Active Directory Domain Services Configuration

3 Nov 2026, 18:2315 min readby ITYantra Admin

# Active Directory Domain Services Configuration ## Introduction Active Directory Domain Services (AD DS) is Microsoft's directory service for Windows domain networks. AD DS stores information abou

# Active Directory Domain Services Configuration

Introduction

Active Directory Domain Services (AD DS) is Microsoft's directory service for Windows domain networks. AD DS stores information about network resources (users, computers, groups, services) and provides authentication, authorization, and centralized administration. This tutorial covers installing and configuring AD DS, creating domains and forests, organizational units, users, groups, and Group Policy Objects.

By the end of this guide, you will be able to deploy and manage a complete Active Directory environment.

Technical Background

Active Directory Components

| Component | Description | |-----------|-------------| | Domain | Logical group of objects sharing a common directory database | | Tree | One or more domains with contiguous namespace | | Forest | Collection of trees sharing common schema and global catalog | | Domain Controller (DC) | Server running AD DS that stores directory and authenticates users | | Organizational Unit (OU) | Container for organizing objects within a domain | | Global Catalog | Partial replica of all objects in forest for search and authentication | | FSMO Roles | Flexible Single Master Operations roles for forest/domain operations |

FSMO Roles

| Role | Scope | Description | |------|-------|-------------| | Schema Master | Forest | Controls schema modifications | | Domain Naming Master | Forest | Controls domain addition/removal | | PDC Emulator | Domain | Password changes, time synchronization | | RID Master | Domain | Allocates Relative Identifier pools | | Infrastructure Master | Domain | Updates cross-domain object references |

AD DS Replication

AD DS uses multi-master replication between domain controllers. Changes made on any DC are replicated to all other DCs in the domain. Replication occurs within sites (intrasite) and between sites (intersite) using site links.

Prerequisites

  • Windows Server 2025 installed
  • Static IP address configured
  • DNS server configured (or AD DS will install DNS)
  • Administrator credentials
  • Network connectivity

Architecture

Single Domain Forest

┌─────────────────────────────────────────────────────────────┐
│                     Forest: ityantra.lab                    │
│                                                             │
│  ┌─────────────────────────────────────────────────────┐   │
│  │              Domain: ityantra.lab                   │   │
│  │                                                     │   │
│  │  ┌─────────┐  ┌─────────┐  ┌─────────┐            │   │
│  │  │  DC01   │  │  DC02   │  │  DC03   │            │   │
│  │  │(Primary)│  │(Replica)│  │(Replica)│            │   │
│  │  └─────────┘  └─────────┘  └─────────┘            │   │
│  │                                                     │   │
│  │  ┌─────────┐  ┌─────────┐  ┌─────────┐            │   │
│  │  │   OU:   │  │   OU:   │  │   OU:   │            │   │
│  │  │  Users  │  │Computers│  │ Servers │            │   │
│  │  └─────────┘  └─────────┘  └─────────┘            │   │
│  └─────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────┘

Multi-Site Topology

Site: Headquarters              Site: Branch Office
┌─────────────┐                 ┌─────────────┐
│   DC01-HQ   │──── Site Link ──│  DC01-BR    │
│   DC02-HQ   │    (VPN/WAN)    │             │
└──────┬──────┘                 └─────────────┘
       │
    Clients

Step-by-Step Implementation

Step 1: Prepare Windows Server for AD DS

**Purpose**: Ensure server is ready for AD DS installation.

**Commands** (PowerShell):

# Set static IP address
New-NetIPAddress -InterfaceAlias "Ethernet0" -IPAddress 192.168.1.10 -PrefixLength 24 -DefaultGateway 192.168.1.1

# Set DNS to loopback (AD DS will install DNS)
Set-DnsClientServerAddress -InterfaceAlias "Ethernet0" -ServerAddresses ("127.0.0.1")

