Windows

Set up Active Directory and DNS on Windows Server 2025

BM BizMaC Team Aug 18, 2026 10 min read

Setting up Active Directory Domain Services (AD DS) and DNS on Windows Server 2025 is the first thing you do when you want centralized authentication, Group Policy, and name resolution for a fleet of Windows machines. The role is installed, the server is promoted to a domain controller, and DNS zones are created automatically during promotion. This guide walks through the whole flow on a fresh Windows Server 2025 instance with a fixed IPv4 address, and it uses PowerShell wherever it is faster than clicking through Server Manager.

  • Key takeaways:
  • AD DS and DNS are installed together: promoting the first domain controller creates the DNS zones for your domain automatically.
  • Set a static IP and a reliable DNS pointer before you promote, a dynamic address breaks both AD and DNS replication.
  • Use Install-WindowsFeature AD-Domain-Services and Install-ADDSForest to automate what Server Manager does by hand.
  • After promotion, verify with Get-ADDomainController and Get-DnsServerZone before you join any clients.

Prerequisites

Before you begin, you need a few things in place. This post assumes you are working on a Windows VPS or a dedicated box running the full Desktop Experience or Server Core edition of Windows Server 2025.

  • A clean install of Windows Server 2025 with the latest cumulative updates applied.
  • Administrator access, either via the console, RDP, or PowerShell Remoting.
  • A static IPv4 address for the server. This is critical, AD DS and DNS will not behave on DHCP-assigned addresses.
  • A DNS server that can resolve your future domain name, or the willingness to point the server at itself after promotion.
  • The server name should not be the default random hostname. Rename it to something like DC01 before promoting.

If you are renting infrastructure, note that a Linux VPS uses SSH while a Windows VPS gives you RDP access to the full desktop. Everything in this guide is done from within Windows, so the Windows flavor is what you want here.

Why Active Directory needs DNS on the same server

Active Directory is not a database that runs on its own. It depends on DNS to locate domain controllers, to find the Global Catalog, and to let clients resolve the _ldap, _kerberos, and _gc SRV records that point to your services. When you promote the first domain controller in a forest, the DNS Server role is installed automatically if it is not already present, and the domain's forward lookup zone is created during the promotion process.

You can technically run AD without hosting DNS on the same box, but it is the wrong call for a single-domain environment. Keeping DNS on the domain controller is the default, it is what Microsoft recommends, and it simplifies replication and troubleshooting. If DNS breaks, so does authentication city-wide. The most common cause of a "domain controller cannot be contacted" error is a DNS misconfiguration, not a broken AD database.

For 2026 the DNS role on Windows Server 2025 also supports DNS over HTTPS (DoH) for the resolver side, but that is a separate feature you enable after the domain is up. Do not turn it on during initial configuration.

Step 1 - Set a static IP and rename the server

Open a PowerShell prompt as Administrator and set a static IPv4 address on the primary network adapter. The exact interface name varies, so list the adapters first.

Get-NetIPConfiguration

Note the InterfaceAlias and the current IPv4Address. Now assign a static address. Use your own subnet, gateway, and preferred DNS. In this example the server gets 10.0.0.10, and since we will host DNS locally, we point DNS at the loopback for now.

New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 10.0.0.10 -PrefixLength 24 -DefaultGateway 10.0.0.1
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses 127.0.0.1

Rename the machine to something meaningful. A domain controller called WIN-XXXX is confusing in logs and in DNS.

Rename-Computer -NewName "DC01" -Restart

Verify: after the restart, confirm the address and the name stuck.

Get-NetIPAddress -AddressFamily IPv4 | Where-Object {$_.InterfaceAlias -eq "Ethernet"}
hostname

Expected output: the static IP you assigned, and DC01 as the hostname. If you skipped the static IP step and only renamed the box, go back. A DHCP address will break AD DS promotion later with an obscure error.

Step 2 - Install the Active Directory Domain Services role

Install the AD DS role along with the DNS Server role. You can let the AD DS installer pull DNS in as a dependency during promotion, but installing both up front is cleaner and gives you visibility into what is going on.

Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
Install-WindowsFeature DNS -IncludeManagementTools

If you are on Server Core with no GUI, drop the -IncludeManagementTools flag. The RSAT tools only matter on the Desktop Experience edition.

Verify: confirm the install succeeded and the roles are staged, not yet configured.

Get-WindowsFeature AD-Domain-Services, DNS | Select-Object Name, InstallState

Expected output: Installed for both roles. If the state is Available, the installation failed, check the error with Get-WindowsFeature | Where-Object {$_.InstallState -eq "Failed"}.

Step 3 - Promote the server to a domain controller

With the roles present, promote the server. For a brand-new forest, use Install-ADDSForest. The -SafeModeAdministratorPassword is the Directory Services Restore Mode (DSRM) password, not the Administrator password. Keep it in a password manager, you need it to restore AD from backup.

$dsrmPass = ConvertTo-SecureString "Your-DSRM-Password-2026" -AsPlainText -Force
Install-ADDSForest `
  -DomainName "corp.example.com" `
  -DomainNetbiosName "CORP" `
  -ForestMode "WinThreshold" `
  -DomainMode "WinThreshold" `
  -InstallDns:$true `
  -SafeModeAdministratorPassword $dsrmPass `
  -Force:$true

Replace corp.example.com with a domain you actually control, or a subdomain like ad.yourcompany.com. Do not use a single-label name like corp.local, single-label DNS names cause certificate and discovery problems down the line. The server reboots automatically when promotion finishes.

Verify: after the restart, log back in and confirm the server is a domain controller.

Get-ADDomainController -Filter * | Select-Object Name, Domain, IPv4Address
nltest /dsgetdc:corp.example.com

Expected output: the first command lists DC01 with your domain; nltest responds with the DC name and IP. If nltest errors with DNS in the message, your DNS zones did not create correctly, which is exactly what the next section fixes.

