Windows Server 2025 / How to Add a Second Domain Controller
An additional domain controller replicates the existing domain and provides its directory and authentication services. Point DC2 at working DC1 DNS, add it to the existing domain, and verify AD replication, DNS, and SYSVOL before changing client configuration.
Prepare DC2 for the existing domain
DC1 must already serve ad.example.test correctly. Install a fresh Windows Server 2025 VM named DC2 at static 172.24.50.11/24. Before promotion, use DC1 at .10 for DNS.
- Verify DC1 health and backup readiness.
- Check unique name and address, time, and updates.
- Prepare server administrator and domain promotion rights.
- Verify the required AD traffic between the two lab VMs.
Resolve-DnsName '_ldap._tcp.dc._msdcs.ad.example.test' -Type SRV -Server 172.24.50.10 nltest /dsgetdc:ad.example.test
Run discovery from DC2. Cloning DC1 and merely renaming it is not this deployment procedure. Check functional-level compatibility; do not raise an operational forest level without a plan.
Choose Add a domain controller to an existing domain
- Install AD DS and its tools on DC2.
- Open promotion from Server Manager’s notification.
- Select addition to an existing domain, not a new forest.
- Specify ad.example.test and authorized credentials.
- Review DNS, global catalog, and the intended site; this lab uses a writable controller rather than RODC.
- Supply DC2’s DSRM password, review paths and prerequisites, then install and restart.
Site selection should reflect subnet and site planning. The small lab may display a default site; that is not a rule for production. See Install-ADDSDomainController.
Use the PowerShell alternative if not already promoted
Run on DC2 and enter credentials and the recovery password interactively rather than placing them in code. Domain credentials and DSRM have separate purposes:
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools $promotionCredential = Get-Credential Install-ADDSDomainController -DomainName 'ad.example.test' -InstallDns -Credential $promotionCredential
A freshly installed server can supply domain credentials during promotion, including when not previously joined as a member. After promotion and restart, confirm console access using the intended domain administrator.
Verify replication, DNS, and SYSVOL
Seeing DC2 in a list does not prove convergence. In an authorized administrative shell, inspect partners, partitions, last success, and errors:
Get-ADDomainController -Filter * | Select-Object HostName,IPv4Address,Site,IsGlobalCatalog repadmin /replsummary repadmin /showrepl DC2 dcdiag /s:DC2 /test:dns Get-SmbShare -Name SYSVOL,NETLOGON
Run the SYSVOL and NETLOGON share query on DC2. From CLIENT1, query the same domain service record against .10 and .11 separately. A file-backed practice zone such as lab.example.test does not automatically replicate through AD like an AD-integrated zone.
For a data check, change a recorded description on a lab object through DC1 and query it through DC2, then restore the original value. Avoid changing operational accounts. Use replication failure diagnostics to investigate dependencies.
Update client DNS only after validation
Once DC2 DNS works, test one member or client using both internal resolvers before changing DHCP options or the whole fleet. Verify discovery, sign-in, and name resolution.
Another DC does not automatically replicate DHCP leases, file data, every DNS zone, or transfer FSMO roles. Two VMs on one host also share that host’s failure risks. Remove DC2 through proper demotion with dependency checks, not VM deletion; keep both controllers for later exercises.
