Intermediate Windows Server Course
Deploying a Windows Server Domain Controller
A domain controller provides centralised authentication, identity management and access control for computers and users within an organisation.
In this intermediate course, you will learn how to prepare a Windows Server installation, configure a static IP address, install Active Directory Domain Services and promote the server as a domain controller.
You will also learn how to create an Active Directory forest and domain, configure DNS, organise directory objects, join computers to the domain and apply Group Policy settings. By the end of the course, you will be able to deploy and manage a functional Windows Server domain environment.
Learning Outcomes
What you will be able to do after completing this course.
By the end of this course, you should be able to deploy, verify, secure, document and maintain a functional Active Directory domain.
- Explain the purpose of a Windows Server domain controller.
- Describe centralised identity and access management.
- Understand domains, forests, trees and organisational units.
- Identify hardware, software and network requirements.
- Install Windows Server on physical or virtual hardware.
- Rename the server using a clear naming convention.
- Configure static IPv4 and DNS settings.
- Apply Windows Server updates before role deployment.
- Install Active Directory Domain Services.
- Promote Windows Server to a domain controller.
- Create a new forest and root domain.
- Select an appropriate internal domain name.
- Configure the DSRM password securely.
- Understand the Active Directory database and SYSVOL.
- Verify the completed deployment.
- Confirm Active Directory and DNS services are running.
- Manage objects through Active Directory Users and Computers.
- Create organisational units.
- Create and manage domain users.
- Create role-based security groups.
- Distinguish security and distribution groups.
- Understand Domain Local, Global and Universal scopes.
- Reset passwords and unlock accounts.
- Join Windows computers to the domain.
- Verify domain authentication from joined computers.
- Configure DNS forwarders.
- Create forward and reverse lookup zones.
- Verify Active Directory DNS and SRV records.
- Create and link Group Policy Objects.
- Apply password, lockout and security policies.
- Deploy desktop, firewall and system settings.
- Use gpupdate and gpresult.
- Delegate selected administrative tasks.
- Use separate administrative and standard accounts.
- Review Active Directory events.
- Use dcdiag and nslookup.
- Troubleshoot domain join, DNS, authentication and Group Policy.
- Configure reliable time synchronisation.
- Back up the domain controller and system state.
- Understand secondary domain controllers and replication.
- Document the domain and administrative environment.
- Apply basic security and maintenance practices.
Course Roadmap
Follow the deployment sequence or select a lesson to review.
Understanding Active Directory and Domain Controllers
Learn how centralised identity and access management works.
Lesson objective:
Explain domains, forests, trees, organisational units and domain
controllers.
Domain Controller
Authenticates users and computers and stores directory data.
Domain
A logical boundary containing users, computers and policies.
Forest
The highest Active Directory structure containing one or more domains.
Core Directory Concepts
- Active Directory stores identity and configuration objects.
- Domain controllers provide authentication and directory services.
- DNS helps clients locate domain services.
- Organisational units organise objects and support delegation.
- Group Policy applies centralised configuration.
Active Directory relies heavily on correctly configured DNS. Domain
members should normally use internal DNS servers that host or resolve
the Active Directory namespace.
Practice Activity
- Define domain, forest, tree and organisational unit.
- Explain the role of a domain controller.
- Describe why DNS is required.
- List three services that benefit from centralised identity.
Planning the Domain Controller Deployment
Prepare hardware, network, naming and recovery requirements.
Lesson objective:
Define the resources and information required before installation.
Planning Checklist
- Supported Windows Server edition
- Physical server or virtual machine capacity
- Reliable storage and backup destination
- Static IP address and subnet information
- Default gateway and DNS design
- Server naming convention
- Active Directory domain name
- Administrative accounts and secure credential storage
- Time source
- Recovery and rollback plan
Example Naming Plan
Server name: CORP-DC01
AD DNS domain: ad.example.com
NetBIOS name: AD
IPv4 address: 10.20.0.10
Default gateway: 10.20.0.1
Preferred DNS: 10.20.0.10
Select the Active Directory domain name carefully. Renaming an
established forest is complex and should not be treated as a routine
change.
Planning Exercise
- Create a server naming standard.
- Select a domain name for the lab.
