Logo lbcyberdefense
Back to All Lab Write-ups
ACTIVE DIRECTORY & IDENTITY MANAGEMENT

Windows Server Domain Controller Setup Guide

Deploy Active Directory Domain Services, configure DNS, build organizational unit structures, and join Windows clients to your domain for enterprise lab environments.

HomeLab Knowledge Base 8 min read Active Directory, Windows Server, AD DS, DNS, Domain

This guide walks through deploying a Windows Server Domain Controller in your Proxmox lab environment. You'll learn how to set up Active Directory Domain Services (AD DS), build organizational units, and join client machines to your domain.

Phase 1: Windows Server Preparation & AD DS Role

Before installing Active Directory Domain Services (AD DS), your server must be properly prepared with a static IP and appropriate configuration.

Step 1: Set a Static IP

Your Domain Controller (DC) must have a consistent IP address that does not change.

  1. Open Network Connections on your Windows Server VM.
  2. Right-click your network adapter → Properties → IPv4.
  3. Assign a static IP (e.g., 192.168.1.10).
  4. CRUCIAL: Set the Preferred DNS server to 127.0.0.1 (the machine itself). This ensures the DC queries itself for DNS resolution.
Static IP Configuration
Figure 1: Setting a static IP address on the Domain Controller
DNS Configuration
Figure 2: Configuring DNS to point to localhost (127.0.0.1)

Step 2: Rename the Server

Give your server a clear, descriptive name such as DC01 via System Properties, then reboot.

Step 3: Install AD DS Role

  1. Open Server Manager → Manage → Add Roles and Features.
  2. Select Active Directory Domain Services and proceed with the installation.
  3. Complete the wizard and let the server install the necessary binaries.
Add Roles and Features Wizard
Figure 3: Server Manager Add Roles and Features Wizard
Select AD DS Role
Figure 4: Selecting Active Directory Domain Services role

Step 4: Promote to Domain Controller

After AD DS installation, a notification flag will appear in Server Manager.

  1. Click the notification flag icon in Server Manager.
  2. Select Promote this server to a domain controller.
  3. Select Add a new forest.
  4. Enter your Root domain name (e.g., lab.local).
  5. Set a strong Directory Services Restore Mode (DSRM) password and store it securely.
  6. Follow the wizard with default settings and allow the server to restart.
Promote to Domain Controller
Figure 5: Promotion dialog for Domain Controller
Domain Configuration
Figure 6: Domain forest and DNS configuration

Phase 2: Building the OU Structure

Organizational Units (OUs) are your "filing cabinets" for organizing users, computers, and servers. They allow you to apply specific Group Policy Objects (GPOs) to different departments or device types.

Create the OU Hierarchy

  1. Open Active Directory Users and Computers (ADUC): Press Win + R, type dsa.msc, and press Enter.
  2. Right-click your domain (e.g., lab.local) → New → Organizational Unit.
  3. Create the following structure:
    • _Admin (Use an underscore to force it to the top)
    • Users (With sub-OUs for departments like IT, HR, NYC)
    • Workstations (With sub-OUs for locations like NYC)
    • Servers

Create a Test User

  1. Right-click your Users → IT OU → New → User.
  2. Follow the wizard to create a test account (e.g., jdoe) and set an initial password.
OU Structure
Figure 7: Completed OU structure in Active Directory Users and Computers

Phase 3: Joining a Client Machine

Now that your Domain Controller is operational, you can join Windows 10 or Windows 11 client machines to your domain.

Configure the Client

  1. Network Configuration: Ensure the client VM's network adapter is on the same virtual bridge (e.g., vmbr1) as your DC.
  2. DNS Configuration: Set the client's Preferred DNS to the IP address of your DC (e.g., 192.168.1.10). This is the most common point of failure—the client must be able to resolve your domain name.

Join the Domain

  1. On the client machine, right-click This PC → Properties → Advanced system settings.
  2. Go to the Computer Name tab → Change.
  3. Select Domain and type your domain name (e.g., lab.local) → OK.
  4. When prompted, enter your Domain Administrator credentials (the Administrator account on your DC).
  5. Restart the client machine.
  6. You can now log in using domain credentials: LAB\jdoe.
Domain Join Dialog
Figure 8: Windows client joining the domain

Troubleshooting: DNS Delegation Issue

When promoting your server to a Domain Controller, you may encounter a "DNS delegation" warning. This is very common in isolated lab environments.

Why This Happens

The error occurs because the DNS server cannot create a "delegation" in the parent DNS zone. Since your lab domain (lab.local) is isolated inside Proxmox and not registered with a public registrar, there is no "parent zone" to delegate to.

How to Proceed

You can safely ignore this warning. Simply click Next in the promotion wizard. Your Active Directory will function perfectly for your internal lab.

Once promotion completes, verify your DNS health:

  1. Open Server Manager → Tools → DNS.
  2. Expand your server name → Forward Lookup Zones.
  3. Ensure your domain (e.g., lab.local) is listed with _msdcs, _sites, _tcp, and _udp folders. These are automatically created and are critical for AD functionality.
Proxmox Lab Tip: If clients cannot find the domain later, verify that the Network Bridge in your Proxmox VM settings is correct so the DC and client machines can communicate on the same virtual subnet. Also ensure the client's DNS setting points only to your DC's IP.

Next Steps

Once your domain is operational, you can:

  • Configure Group Policy Objects (GPOs) for security baselines.
  • Create user accounts and security groups for role-based access control.
  • Join additional workstations and servers to the domain.
  • Configure domain-wide security policies and audit logging.
All Articles Next Lab: Group Policy Setup