Installing AD DS and Promoting a Domain Controller
Deploying a new domain controller involves two distinct steps: installing the AD DS server role (the binaries), and then promoting the server, which actually configures it as a domain controller for a new or existing domain, forest, or tree. On modern Windows Server (2012 R2 and later), the graphical dcpromo.exe wizard is gone — promotion happens either through Server Manager's Active Directory Domain Services Configuration Wizard or, more reliably for automation, through the ADDSDeployment PowerShell module.
Cricket analogy: Similar to how building a new stadium involves first constructing the physical ground (installing the role) and then officially certifying it as an ICC-sanctioned venue before it can host international matches (promotion).
Prerequisites: DNS, Static IP, and Hardware
Before promoting a server, it needs a static IP address (DHCP-assigned addresses risk changing and breaking client DC discovery), a supported Windows Server edition, and correctly configured DNS — either pointing to an existing DC's DNS server if joining an existing forest, or being prepared to host the new AD-integrated DNS zone itself if this is the first DC in a new forest. The server should also meet minimum hardware guidance (Microsoft recommends at least 2 vCPUs, 4+ GB RAM, and enough disk space for ntds.dit and the SYSVOL replica to grow), and its system clock must be within Kerberos's default 5-minute skew tolerance of other DCs, or authentication will fail outright.
Cricket analogy: Similar to how a stadium must have its pitch certified, floodlights tested, and drainage system verified before the ICC will even consider scheduling a match there — skip a prerequisite and the fixture gets pulled.
Installing the AD DS Role
The AD DS role can be installed via Server Manager's 'Add Roles and Features' wizard, or more efficiently for repeatable deployments, via PowerShell's Install-WindowsFeature cmdlet with the AD-Domain-Services feature name, optionally including the management tools. Installing the role alone does nothing except stage the binaries and the ADDSDeployment PowerShell module — the server is not yet a domain controller, doesn't yet host any part of the directory, and won't authenticate anyone until the subsequent promotion step actually runs.
Cricket analogy: Similar to a franchise signing a player to a contract (installing) — that alone doesn't put them on the field; they still need to be named in the starting XI for a specific match (promotion) to actually play.
# Install the AD DS role and management tools
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools
# Promote this server as the first DC in a brand-new forest
Install-ADDSForest `
-DomainName "contoso.com" `
-DomainNetbiosName "CONTOSO" `
-ForestMode "WinThreshold" `
-DomainMode "WinThreshold" `
-InstallDns:$true `
-SafeModeAdministratorPassword (ConvertTo-SecureString "P@ssw0rd!2026" -AsPlainText -Force)
# Promote this server as an additional DC in an existing domain
Install-ADDSDomainController `
-DomainName "contoso.com" `
-Credential (Get-Credential) `
-InstallDns:$true `
-SafeModeAdministratorPassword (ConvertTo-SecureString "P@ssw0rd!2026" -AsPlainText -Force)Install-ADDSForest and Install-ADDSDomainController both automatically reboot the server as part of promotion. Always run these unattended commands with -Confirm:$false and appropriate logging in automated deployment pipelines, and make sure any preceding configuration steps (like setting the static IP) have already completed and been verified before kicking off promotion.
Promoting the Server and Verifying Health
During promotion, the server creates the SYSVOL share (the replicated folder holding Group Policy templates and logon scripts), configures itself as a DNS server if requested, and begins its first replication cycle with an existing DC if joining an established domain. After the mandatory reboot, administrators should verify DC health rather than assume success — dcdiag runs a comprehensive suite of connectivity, replication, and service tests, while repadmin /showrepl confirms replication partners and the last successful sync time, and the Directory Service, DNS Server, and File Replication Service event logs should be checked for errors in the first hour after promotion.
Cricket analogy: Similar to how a newly built stadium doesn't just get declared match-ready after construction — groundstaff run pitch reports and drainage tests, and only a clean report clears it for an actual fixture.
Never promote a new DC into an existing forest without first confirming FSMO role holders are healthy and reachable, and that the existing forest/domain functional level supports the new server's Windows version. Promoting into a forest with an unhealthy Schema Master, for example, can leave the new DC in an inconsistent, hard-to-diagnose replication state.
- Installing AD DS (the role/binaries) and promoting a server (making it an actual DC) are two distinct steps.
- A static IP, correctly configured DNS, and clocks within Kerberos's 5-minute skew tolerance are mandatory prerequisites.
- Install-WindowsFeature AD-Domain-Services stages the role; it does not make the server a domain controller.
- Install-ADDSForest promotes the first DC of a brand-new forest; Install-ADDSDomainController adds a DC to an existing domain.
- Promotion creates the SYSVOL share and triggers an automatic reboot.
- dcdiag and repadmin /showrepl are the standard post-promotion health checks.
- Never promote into a forest with unhealthy FSMO role holders or mismatched functional levels.
Practice what you learned
1. What is the correct order of steps when deploying a new domain controller?
2. Which PowerShell cmdlet promotes a server as the first domain controller in a brand-new forest?
3. Why does a domain controller require a static IP address?
4. What folder share does promotion automatically create to hold Group Policy templates and logon scripts?
5. What tool provides a comprehensive suite of post-promotion health tests for a domain controller?
Was this page helpful?
You May Also Like
What Is Active Directory?
An introduction to Active Directory as Microsoft's directory service for centralizing identity, authentication, and resource management across a Windows network.
Domains, Trees, and Forests
How Active Directory organizes multiple domains into trees and forests to model organizational and trust boundaries.
Organizational Units (OUs)
How OUs let administrators organize AD objects for delegated administration and targeted Group Policy application.
Related Reading
Related Study Notes in Microsoft Technologies
Browse all study notesWindows 10 / UWP Development Study Notes
.NET · 30 topics
Microsoft TechnologiesWindows Batch Scripting Study Notes
Batch · 30 topics
Microsoft TechnologiesMFC (Microsoft Foundation Classes) Study Notes
C++ · 30 topics
Microsoft TechnologiesSilverlight Study Notes
.NET · 30 topics
Microsoft TechnologiesXAML Study Notes
.NET · 30 topics
Microsoft TechnologiesWPF (Windows Presentation Foundation) Study Notes
.NET · 30 topics