- Reserve a static IP address.
- Document hardware and backup requirements.
Installing Windows Server
Prepare a clean physical or virtual server installation.
Lesson objective:
Install Windows Server and complete the initial administrator setup.
- Create or attach official Windows Server installation media.
- Boot the physical server or virtual machine from the installer.
- Select the required edition and installation option.
- Choose the target storage device.
- Complete the installation.
- Set a strong local Administrator password.
- Sign in and confirm Server Manager opens correctly.
Initial Installation Checks
- Correct operating-system edition
- Expected disk capacity
- Network adapter detected
- Correct regional and keyboard settings
- Secure local Administrator password
- Virtual-machine integration tools where required
Confirm the target disk before installation. Formatting or replacing
the wrong volume can permanently erase data.
Installation Exercise
- Create a lab virtual machine.
- Install Windows Server.
- Set the local Administrator password.
- Confirm storage and network adapter detection.
Preparing the Server for Active Directory
Rename the server, configure networking and apply updates.
Lesson objective:
Complete all essential server preparation before installing AD DS.
Preparation Sequence
- Rename the server using the naming standard.
- Restart the server.
- Configure a static IP address.
- Set the subnet mask or prefix length.
- Set the default gateway.
- Configure the preferred DNS server.
- Apply Windows Server updates.
- Restart and verify the configuration.
PowerShell Examples
Rename-Computer -NewName "CORP-DC01" -Restart
Get-NetAdapter
Get-NetIPConfiguration
New-NetIPAddress `
-InterfaceAlias "Ethernet" `
-IPAddress 10.20.0.10 `
-PrefixLength 24 `
-DefaultGateway 10.20.0.1
Set-DnsClientServerAddress `
-InterfaceAlias "Ethernet" `
-ServerAddresses 10.20.0.10
Avoid relying on a changing DHCP address for a domain controller.
Directory clients and DNS records require stable network settings.
Preparation Exercise
- Rename the lab server.
- Assign a static IP address.
- Configure the intended DNS address.
- Install available updates.
- Verify the configuration after restart.
Installing Active Directory Domain Services
Add the server role and required management tools.
Lesson objective:
Install the AD DS role through Server Manager or PowerShell.
Server Manager Workflow
- Open Server Manager.
- Select Add Roles and Features.
- Choose role-based or feature-based installation.
- Select the local server.
- Select Active Directory Domain Services.
- Add the required management tools.
- Confirm and install the role.
PowerShell Example
Install-WindowsFeature `
-Name AD-Domain-Services `
-IncludeManagementTools
Installing the role does not automatically create a domain
controller. Promotion is a separate configuration step.
Role Installation Exercise
- Install AD DS.
- Confirm the management tools are included.
- Review Server Manager notifications.
- Do not promote the server until the next lesson.
Promoting the Server and Creating the Forest
Create the root domain and configure the DSRM password.
Lesson objective:
Promote the server as the first domain controller in a new forest.
- Open the post-deployment promotion task.
- Select Add a new forest.
- Enter the root domain name.
- Select supported forest and domain functional levels.
- Keep DNS Server and Global Catalog selected.
- Set a secure Directory Services Restore Mode password.
- Review the NetBIOS domain name.
- Review database, log and SYSVOL paths.
- Run prerequisite checks.
- Install and allow the server to restart.
Important Active Directory Storage
| Item | Purpose |
|---|---|
| NTDS Database | Stores Active Directory objects and attributes |
| Log Files | Support transactional consistency and recovery |
| SYSVOL | Stores Group Policy and domain logon-related files |
Store the DSRM password securely. It is used for directory recovery
scenarios and should not be shared casually.
Promotion Exercise
- Create a new forest in the lab.
- Use the planned domain name.
- Set a secure DSRM password.
- Complete prerequisite checks.
- Restart and sign in using the domain administrator account.
Verifying the Domain Controller Deployment
Confirm directory, DNS and domain-controller services.
Lesson objective:
Validate that the new forest, domain and required services are healthy.
Verification Checklist
- Sign in using the domain administrator account.
- Open Active Directory Users and Computers.
- Open DNS Manager.
- Confirm the domain DNS zone exists.
- Confirm SYSVOL and NETLOGON are shared.
