Configuring Active Directory on Three Computers: DC, Comp, and IIS

Setting up a functional Active Directory environment requires coordinating three distinct roles: a Domain Controller for authentication, a client computer for domain joining, and an IIS server for web services. This guide details the step-by-step configuration of these components to create a secure, integrated network infrastructure.

Preparing the Virtual Environment

Before installing any software, you must establish a stable virtualization layer. Using Hyper-V or VMware Workstation, create three separate virtual machines (VMs). Assign unique static IP addresses to each VM to prevent DHCP conflicts during the setup process. For example, set the Domain Controller (DC) to 192.168.1.10, the Client Computer (Comp) to 192.168.1.20, and the IIS Server to 192.168.1.30. Ensure all VMs share the same virtual switch so they can communicate via internal networking. Disable firewalls temporarily on all machines if they block local traffic, but remember to re-enable them with appropriate rules once the configuration is complete.

Configuring the Domain Controller

The Domain Controller is the heart of your Active Directory structure. Install Windows Server on the first VM and promote it to a Primary Domain Controller using the "Active Directory Domain Services" role. During promotion, create a new forest with a root domain name such as corp.local. Set a strong password for the Administrator account, as this credential will be used across all subsequent configurations. After the reboot, verify that the DNS service is running correctly, as Active Directory relies heavily on DNS for locating resources. You can test this by pinging the domain name from the DC itself. If the ping resolves to the DC's IP address, your DNS foundation is solid.

Joining the Client Computer to the Domain

Now, configure the second VM, which acts as the standard user workstation. Install the client version of Windows, such as Windows 10 or 11 Enterprise. Navigate to System Properties and change the computer name settings. Instead of workinggroup, select "Domain" and enter the root domain name created earlier (corp.local). When prompted, provide the Administrator credentials from the Domain Controller. The system will contact the DC, validate the credentials, and join the domain. A successful join requires a restart. After rebooting, log in using a domain account (e.g., CORP\Administrator) to confirm that Group Policy Objects are applied correctly. This step ensures that users are authenticated centrally rather than locally.

Installing and Configuring IIS

The third VM hosts Internet Information Services. Install Windows Server on this machine and add the "Web Server (IIS)" role through Server Manager. By default, IIS listens on port 80. To integrate this server into the domain, you must first join it to the domain just like the client computer. Once joined, configure the Default Web Site to use HTTPS for security. This involves generating a self-signed certificate or importing a private key SSL cert to ensure encrypted communications. For detailed instructions on securing your web server, refer to our guide on Adding Private key SSL Cert to IIS. Additionally, ensure that the IIS server can resolve domain names by pointing its primary DNS adapter to the Domain Controller's IP address.

Testing Connectivity and Security

With all three components configured, perform end-to-end testing. From the Client Computer, open a browser and navigate to the IIS server's IP address or hostname. Verify that the website loads correctly. Next, test authentication by accessing shared folders on the Domain Controller from the Client Computer. Use the net user command in the command prompt to check current session information. If you encounter issues reaching the website after updates, review our troubleshooting steps for Troubleshooting: Unable to Reach Website After Downloading File During Windows Server Upgrade. Ensure that Windows Firewall allows inbound traffic on ports 80, 443, and 389 (LDAP) across all machines. Properly configured ACLs on shared folders should restrict access to only authorized domain groups.

Frequently Asked Questions

What happens if the Domain Controller goes offline?

Client computers that have already logged in can still access cached credentials for a short period. However, new login attempts will fail, and group policy updates will not occur. It is crucial to maintain high availability by configuring a secondary Domain Controller in production environments.

Can I use a dynamic IP address for the Domain Controller?

No, Active Directory requires static IP addresses for all critical servers. Dynamic IPs can cause DNS registration failures, leading to authentication errors and service disruptions. Always assign a static IP in the network adapter settings.

How do I reset the Administrator password if I forget it?

If you have physical or console access to the Domain Controller, you can boot into Safe Mode to reset the local administrator password. For domain accounts, you may need to use emergency backup media or another admin account to perform a reset. Regularly document recovery procedures to avoid lockouts.

Why can't the IIS server see the Domain Controller?

This is usually a DNS resolution issue. Ensure the IIS server's primary DNS setting points to the Domain Controller. Check that both machines are on the same subnet and that no firewall rules are blocking LDAP (port 389) or Global Catalog (port 3268) traffic.

Is it safe to use a self-signed certificate for internal IIS sites?

For internal development or testing, self-signed certificates are acceptable. However, they will trigger browser warnings because they are not trusted by default. In production, always use certificates issued by an internal Enterprise CA or a public Certificate Authority to ensure seamless trust.