# AD DS first domain on Windows Server 2025: a lab you can rebuild

> Promote a Windows Server 2025 Evaluation VM to a first forest/domain controller with static IP, DNS, DSRM and verification — snapshotted, not production.

**Tested on**

- Build: 26100.33650
- Edition: Standard / Datacenter (Evaluation)
- Architecture: x64
- Evidence: E1
- Verified: 2026-10-28

## The short answer

A first lab domain is four decisions:

1. **A name** you will not regret (`lab.internal`, not `LAB` or a public domain you do not own).
2. **A static IP** and correct DNS.
3. **A DSRM password** stored outside the VM.
4. **A snapshot before promotion**, so you can rebuild without reinstalling.

Then install AD DS, promote a new forest, reboot, and verify DNS/SYSVOL/ replication. Do not join clients until those checks pass.

## Before promotion

| Check | Value |
|---|---|
| Computer name | `dc1` (rename before promotion) |
| IP | Static, e.g. `10.10.10.10/24` |
| DNS | `127.0.0.1` only after DNS is installed; no public DNS on the DC |
| Time | Correct time zone; sync to a reliable source |
| Domain name | `lab.internal` (single-label names are a bad habit) |
| DSRM password | In a password manager, not a desktop note |
| Snapshot | `srv2025-pre-ad` |

```powershell
Rename-Computer -NewName dc1 -Restart
Get-NetIPAddress -AddressFamily IPv4
```

## Install and promote

```powershell
Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
Install-ADDSForest `
  -DomainName 'lab.internal' `
  -DomainNetbiosName 'LAB' `
  -InstallDns `
  -ForestMode 'Win2025' `
  -DomainMode 'Win2025'
```

The cmdlet asks for a DSRM password and reboots. `Win2025` functional levels are fine for a new lab forest; lower levels only if you are intentionally mixing older DCs.

## Verify before adding clients

```powershell
Get-Service NTDS,DNS,Netlogon,SYSVOL
dcdiag /test:dns /v
nltest /dsgetdc:lab.internal
Get-SmbShare SYSVOL,NETLOGON
```

Expected:

- `NTDS`, `DNS`, `Netlogon` running;
- SYSVOL/NETLOGON shares present;
- `dcdiag` DNS tests pass;
- the DC locator finds `dc1`.

Then set DNS forwarders on the DC (do not use the router as the DC’s only forwarder if it cannot resolve external names reliably). Test with `Resolve-DnsName microsoft.com`.

> **Caution: Snapshot before promotion, not after**
>
> Promotion changes the AD database, SYSVOL and DNS. A pre-promotion snapshot is the clean rollback point. A snapshot of a running DC is not a supported backup.

## Join a client

1. Set the client’s DNS to the DC only.
2. Join `lab.internal`, reboot.
3. Log in with a domain account.
4. Verify `whoami /fqdn`, `nltest /sc_query:lab.internal`.

If join fails, check DNS first: a client that cannot resolve the SRV records will never find the domain.

## Lab boundaries

- One DC is a lab, not a highly available domain.
- No public domain name, no production CA, no external federation.
- Rebuild from `srv2025-clean` + this page instead of “repairing” a broken lab.
- Evaluation expiry applies; record it.

## Sources

- [Microsoft Learn — AD DS overview](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dc/active-directory-domain-services-overview)
- [Microsoft Learn — Install a new forest](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/ad-ds-deployment)

---

Source: https://windows.homes/en/server/roles/ad-ds/