# Rename server
Rename-Computer -NewName "DC01" -Restart

# Verify connectivity
Test-NetConnection -ComputerName 192.168.1.1

**Expected output**: Server configured with static IP, DNS, and hostname.

Step 2: Install AD DS Role

**Purpose**: Install Active Directory Domain Services role.

**Commands** (PowerShell):

# Install AD DS role and management tools
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

# Verify installation
Get-WindowsFeature AD-Domain-Services

**Expected output**: AD DS role installed; server ready for promotion.

Step 3: Promote Server to Domain Controller

**Purpose**: Create new forest and domain.

**Commands** (PowerShell):

# Create new forest
Install-ADDSForest `
    -DomainName "ityantra.lab" `
    -DomainNetbiosName "ITYANTRA" `
    -InstallDns:$true `
    -CreateDnsDelegation:$false `
    -DatabasePath "C:\Windows\NTDS" `
    -LogPath "C:\Windows\NTDS" `
    -SysvolPath "C:\Windows\SYSVOL" `
    -SafeModeAdministratorPassword (ConvertTo-SecureString -AsPlainText "P@ssw0rd!" -Force) `
    -Force:$true

**Expected output**: New forest and domain created; server promoted to domain controller; server restarts.

**Verification**:

# Verify domain controller
Get-ADDomainController
Test-AdfsServerDeployment  # if AD FS

Step 4: Create Organizational Units (OUs)

**Purpose**: Organize users, computers, and resources into OUs.

**Commands** (PowerShell):

# Import ActiveDirectory module
Import-Module ActiveDirectory

# Create OUs
New-ADOrganizationalUnit -Name "Users" -Path "DC=ityantra,DC=lab" -ProtectedFromAccidentalDeletion $true
New-ADOrganizationalUnit -Name "Computers" -Path "DC=ityantra,DC=lab" -ProtectedFromAccidentalDeletion $true
New-ADOrganizationalUnit -Name "Servers" -Path "DC=ityantra,DC=lab" -ProtectedFromAccidentalDeletion $true
New-ADOrganizationalUnit -Name "Groups" -Path "DC=ityantra,DC=lab" -ProtectedFromAccidentalDeletion $true
New-ADOrganizationalUnit -Name "Service Accounts" -Path "DC=ityantra,DC=lab" -ProtectedFromAccidentalDeletion $true

# Create nested OUs
New-ADOrganizationalUnit -Name "IT Department" -Path "OU=Users,DC=ityantra,DC=lab"
New-ADOrganizationalUnit -Name "HR Department" -Path "OU=Users,DC=ityantra,DC=lab"

# Verify OUs
Get-ADOrganizationalUnit -Filter * | Select-Object Name, DistinguishedName

**Expected output**: OUs created in domain.

**Verification**:

Get-ADOrganizationalUnit -Filter *
# Lists all OUs in domain

Step 5: Create User Accounts

**Purpose**: Create user accounts for authentication.

**Commands** (PowerShell):

# Create domain user
New-ADUser `
    -Name "John Doe" `
    -GivenName "John" `
    -Surname "Doe" `
    -SamAccountName "jdoe" `
    -UserPrincipalName "jdoe@ityantra.lab" `
    -Path "OU=Users,DC=ityantra,DC=lab" `
    -AccountPassword (ConvertTo-SecureString -AsPlainText "P@ssw0rd!" -Force) `
    -Enabled:$true `
    -PasswordNeverExpires:$false `
    -ChangePasswordAtLogon:$true

# Create service account
New-ADUser `
    -Name "SQL Service Account" `
    -SamAccountName "svc_sql" `
    -UserPrincipalName "svc_sql@ityantra.lab" `
    -Path "OU=Service Accounts,DC=ityantra,DC=lab" `
    -AccountPassword (ConvertTo-SecureString -AsPlainText "S3rviceP@ss!" -Force) `
    -Enabled:$true `
    -PasswordNeverExpires:$true `
    -CannotChangePassword:$true

# Verify users
Get-ADUser -Filter * -Properties SamAccountName, Enabled, DistinguishedName

**Expected output**: User accounts created in OUs.

**Verification**:

Get-ADUser -Filter *
# Lists all domain users

Step 6: Create Groups and Manage Membership

**Purpose**: Create groups for permission management.

**Commands** (PowerShell):

# Create security groups
New-ADGroup -Name "Domain Admins Custom" -GroupScope Global -Path "OU=Groups,DC=ityantra,DC=lab"
New-ADGroup -Name "IT Staff" -GroupScope Global -Path "OU=Groups,DC=ityantra,DC=lab"
New-ADGroup -Name "HR Staff" -GroupScope Global -Path "OU=Groups,DC=ityantra,DC=lab"
New-ADGroup -Name "File Server Admins" -GroupScope DomainLocal -Path "OU=Groups,DC=ityantra,DC=lab"

