click the server name, and select "Configure a DNS Server" from the menu. Then complete the wizard as shown below:
Add the domain that you want to use for Active Directory and make sure that dynamic updates are enabled. You should also configure DNS forwarders. In this example, Cloudflare's public DNS servers 1.1.1.1 and 1.0.0.1 are used.
Installing Active Directory and promoting the server
Once you have completed the previous steps, the final task is to promote the server to a domain controller:
In older versions of Windows Server, you could run dcpromo to launch the Active Directory Domain Services installation wizard. However, this command is no longer supported in recent versions and will display a warning message.
Instead, you can open Server Manager by running the following command:
ServerManagerThen, follow the instructions in the GUI tab to promote the server from Server Manager.
You can still use dcpromo in older versions of Windows Server to perform an attended or unattended installation. More information is available in Microsoft's official documentation. On current versions of Windows Server, use PowerShell or Server Manager instead.
To promote the server using PowerShell, run the following command:
Install-ADDSForest -DomainName "example.lan" -CreateDNSDelegation You will be prompted to enter a Directory Services Restore Mode password and the administrator credentials required to create the DNS delegation. The process may take several minutes, and the server will restart automatically once it has completed.
To use the GUI, open Server Manager and click Promote this server to a domain controller in the notification:
The Active Directory Domain Services Configuration Wizard will open. Use it to configure the environment and complete the Active Directory installation:
Select "Add a new forest" and enter the domain name that you used when creating the DNS zone. For example, "example.lan". Click Next, enter a Directory Services Restore Mode password, and click Next again. Configure the DNS delegation and enter the administrator credentials when prompted. Continue clicking Next until you reach the installation screen, and then click Install:
The installation will take a few minutes to complete. Once the promotion has finished, the server will restart automatically. The operating system may take longer than usual to start while the remaining configuration is completed. Once the server has fully started, it will be ready to use as a domain controller.
We hope you found this tutorial helpful 🙂. If you have any questions about this or any other matter related to your Clouding servers, please contact us at soporte@clouding.io. We are always here to help!