I am setting up the IT for a small office from scratch and need a proper Windows domain so I can manage user logins and group policy centrally. I have a fresh Windows Server box ready. How do I turn it into a domain controller? I keep seeing people mention dcpromo but it does not seem to exist on my server. What is the correct current process, and is there anything I should get right before I start so I do not have to redo it?
How to Set Up a New Active Directory Domain Controller on Windows Server
Resolved
Data Recovery
CM
Community Member August 08, 2026
6 replies
1,214 views
Reviewed by moderators
6 Answers
You are right that dcpromo is gone, it was deprecated in Windows Server 2012. The modern process replaces it with the AD DS role plus the Active Directory Domain Services Configuration Wizard in Server Manager. At a high level it is three stages: prepare the server, install the AD DS role, then promote the server to a domain controller. A domain controller is simply a server running the AD DS role, it is what authenticates and authorizes every user and computer in your domain and enforces group policy.
Since you are building the very first domain in a brand new office, you will create a new forest during promotion rather than joining an existing domain.
Stage 1, prepare the server (do this first, it matters).
Set a static IP address, the DC should never use DHCP. Set a meaningful hostname now, for example DC01, because renaming a server after promotion is painful and can break replication. Apply Windows updates and reboot. For the very first DC keep the server in a workgroup, you do not join it to a domain first because there is no domain yet, the promotion creates it.
Stage 2, install the AD DS role.
Open Server Manager, choose Manage, then Add Roles and Features. Pick Role-based or feature-based installation, select your server from the pool, then on the Server Roles page tick Active Directory Domain Services. When it prompts to add the required features, accept them, click through and Install. Installing the role does not make the server a DC yet, it just lays down the files. Do not restart looking for a domain, the promotion is the next step.
Stage 3, promote to a domain controller.
After the role installs, click the yellow notification flag in Server Manager and choose Promote this server to a domain controller. In the wizard select Add a new forest and enter your root domain name, something like corp.yourcompany.com. Set the forest and domain functional levels, leave the DNS server option checked (the first DC normally runs DNS), and set a Directory Services Restore Mode (DSRM) password, store it somewhere safe, you need it for AD recovery. Click through the prerequisite check and Install. The server restarts automatically and comes up as your first domain controller.
If you prefer PowerShell, the whole promotion for a new forest is one cmdlet after the role is installed:
Install-ADDSForest -DomainName "corp.yourcompany.com" -DomainNetbiosName "CORP" -InstallDns:$true
It will prompt for the DSRM password and then reboot. This is the route to use if you will build DCs repeatedly, because you can document and reuse it.
After it reboots, log in with the domain admin account (CORP\Administrator) and confirm everything is healthy before you rely on it:
Get-Service adws,kdc,netlogon,dns | Format-Table Name,Status to check the core AD services are running, and Get-ADDomainController to confirm the DC registered. Also verify DNS resolves and that clients point their DNS to this server's IP, not to a router or public resolver, that single setting is the most common reason a new domain "does not work" after setup.