Windows Server 2025 / How to Create the First AD Domain and Forest
To create the first Windows Server 2025 domain, install AD DS and promote the server as the first controller of a new forest. This isolated exercise builds ad.example.test on DC1; do not apply the new-forest choices to an existing organization.
Verify the new-forest prerequisites
| Setting | Lab value |
|---|---|
| Server | DC1, Windows Server 2025 |
| Address | 172.24.50.10/24 on the isolated network |
| DNS domain | ad.example.test |
| NetBIOS domain | AD |
| Existing practice zone | lab.example.test, kept separate |
Confirm name, static IP, updates, and time. Where DC1 already runs DNS, verify its working local DNS address .10. A new server without DNS can install it during promotion; inspect the resulting settings afterward.
Securely store a unique Directory Services Restore Mode (DSRM) password, distinct in purpose from ordinary sign-in credentials. Keep it out of plaintext scripts and screenshots. Domain creation establishes the lab’s authentication foundation, so namespace and recovery decisions come first.
Install AD DS and begin promotion
- In Server Manager, add roles and features on DC1.
- Install Active Directory Domain Services and the required tools.
- Use the post-installation notification to promote the server.
- Select Add a new forest and enter ad.example.test.
Role binaries and promotion are separate stages. Follow Microsoft’s AD DS deployment guide. A second controller for this domain must join the existing domain rather than create another forest.
Review levels, DNS, and recovery settings
- Review domain and forest functional levels. This new lab can use the 2025 levels when all planned controllers meet their requirements.
- Confirm DNS and global catalog settings for a writable controller.
- Supply the unique DSRM password.
- Evaluate a DNS delegation warning against the actual parent zone; this isolated example has no managed external parent DNS.
- Check NetBIOS name AD and the database, log, and SYSVOL paths.
- Run prerequisites, resolve real errors, and install while retaining console access for the restart.
Functional levels govern AD capabilities and controller requirements, not the client OS version. Check functional-level guidance separately before adding 2025 controllers to an existing forest. Do not raise operational levels just to copy a lab.
The following PowerShell alternative installs a new forest and prompts as required. Do not repeat it after GUI promotion. Review the resulting functional levels rather than assuming unspecified defaults:
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools Install-ADDSForest -DomainName 'ad.example.test' -DomainNetbiosName 'AD' -InstallDns
Verify domain services after restart
Sign in at the console with the intended domain administrator, such as AD\Administrator. Run these on DC1:
whoami Get-ADDomain | Select-Object DNSRoot,NetBIOSName,DomainMode Get-ADForest | Select-Object RootDomain,ForestMode Get-DnsServerZone Resolve-DnsName '_ldap._tcp.dc._msdcs.ad.example.test' -Type SRV -Server 172.24.50.10 Get-SmbShare -Name SYSVOL,NETLOGON dcdiag /test:dns
Confirm the domain and functional levels, DC1 in the service-record answer, SYSVOL and NETLOGON shares, and DNS diagnostics. Distinguish brief initial processing from persistent errors and record actual events. An existing practice DNS zone alone does not prove AD deployment.
Update the earlier DHCP lab for the domain
If DC1 already provides DHCP, check AD authorization. Follow DHCP authorization guidance and add authorization only when needed, not as a duplicate:
Get-DhcpServerInDC Add-DhcpServerInDC -DnsName 'dc1.ad.example.test' -IPAddress 172.24.50.10 Set-DhcpServerv4OptionValue -ScopeId 172.24.50.0 -DnsServer 172.24.50.10 -DnsDomain 'ad.example.test'
Apply the scope option command only when that scope exists. Renew CLIENT1 at its console and verify DNS .10 and suffix ad.example.test. A suffix is not domain membership.
Do not undo promotion by deleting the VM or removing role files first. Assess whether it is the last DC and which accounts, DNS, DHCP, and clients depend on it. Demotion and recovery need a separate plan; keep this domain for the following labs.