- Confirm AD DS and DNS services are running.
- Review Server Manager health notifications.
- Review relevant Event Viewer logs.
Useful Commands
hostname
whoami
net share
Get-Service NTDS,DNS,Netlogon
Get-ADDomain
Get-ADForest
Correct small warning conditions before adding users and computers.
A clean baseline simplifies later troubleshooting.
Verification Exercise
- Confirm the domain and forest names.
- Verify SYSVOL and NETLOGON shares.
- Confirm AD DS and DNS services.
- Review the Directory Service and DNS Server event logs.
Designing Organisational Units
Organise users, computers and administration logically.
Lesson objective:
Create an OU structure that supports policy and delegated administration.
Example OU Structure
ad.example.com
├── Users
│ ├── Finance
│ ├── Human Resources
│ └── Operations
├── Computers
│ ├── Workstations
│ └── Laptops
├── Servers
├── Groups
└── AdminOU Design Principles
- Design OUs for management, policy and delegation.
- Avoid copying the organisation chart without a technical reason.
- Separate users, computers and servers where useful.
- Use clear and consistent names.
- Avoid excessive nesting.
- Enable accidental-deletion protection.
OU Exercise
- Create Users, Computers, Servers, Groups and Admin OUs.
- Create two department OUs.
- Enable accidental-deletion protection.
- Document the purpose of each OU.
Creating and Managing Domain User Accounts
Create identities and perform common account-support tasks.
Lesson objective:
Create users, reset passwords, unlock accounts and apply restrictions.
User-Creation Checklist
- Use the approved naming convention.
- Place the account in the correct OU.
- Set a secure initial password.
- Require a password change at first sign-in where appropriate.
- Set account expiration for temporary users.
- Record manager, department and contact attributes where required.
- Add the user to role-based groups.
Common Support Tasks
- Reset a forgotten password.
- Unlock a locked account.
- Disable an unused account.
- Move an account to another OU.
- Review group membership.
- Set logon-hour or workstation restrictions where required.
Disable departed-user accounts promptly and preserve data according to
the organisation's retention and access procedures.
User Exercise
- Create three test users.
- Place them in different department OUs.
- Reset one password.
- Lock and unlock one test account.
- Disable one account.
Using Groups for Role-Based Access
Apply security groups, distribution groups and appropriate scopes.
Lesson objective:
Create groups and assign access through role-based principles.
Security Group
Can be used to assign permissions and access rights.
Distribution Group
Used primarily for email distribution and not resource permissions.
| Scope | Typical Use |
|---|---|
| Global | Collect users or computers with the same organisational role |
| Domain Local | Assign permissions to resources within a domain |
| Universal | Support membership and access across multiple domains |
Role-Based Example
User accounts
↓
Global role group
↓
Domain Local resource group
↓
Folder, printer or application permissionGroup Exercise
- Create a Finance Users global group.
- Create a Finance Share Access domain-local group.
- Add the role group to the resource group.
- Add test users to the role group.
- Document the access design.
Joining Windows Computers to the Domain
Create computer accounts and verify domain authentication.
Lesson objective:
Configure client DNS, join the domain and test a domain-user sign-in.
Domain-Join Prerequisites
- Supported Windows edition
- Correct date and time
- Network connectivity to the domain controller
- Client DNS points to Active Directory DNS
- Valid domain-join credentials
- Unique computer name
Join Workflow
- Rename the computer according to the naming standard.
- Configure the internal DNS server.
- Verify the domain name resolves.
- Join the Active Directory domain.
- Restart the computer.
- Sign in using a domain user.
- Move the computer object to the correct OU.
Using only a public DNS resolver on a domain member can prevent the
computer from locating domain-controller service records.
Domain-Join Exercise
- Create a Windows client virtual machine.
- Configure internal DNS.
- Join the lab domain.
- Restart and sign in as a domain user.
- Move the computer into the Workstations OU.
Configuring and Verifying Active Directory DNS
Manage forwarders, zones and service-location records.
Lesson objective:
Configure reliable internal and external name resolution.
DNS Tasks
- Confirm the Active Directory-integrated forward zone exists.
- Confirm domain-controller host records exist.
- Verify service-location records under the domain.
