Setting Up Active Directory Domain Services on Windows Server: A Complete Walkthrough

Installing Active Directory Domain Services is the starting point for almost every Windows Server environment, and while the process itself has stayed conceptually stable for years, the exact steps and defaults are worth walking through cleanly on current Windows Server (2022 and 2025) rather than trusting instructions written for an older release.

Step 1: Install the AD DS role

Via PowerShell, the fastest and most repeatable method:

Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

This installs the role binaries and management tools (ADUC, ADAC, PowerShell module) but does not yet promote the server to a domain controller, that’s a deliberate second step, since installing the role and promoting the server are logically separate actions.

Step 2: Promote the server

What you run here depends on whether this is a brand new forest or an additional domain controller joining an existing one.

New forest (first domain controller ever):

Install-ADDSForest `
    -DomainName "yourdomain.com" `
    -DomainNetbiosName "YOURDOMAIN" `
    -ForestMode "WinThreshold" `
    -DomainMode "WinThreshold" `
    -InstallDns:$true `
    -SafeModeAdministratorPassword (ConvertTo-SecureString "YourDSRMPassword123!" -AsPlainText -Force)

Additional domain controller in an existing domain:

Install-ADDSDomainController `
    -DomainName "yourdomain.com" `
    -InstallDns:$true `
    -Credential (Get-Credential) `
    -SafeModeAdministratorPassword (ConvertTo-SecureString "YourDSRMPassword123!" -AsPlainText -Force)

The -Credential prompt needs Domain Admins (or Enterprise Admins for a new domain in an existing forest) rights, and the server will reboot automatically to complete promotion.

What “WinThreshold” actually means

Despite the name (a holdover from an early Windows 10/Server 2016 development codename), WinThreshold remains the correct forest/domain functional level value to specify for current Windows Server versions, since Microsoft has not introduced new named functional level constants for Server 2022 or 2025. Check Get-ADForest and Get-ADDomain after promotion to confirm the actual functional level applied matches what you intended.

Verifying the promotion succeeded

Get-ADDomainController -Filter * | Select-Object Name, OperatingSystem, Site
dcdiag /v
repadmin /replsummary

dcdiag and repadmin remain the standard post-promotion health checks, run these before considering the domain controller production-ready, not just a clean reboot with no visible errors.

Frequently asked questions

Should I let AD DS installation also configure DNS automatically?
For a new forest, yes, generally, since Active Directory depends on DNS for basically everything (locating domain controllers, service records) and having AD DS manage it directly avoids a common early misconfiguration. In an environment with existing DNS infrastructure you need to integrate with instead, plan the DNS delegation separately before promotion rather than relying on the default.

What’s the minimum number of domain controllers for a production environment?
Two, at minimum, in separate physical locations or at least separate hardware, for redundancy. A single domain controller is a single point of failure for authentication across your entire environment, acceptable only for a lab or genuinely temporary test setup, never for anything you depend on daily.