# Add users to groups
Add-ADGroupMember -Identity "IT Staff" -Members jdoe,asmith
Add-ADGroupMember -Identity "Domain Admins Custom" -Members administrator

# Verify group membership
Get-ADGroupMember -Identity "IT Staff"
Get-ADPrincipalGroupMembership -Identity jdoe

**Expected output**: Groups created with members.

**Verification**:

Get-ADGroupMember -Identity "IT Staff"
# Shows members of IT Staff group

Step 7: Configure Group Policy Objects (GPOs)

**Purpose**: Apply configuration and security settings via Group Policy.

**Commands** (PowerShell):

# Import GroupPolicy module
Import-Module GroupPolicy

# Create GPO
New-GPO -Name "Domain Password Policy" | New-GPLink -Target "DC=ityantra,DC=lab" -LinkEnabled Yes -Enforced Yes

# Create GPO for workstations
New-GPO -Name "Workstation Security" | New-GPLink -Target "OU=Computers,DC=ityantra,DC=lab"

# Verify GPOs
Get-GPO -All | Select-Object DisplayName, GpoStatus

**GPO Management** (Group Policy Management Console - GPMC.msc):

1. Open Group Policy Management (GPMC.msc) 2. Navigate to domain or OU 3. Right-click → Create a GPO in this domain, and Link it here 4. Edit GPO to configure settings 5. Configure:

  • Computer Configuration → Policies → Windows Settings → Security Settings
  • User Configuration → Policies → Windows Settings → Security Settings

**Expected output**: GPOs created and linked to domain/OU.

**Verification**:

Get-GPO -All | Select-Object DisplayName
# Lists all GPOs in domain

Step 8: Add Additional Domain Controller

**Purpose**: Provide redundancy and fault tolerance.

**Commands** (PowerShell):

# Install AD DS role on second server
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

# Promote as additional domain controller in existing domain
Install-ADDSDomainController `
    -DomainName "ityantra.lab" `
    -SiteName "Default-First-Site-Name" `
    -InstallDns:$true `
    -DatabasePath "C:\Windows\NTDS" `
    -LogPath "C:\Windows\NTDS" `
    -SysvolPath "C:\Windows\SYSVOL" `
    -SafeModeAdministratorPassword (ConvertTo-SecureString -AsPlainText "P@ssw0rd!" -Force) `
    -Force:$true

**Expected output**: Additional domain controller replicating with first DC.

**Verification**:

Get-ADDomainController -Filter *
# Shows all domain controllers in domain

Configuration Examples

Password Policy (Fine-Grained Password Policy)

# Create fine-grained password policy
New-ADFineGrainedPasswordPolicy -Name "Strict Password Policy" `
    -ComplexityEnabled:$true `
    -MinPasswordLength 14 `
    -MinPasswordAge 1 `
    -MaxPasswordAge 90 `
    -PasswordHistoryCount 24 `
    -LockoutDuration (New-TimeSpan -Minutes 30) `
    -LockoutObservationWindow (New-TimeSpan -Minutes 30) `
    -LockoutThreshold 5 `
    -Precedence 100

# Apply to group
Add-ADFineGrainedPasswordPolicySubject -Identity "Strict Password Policy" -Subjects "Domain Users"

Group Policy Security Settings (GPMC)

Computer Configuration → Policies → Windows Settings → Security Settings:
  Account Policies → Password Policy:
    Enforce password history: 24 passwords remembered
    Maximum password age: 90 days
    Minimum password age: 1 day
    Minimum password length: 14 characters
    Password must meet complexity requirements: Enabled
    
  Account Policies → Account Lockout Policy:
    Account lockout duration: 30 minutes
    Account lockout threshold: 5 invalid attempts
    Reset account lockout counter after: 30 minutes
    