- Create a reverse lookup zone where required.
- Configure DNS forwarders for external name resolution.
- Verify clients use internal DNS.
Verification Commands
nslookup ad.example.com
nslookup CORP-DC01.ad.example.com
nslookup -type=SRV _ldap._tcp.dc._msdcs.ad.example.com
ipconfig /registerdns
ipconfig /flushdns
Configure external resolution through DNS forwarders rather than
assigning public DNS servers directly to domain members.
DNS Exercise
- Review the forward lookup zone.
- Create a reverse lookup zone.
- Configure a forwarder.
- Verify domain SRV records.
- Test name resolution from a joined client.
Creating and Testing Group Policy
Apply centralised security and desktop configuration.
Lesson objective:
Create, link and verify Group Policy Objects.
Common Group Policy Uses
- Password and account-lockout policies
- Windows Firewall configuration
- Desktop and Start-menu settings
- Security options
- Mapped drives and printers
- Windows Update settings
- Application restrictions
- Audit settings
GPO Workflow
- Open Group Policy Management.
- Create a clearly named GPO.
- Edit the required settings.
- Link the GPO to the correct domain or OU.
- Review security filtering.
- Update policy on a test computer.
- Confirm the applied result.
Testing Commands
gpupdate /force
gpresult /r
gpresult /h C:\Temp\gpresult.html
Test new policies in a controlled OU before linking them broadly.
Incorrect settings can affect many users and computers.
Group Policy Exercise
- Create a workstation test OU.
- Create a basic security GPO.
- Link it to the test OU.
- Run gpupdate on a joined client.
- Verify the result with gpresult.
Delegating Administration Securely
Grant selected tasks without providing full domain control.
Lesson objective:
Delegate limited administration and separate privileged accounts.
Delegation Examples
- Reset passwords in a department OU.
- Create and manage users in a specific OU.
- Join computers to the domain.
- Manage selected group memberships.
- Manage workstation objects without server access.
Administrative Account Principles
- Use a standard account for email and routine work.
- Use a separate administrative account for privileged tasks.
- Do not browse the internet using highly privileged accounts.
- Use the least privilege required.
- Review delegated permissions regularly.
- Protect privileged accounts with stronger controls.
Domain Admin membership should be limited to accounts that genuinely
require forest-wide administrative control.
Delegation Exercise
- Create a Helpdesk security group.
- Delegate password-reset rights on one OU.
- Test the delegated account.
- Confirm it cannot administer other OUs.
Monitoring Domain Controller Health
Use Event Viewer, dcdiag and DNS tests.
Lesson objective:
Review important logs and run health-verification tools.
Important Event Logs
- Directory Service
- DNS Server
- System
- Security
- DFS Replication
- Group Policy operational logs
Health Commands
dcdiag
dcdiag /v
dcdiag /test:dns
nslookup ad.example.com
nltest /dsgetdc:ad.example.com
Get-Service NTDS,DNS,Netlogon
Record a healthy baseline after deployment. Later differences are
easier to recognise when expected results are documented.
Health-Check Exercise
- Run dcdiag.
- Run the DNS test.
- Review Directory Service and DNS logs.
- Document warnings and corrective actions.
Configuring Reliable Time Synchronisation
Maintain accurate time for Kerberos authentication and logging.
Lesson objective:
Understand the domain time hierarchy and verify synchronisation.
Time Hierarchy
- Domain members normally synchronise through the domain hierarchy.
- The PDC Emulator in the forest root domain is the authoritative domain time source.
- The PDC Emulator should use a reliable external or organisational time source.
- Large time differences can cause authentication failures.
Verification Commands
w32tm /query /status
w32tm /query /source
w32tm /query /configuration
w32tm /resync
Do not configure every domain member independently against unrelated
external time servers. Preserve the domain time hierarchy.
Time Exercise
- Identify the PDC Emulator.
- Check its current time source.
- Check the time source on a joined client.
- Verify the client follows the domain hierarchy.
Backing Up Active Directory and Adding Resilience
Protect the directory with system-state backup and replication.
Lesson objective:
Back up the domain controller and understand the role of additional DCs.
