Establishing an Active Directory domain in Hyper-V requires configuring a virtual external switch to bridge VMs with the physical network. You must create the switch, assign static IPs to your Domain Controller and File Server, promote the DC, and use System Properties—not sysprep—to join the workstation. This setup ensures proper DNS resolution and network connectivity for all three initial machines.
Creating the External Virtual Switch
The foundation of your domain infrastructure is a virtual switch that allows your virtual machines to communicate with each other and the outside world. In Hyper-V Manager, navigate to Virtual Switch Manager on the right-hand panel. Select New virtual network switch and choose External. This type of switch binds directly to a physical network adapter on your host machine, enabling NAT or bridged networking depending on your router configuration.
Name the switch something identifiable, such as DomainSwitch. Ensure you check the box labeled Allow management operating system to share this network adapter. This critical step permits the host computer itself to retain internet access while the switch is active. If you do not enable this, your host PC will lose network connectivity until you disable or delete the switch.
Once created, verify the switch appears in the list. You will need to attach this switch to every VM that requires network access, including the future Ubuntu instance. For internal-only communication between VMs without internet access, you would instead create an Internal switch, but for a functional domain environment with updates and external resources, External is required. See Making a Virtual Internal NAT Switch Work for Hyper-V VMs if you later need isolated testing environments.
Configuring the Domain Controller
Deploy your first VM, which will serve as the Domain Controller (DC). Install Windows Server (e.g., 2019 or 2022) and connect it to the DomainSwitch. Before installing any roles, you must configure a static IP address. DHCP can cause issues during the initial promotion process if the lease changes unexpectedly.
Open Network Connections, right-click the Ethernet adapter, and select Properties. Choose Internet Protocol Version 4 (TCP/IPv4) and click Properties. Set a static IP address, such as 192.168.1.10, with a subnet mask of 255.255.255.0. The default gateway should be your physical router’s IP (e.g., 192.168.1.1). Crucially, set the Preferred DNS server to 127.0.0.1 or its own static IP. A domain controller must point to itself for DNS resolution during promotion.
Next, open Server Manager and add the Active Directory Domain Services role. After installation, run the prompt to promote this server to a domain controller. Choose Add a new forest and provide a root domain name, such as localdomain.local. Follow the wizard to completion. Once finished, the server will reboot. Verify that you can ping the loopback address and resolve the domain name.
Setting Up the File Server
Create your second VM for the file server. Connect it to the same DomainSwitch. Install Windows Server or a standard Windows OS version. Like the DC, assign a static IP address, such as 192.168.1.11. Configure the DNS server to point to the Domain Controller’s IP (192.168.1.10). This ensures the file server can locate domain services.
At this stage, the file server is likely still in a workgroup. You cannot fully utilize domain features until it joins the domain. However, you can prepare shared folders now. Create a directory structure, right-click the folder, select Properties, go to the Sharing tab, and configure permissions. Note that full domain-based permissions will only apply after the join operation. For more details on network adapter configurations, refer to Creating Hyper-V Virtual Ethernet Adapter.
Joining the Workstation to the Domain
The third VM represents a client workstation. Install Windows 10 or 11 Pro/Enterprise (Home editions cannot join domains). Assign it a static IP like 192.168.1.12 and set its DNS to the DC (192.168.1.10). To join the domain, do not use sysprep, which is intended for generalizing images before deployment, not for joining existing systems to a domain.
Instead, press Windows Key + R, type sysdm.cpl, and hit Enter. This opens the System Properties dialog. Go to the Computer Name tab and click Change.... Under Member of, select Domain and enter your domain name (e.g., localdomain.local). Click OK.
You will be prompted for credentials; use an account with administrative privileges on the domain controller. Upon successful authentication, you will receive a confirmation message. Restart the workstation. After reboot, you can log in using domain credentials (format: DOMAIN\Username or [email protected]). This completes the core trio of your infrastructure.
Future Ubuntu Deployment
When deploying your Ubuntu VM, connect it to DomainSwitch. While Ubuntu does not natively join Active Directory without additional tools like sssd or
Frequently Asked Questions
Can I use DHCP for the Domain Controller?
No, you should never assign a static IP to a Domain Controller. While some guides suggest otherwise, best practice dictates that the DC must have a static IP to ensure consistent DNS registration and reliable service availability. DHCP leases can change, causing replication failures and authentication errors across the domain.
Why does my workstation fail to join the domain?
The most common cause is incorrect DNS configuration. The workstation must point to the Domain Controller’s IP as its primary DNS server. If it points to the router or an external DNS provider, it cannot locate the domain controllers. Verify this in the network adapter properties before attempting the join again.
Is sysprep necessary for joining the domain?
No, sysprep is used to generalize a Windows image for cloning or mass deployment. To join an existing running system to a domain, use the System Properties dialog accessed via sysdm.cpl. Using sysprep at this stage would reset the computer name and remove drivers, which is counterproductive for a single join operation.
How do I handle IP conflicts in Hyper-V?
Ensure each VM has a unique static IP address within the same subnet. Avoid assigning IPs that fall within your physical router’s DHCP range to prevent conflicts with other devices on the network. Check your router’s DHCP scope and exclude the static IPs you assign to your VMs.
Can I access the domain from outside the virtual switch?
Yes, because you selected an External switch, your VMs are bridged to the physical network. Any device on the same physical LAN segment can reach the VMs if firewall rules allow it. Ensure Windows Firewall on the DC and File Server permits SMB and LDAP traffic from trusted subnets.