  Local Policies → User Rights Assignment:
    Access this computer from the network: Administrators, Authenticated Users
    Log on as a service: (service accounts)
    Deny log on locally: Guests

DNS Configuration for AD

# Verify DNS records for AD
Get-DnsServerResourceRecord -ZoneName "ityantra.lab"

# Key SRV records created by AD:
# _ldap._tcp.dc._msdcs.ityantra.lab
# _kerberos._tcp.dc._msdcs.ityantra.lab
# _gc._tcp.ityantra.lab
# _ldap._tcp.gc._msdcs.ityantra.lab

Verification

AD DS Verification Commands

# Test domain controller
Test-AdfsServerDeployment
dcdiag /v

# Check replication status
repadmin /showreps
repadmin /replsummary

# Verify FSMO roles
Get-ADDomainController -Filter * | Select-Object Domain, Forest, FSMORoles
netdom query fsmo

# Verify DNS
nslookup -type=SRV _ldap._tcp.dc._msdcs.ityantra.lab
nslookup -type=SRV _gc._tcp.ityantra.lab

# Verify user authentication
Get-ADUser -Identity jdoe -Properties *

Expected Results

  • `dcdiag` passes all tests
  • `repadmin /replsummary` shows successful replication
  • FSMO roles assigned to domain controllers
  • DNS SRV records present for AD services
  • Users can authenticate and log in

Troubleshooting

| Symptom | Possible Cause | Diagnostic Command | Corrective Action | Verification | |---------|---------------|-------------------|-------------------|--------------| | Cannot promote to DC | DNS not configured | `dcdiag /test:dns` | Install DNS; point DNS to self | Promotion succeeds | | Replication fails | Network or RPC issue | `repadmin /showreps` | Fix network; check firewall | Replication succeeds | | Users cannot log in | Account locked or disabled | `Get-ADUser -Properties LockedOut,Enabled` | Unlock account; enable account | User can log in | | FSMO role missing | Role holder offline | `netdom query fsmo` | Seize or transfer role | Role assigned | | Group Policy not applied | GPO not linked or enforced | `gpresult /r` | Link GPO; check enforcement | GPO applies | | Cannot join domain | DNS suffix or DNS server | `ipconfig /all` | Set primary DNS to DC | Domain join succeeds | | SYSVOL not shared | File Replication Service issue | `dfsrdiag` | Fix DFS-R; restart service | SYSVOL shared |

Best Practices

1. **Deploy at least 2 domain controllers**: Provides redundancy and fault tolerance. 2. **Place DCs in separate sites**: Reduces WAN traffic for authentication. 3. **Enable AD Recycle Bin**: Recover deleted objects without authoritative restore. 4. **Use fine-grained password policies**: Different requirements for different user groups. 5. **Protect built-in accounts**: Rename Administrator; disable Guest. 6. **Implement least privilege**: Delegate specific OU management to trusted admins. 7. **Monitor AD health**: Run dcdiag regularly; monitor replication. 8. **Back up AD regularly**: System state backup on at least one DC per domain. 9. **Use secure LDAP (LDAPS)**: Encrypt directory queries. 10. **Document FSMO role placement**: Know which DC holds each role.

Conclusion

Active Directory Domain Services provides the foundation for identity and access management in Windows environments. Proper AD DS design includes domain structure, OU organization, domain controller placement, replication, and Group Policy. This guide covered installation, domain creation, OU and user management, groups, GPOs, and additional domain controllers. For production environments, implement AD Recycle Bin, multiple domain controllers, regular backups, and comprehensive monitoring.

References

  • Microsoft Active Directory Documentation (https://learn.microsoft.com/windows-server/identity/)
  • Active Directory Domain Services Overview (https://learn.microsoft.com/windows-server/identity/ad-ds/get-started/virtual-dc/remote-operations)
  • Group Policy Documentation (https://learn.microsoft.com/windows-server/group-policy/)
  • PowerShell ActiveDirectory Module (https://learn.microsoft.com/powershell/module/addsadministration/)
#active-directory#ad-ds#domain-controller#forest#ou#group-policy#windows-server#identity