Backup Requirements
- System state backup
- Server configuration documentation
- Secure backup storage
- Regular backup schedule
- Restore testing
- Recovery credentials and procedures
Secondary Domain Controller Benefits
- Additional authentication availability
- Additional DNS availability
- Directory replication
- Reduced dependency on one server
- Support for branch or site designs
Replication Verification Examples
repadmin /replsummary
repadmin /showrepl
Get-ADDomainController -Filter *
A second domain controller does not replace backup. Replication can
also replicate unwanted deletions or configuration errors.
Resilience Exercise
- Install Windows Server Backup in the lab.
- Create a system-state backup.
- Document the restore procedure.
- Plan a secondary domain controller.
- Review replication commands.
Troubleshooting and Maintaining the Domain
Resolve common DNS, join, authentication and Group Policy problems.
Lesson objective:
Use a structured troubleshooting process and maintain the environment.
| Problem | First Checks |
|---|---|
| Domain join fails | DNS, time, credentials, network path and computer name |
| User cannot sign in | Password, lockout, account state, time and domain connectivity |
| GPO not applying | OU placement, link, filtering, inheritance and client logs |
| Domain name does not resolve | Client DNS, zone records, service state and forwarders |
| Slow sign-in | DNS, unavailable resources, scripts and Group Policy processing |
Structured Troubleshooting Sequence
- Define the exact error and affected users or devices.
- Check time and network connectivity.
- Verify client DNS settings.
- Test name and SRV-record resolution.
- Check account and computer-object state.
- Review relevant event logs.
- Run dcdiag, nslookup, gpresult or replication tools.
- Make one controlled change and test again.
Maintenance Checklist
- Apply tested Windows Server updates.
- Review backup success.
- Review privileged groups.
- Disable stale accounts.
- Review DNS and event logs.
- Verify domain-controller health.
- Update documentation.
Troubleshooting Exercise
- Configure an incorrect DNS address on a test client.
- Observe the domain-related failure.
- Use nslookup and nltest to diagnose it.
- Restore the correct DNS setting.
- Document the symptoms and solution.
Final Project: Deploy and Manage a Windows Server Domain
Apply the complete Active Directory deployment workflow.
Project objective:
Deploy, configure, test, secure and document a functional domain
environment in a lab or authorised network.
Project Requirements
- Create a deployment plan.
- Install Windows Server.
- Rename the server.
- Configure a static IP address.
- Configure internal DNS.
- Apply operating-system updates.
- Install Active Directory Domain Services.
- Create a new forest and root domain.
- Configure a secure DSRM password.
- Verify AD DS, DNS, SYSVOL and NETLOGON.
- Create a logical OU structure.
- Create users and groups.
- Apply role-based group membership.
- Join at least one Windows client.
- Verify domain-user authentication.
- Configure DNS forwarders.
- Verify SRV records.
- Create and link a test GPO.
- Verify the GPO with gpresult.
- Delegate one limited administrative task.
- Verify time synchronisation.
- Run dcdiag and DNS tests.
- Create a system-state backup.
- Document the entire environment.
Recommended Project Workflow
- Plan
- Install
- Configure
- Promote
- Organise
- Join
- Apply Policy
- Verify
Final Verification Checklist
- The server uses a static IP address.
- The domain and forest names match the plan.
- AD DS and DNS services are running.
- SYSVOL and NETLOGON are shared.
- DNS forward and reverse lookup operate correctly.
- SRV records resolve.
- Users and groups are organised correctly.
- The joined client authenticates domain users.
- The test GPO applies successfully.
- Delegated permissions work only in the intended scope.
- Time synchronisation is correct.
- dcdiag completes without unresolved critical errors.
- A current system-state backup exists.
- Documentation matches the deployed environment.
Perform the final project in a lab, staging environment or authorised
production change window with current backups and a rollback plan.
Congratulations!
You have completed Deploying a Windows Server Domain Controller.
You can now prepare Windows Server, install Active Directory Domain Services, create a forest and domain, configure DNS, organise directory objects, join computers, apply Group Policy and verify domain-controller health.
18 Lessons
Completed
Active Directory Domain
Deployed
100% Progress
Course Completed
Continue maintaining the environment through updates, health checks, tested backups, privileged-access reviews and accurate documentation.