Step 4 - Verify and configure DNS zones

Promotion creates the forward and reverse lookup zones for your domain. Check them with the DNS server cmdlets.

Get-DnsServerZone | Select-Object ZoneName, ZoneType, IsDsIntegrated
Get-DnsServerResourceRecord -ZoneName "corp.example.com" -RRType SOA

Expected output: the zone list includes corp.example.com (Primary, DS-integrated) and the _msdcs forest zone. The SOA record shows dc01.corp.example.com as the primary server. If you see the zone but no SOA, the zone failed to initialize, delete it and re-create the forward zone manually, or re-run Install-ADDSForest on a clean box.

Now confirm the SRV records for Kerberos and LDAP exist. These are the records every client needs to find the domain.

Get-DnsServerResourceRecord -ZoneName "corp.example.com" -RRType SRV | Where-Object {$_.HostName -like "_ldap*" -or $_.HostName -like "_kerberos*"}

Expected output: at least _ldap._tcp and _kerberos._tcp records pointing to dc01.corp.example.com. Missing SRV records mean clients will fail to join the domain, even though DNS resolves the hostname fine.

Finally, set the forwarder for external name resolution. Without a forwarder, the DC resolves internal zones but fails on public names, which breaks nslookup google.com and software updates on joined clients.

Set-DnsServerForwarder -IPAddress 8.8.8.8, 1.1.1.1
Get-DnsServerForwarder

Step 5 - Point the server at itself and test name resolution

The server should use its own DNS service for all lookups. With the static IP set earlier to 127.0.0.1, replace that with the actual server IP so that replication partners can reach it too.

Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses 10.0.0.10
ipconfig /all | findstr /i "DNS Servers"

Expected output: the DNS Servers line shows 10.0.0.10. Now run a batch of lookups to confirm AD and public resolution both work.

nslookup dc01.corp.example.com
nslookup -type=SRV _ldap._tcp.corp.example.com
nslookup google.com

Expected output: the first two resolve internally, the last one returns a public IP from the forwarder. Any failure here means clients will not be able to authenticate, fix DNS before proceeding. A missing _ldap SRV record usually points to a broken _msdcs zone, not a missing host record.

Troubleshooting common failures

Three failures show up constantly during this setup. Here is what they look like and how to fix them.

The DSRM password does not meet complexity requirements

Install-ADDSForest rejects weak passwords silently until you get an error that just says the password does not meet policy. Use a password with upper, lower, digit, and a symbol, and at least 14 characters. The same policy applies to the built-in Administrator account, so you will hit this during promotion before you even get to DSRM.

Active Directory cannot be reached after joining clients

Clients fail to join with domain controller not found. This is almost always DNS, the client cannot resolve the SRV records. On the client, run nslookup -type=SRV _ldap._tcp.corp.example.com. If it returns nothing, check the _msdcs zone on the DC, it holds the SRV records. Recreating the zone is rarely needed, usually the issue is the client is pointed at a public DNS server, not your DC.

DNS resolves the host but not the domain

An A record for dc01 exists, but nslookup corp.example.com times out. The SOA record is missing or the zone has no records. Open an elevated PowerShell and force a zone reload.

Restart-Service DNS
Get-DnsServerZone corp.example.com

If the zone is still empty, delete and recreate it, then force AD to rewrite the records.

Remove-DnsServerZone -Name "corp.example.com" -Force
Add-DnsServerPrimaryZone -Name "corp.example.com" -ReplicationScope "Domain"
Get-ADDomainController -Filter * | ForEach-Object { Invoke-Command -ComputerName $_.HostName -ScriptBlock { Restart-Service NetLogon } }

Netlogon re-registers all the SRV records on restart. Give it a minute, then re-check the zone contents.

FAQ

Should I install DNS before or with Active Directory?

With it. The AD DS promotion wizard installs DNS as a dependency, and installing DNS separately beforehand adds no benefit. The -InstallDns:$true flag in Install-ADDSForest covers both roles in one step.

Can I configure Active Directory on Windows Server 2025 Server Core?

Yes, and it works well. All the commands in this guide run on Server Core. Skip -IncludeManagementTools and manage the server remotely with RSAT from a Windows 11 workstation.

Do I need a separate DNS server for Active Directory?

No. For a single-domain forest, hosting DNS on the domain controller is the recommended and simplest setup. A separate DNS server only adds complexity when you have multiple sites or a massive domain.

Can I use a .local domain instead of a real domain?

Avoid it. Single-label and .local names break certificate issuance, federation, and some cloud integrations. Use a subdomain of a domain you own, like ad.corp.example.com.

How long does it take to promote a domain controller?

Five to ten minutes on typical server hardware. The slowest part is the reboot and the replication initialization when you add a second domain controller later. On a modern Windows VPS with NVMe storage, promotion completes faster than on spinning disks.

Related articles

Windows Server 2025 域控与 DNS 配置要点

本文介绍了在 Windows Server 2025 上安装 Active Directory 域服务并提升为域控制器的完整流程。关键步骤包括设置静态 IP、安装 AD DS 与 DNS 角色、使用 Install-ADDSForest 创建新林，以及验证 DNS 区域和 SRV 记录。生产环境中应避免使用 .local 单标签域名，建议使用你拥有域名的子域。配置完成后，用 nslookup 和 Get-ADDomainController 验证客户端能找到域控，这是排错的基础。若租用越南 Windows VPS，需确保至少 4GB 内存，2GB 对域控和 DNS 来说明显不足。

Note: This guide is for general reference. Every system and infrastructure has its own specifics, so test each step in a safe environment and consult a qualified engineer before applying it in production.