Installing Active Directory Domain Services (AD DS) on Windows Server 2016

Overview

Active Directory Domain Services (AD DS) is the foundation of identity and access management in Windows Server environments. This guide walks through a complete greenfield deployment of AD DS on Windows Server 2016, including server preparation, role installation, forest promotion, and verification.

Windows Server 2016 AD DS Static IP DNS Group Policy DHCP

01 Configure Server — Preparation

Before installing AD DS, the server must be properly configured with a static IP address and a meaningful hostname. These are prerequisites for domain controller promotion.

1 Assign a Static IP Address

Navigate to Control Panel > Network and Sharing Center > Change adapter settings. Right-click the active network adapter, select Properties, then select Internet Protocol Version 4 (TCP/IPv4) and choose Use the following IP address.

Example Static IP Configuration

IP Address:     192.168.1.10
Subnet Mask:    255.255.255.0
Default Gateway: 192.168.1.1
Preferred DNS:  127.0.0.1

Using 127.0.0.1 as the preferred DNS server is standard practice — the AD DS installation will configure DNS automatically during promotion.

2 Rename the Server

Open System Properties (right-click This PC > Properties > Rename this PC). Change the computer name to a descriptive hostname that identifies the server's role.

System Properties — Computer Name

Computer name: DC01
Full computer name: DC01

A restart is required for the name change to take effect. After reboot, log back in to proceed with the AD DS installation.

02 Add Roles and Features

Using the Server Manager console, add the Active Directory Domain Services role. This installs the binaries required to make the server a domain controller.

3 Launch Add Roles and Features Wizard

Open Server Manager and click Add roles and features. The wizard guides you through the installation:

Installation Type: Role-based or feature-based installation
Server Selection: Select the local server from the server pool
Server Roles: Check Active Directory Domain Services

ⓘ

When you select AD DS, a dialog prompts you to Add Features required for AD DS (including Group Policy Management tools). Accept the defaults.

4 Complete the Installation

Proceed through the wizard, confirm the installation selections, and click Install. The installation progress is displayed in Server Manager. Once complete, you will see a notification indicating that configuration is required for AD DS — this is the promotion step covered next.

03 Promote to a Domain Controller

After the AD DS role is installed, the server must be promoted to a domain controller. For greenfield deployments, this means creating a new forest and root domain.

5 Add a New Forest

Click the Promote this server to a domain controller notification flag in Server Manager. In the Deployment Configuration screen, select Add a new forest and specify the root domain name.

Deployment Configuration

Deployment Operation: Add a new forest
Root Domain Name:     company.local

The domain name company.local is a commonly used example for lab/testing environments. In production, use a valid DNS domain name your organization owns.

6 Domain Controller Options

Configure the following:

Forest functional level: Windows Server 2016
Domain functional level: Windows Server 2016
DNS Server: Check this box (recommended)
Global Catalog (GC): Checked by default for the first DC
DSRM Password: Set a strong password (next step)

04 DSRM Password

Directory Services Restore Mode (DSRM) is a safe-mode boot option for repairing Active Directory. A dedicated password is required during the promotion process.

7 Configure DSRM Password

In the Domain Controller Options step, enter and confirm the DSRM password. This password must be stored securely — it is required for any future Active Directory recovery operations.

⚠

DSRM is not the same as the domain administrator password. If the DSRM password is lost, recovery tools or reinstallation may be required to regain access to Directory Services Restore Mode.

After configuring all options, the wizard performs a prerequisite check. Resolve any warnings (such as DNS delegation issues, which are expected in a new deployment) and click Install to begin the promotion. The server will automatically restart upon completion.

05 Restart and Verify

After the server reboots, log in with the domain administrator account to confirm the installation succeeded.

8 Verify with Active Directory Users and Computers

Open Server Manager > Tools > Active Directory Users and Computers. Verify that the domain structure is visible, including the default containers:

Builtin — default built-in security groups
Computers — computer objects in the domain
Domain Controllers — the DC01 server object
Users — default user accounts and groups

If the domain structure and the DC01 server appear in the Domain Controllers OU, the installation is successful.

9 Log in as Domain Administrator

The local administrator account is now a domain administrator. Use the format COMPANY\Administrator or [email protected] to log in with domain credentials. Open a command prompt and run:

whoami
echo %USERDOMAIN%

Both commands should return company\administrator and COMPANY respectively, confirming domain authentication is working.

Architecture Overview

The completed deployment establishes a domain controller that authenticates and authorizes all client computers joined to the domain.

Domain Controller & Client Topology

■

DC01 Domain Controller 192.168.1.10

SWITCH

●

Client 01

●

Client 02

●

Client 03

JOINED CLIENTS

The domain controller (DC01) authenticates client machines and provides centralized identity, policy, and resource management.

Post-Installation Configuration

After AD DS is verified, several supporting services should be configured for a fully functional domain environment.

DNS Configuration

AD DS automatically installs and configures DNS Server when selected during promotion. Verify that forward and reverse lookup zones are created for company.local. DNS is critical for domain-joined clients to locate domain controllers.

DHCP Role Installation

Install the DHCP Server role via Server Manager to automatically assign IP addresses to domain-joined clients. Configure a scope that matches your network subnet and authorize the DHCP server in Active Directory.

Scope:     192.168.1.100 - 192.168.1.200
Subnet:    255.255.255.0
DNS:       192.168.1.10
Gateway:   192.168.1.1

Group Policy Management

Use the Group Policy Management Console to create and link Group Policy Objects (GPOs). Common use cases include password policies, software deployment, drive mappings, and security settings applied to OUs containing users or computers.

ⓘ

Quick Tip: Organize your AD DS environment with Organizational Units (OUs) before deploying GPOs. A well-planned OU structure (e.g., by department or location) makes policy management significantly easier at scale.

AD DS Provided Services

Active Directory Domain Services enables several core capabilities that form the backbone of Windows-based enterprise identity management.

Core Services

Centralized User Management

Authentication & Authorization

Group Policy Management

Single Sign-On (SSO)

Resource Management

Certificate Services (AD CS)

Key Benefits of AD DS

Centralized Identity: User accounts, groups, and computers are managed from a single directory, eliminating the need for local accounts on each machine.
Policy-Based Administration: Group Policy provides granular control over user and computer configurations across the entire domain.
Scalability: Multiple domain controllers can be deployed across sites to provide redundancy and local authentication.
Interoperability: AD DS integrates with cloud services (Azure AD Connect), third-party identity providers, and LDAP-compliant applications.

Installing Active DirectoryDomain Services on Windows Server 2016