Establishing a new Active Directory domain on physical hardware running Windows Server 2019 requires careful planning of IP addressing, DNS configuration, and network segmentation. This guide walks you through promoting the server to a Domain Controller, configuring static IPs, and establishing secure connectivity between your main LAN and neighboring building infrastructure using VLANs.
Prerequisites and Network Planning
Before installing the operating system or attempting to join a domain, you must define your network topology. Since you are dealing with a physical server and potentially multiple buildings, consistency is key. You need a dedicated static IP address for the Domain Controller that will not change. Dynamic IP assignments via DHCP can cause significant issues when the server tries to register its DNS records after a reboot if it receives a different address.
You should also decide on your naming convention early. For example, use
corp.local for internal resolution or a reverse public domain like
internal.company.com. Avoid using .local unless necessary, as mDNS conflicts can arise. Ensure your physical server has at least two network interfaces if you plan to separate management traffic from user data, though a single interface with VLAN tagging is often sufficient for smaller deployments.
Installing Windows Server 2019 and Initial Configuration
Begin by installing Windows Server 2019 Standard or Datacenter edition from your licensed media. During installation, select the "Server with Desktop Experience" if you require a GUI for easier management, or the minimal installation for better security and performance. Once installed, log in locally with the Administrator account.
Navigate to
Server Manager and then to
Local Users and Groups. Rename the local Administrator account to something less obvious, such as
SvrAdmin, to reduce brute-force attack vectors. Set a strong password immediately. Next, configure the network adapter properties. Right-click the network icon, go to
Internet Properties, and select
IPv4. Assign a static IP address, subnet mask, and default gateway. Crucially, set the Preferred DNS server to point to the server's own IP address (e.g., 127.0.0.1 or its specific static LAN IP). This ensures the server resolves its own name correctly during promotion.
If you have a neighboring building scenario, ensure that the physical cabling or fiber links between the buildings are configured on your core switches to support VLAN trunking. This allows traffic from different logical networks to traverse the same physical cable while remaining isolated.
Promoting the Server to a Domain Controller
Open
Server Manager and click on
Add roles and features. Proceed through the wizard until you reach the
Server Roles section. Check the box for
Active Directory Domain Services. A popup will appear warning you about dependencies; click
Add Features. Complete the wizard and install the role.
After installation, you will see a yellow flag in the notification area of Server Manager. Click this flag and select
Promote this server to a domain controller. Choose
Add a new forest and enter your root domain name (e.g.,
mycompany.local). Set a DSRM (Directory Service Restore Mode) password, which is critical for recovery scenarios. Select
Domain Name System to install DNS automatically. Specify the NetBIOS domain name, usually the first part of your FQDN.
In the paths section, accept the default locations for the AD database and logs. Review the prerequisites; if any fail, resolve them before proceeding. Finally, restart the server. Upon reboot, you will be prompted for credentials. Use
DOMAIN\Administrator to log in, confirming that the domain controller is operational.
Configuring VLANs and Inter-Building Connectivity
For the neighboring building scenario, you must configure your network switches to handle VLANs. Create a VLAN ID for the corporate network (e.g., VLAN 10) and another for guest or IoT devices if needed. On the switch ports connecting the two buildings, configure them as trunk ports to allow multiple VLANs to pass through.
On the Windows Server, you do not necessarily need to create sub-interfaces unless you are routing between VLANs on the server itself. Typically, a Layer 3 switch handles the routing. However, if you need the DC to respond to requests on multiple subnets, ensure your DHCP scopes are configured on the router or firewall to offer addresses within the correct subnet for each VLAN. Test connectivity by pinging a client machine in the neighboring building using its IP address and then its hostname. If hostname resolution fails, check the DNS zones on the DC to ensure forward lookup zones are replicating correctly.
It is also important to verify that firewalls between the buildings allow necessary AD traffic: TCP/UDP 53 (DNS), TCP 88 (Kerberos), TCP 389 (LDAP), and TCP 445 (SMB). Without these, clients cannot authenticate against the central DC.
Ongoing Management and Best Practices
Once the environment is stable, focus on maintenance. Install updates regularly via
Windows Update or WSUS if you deploy it later. Enable auditing policies to track logon events and privilege usage. Regularly back up the system state, which includes the AD database, using Windows Server Backup or a third-party solution. Store backups off-site or on a separate volume to protect against ransomware.
Consider integrating other services gradually. For instance, if you need file sharing across the LAN, ensure permissions are set via NTFS and Share permissions rather than relying solely on host-based firewalls. Understanding how these permissions interact is vital for securing sensitive data. For more details on managing local network resources, see our guide on
Enable WIN10/11 LAN File Sharing. Additionally, if you plan to extend access outside the local network, understanding SSH and remote management protocols is essential, as outlined in
Windows Computer: Gaining SSH Access Outside Local Network Using PowerShell.
Frequently Asked Questions
Can I use a dynamic IP address for my Domain Controller?
No, you should never use a dynamic IP for a Domain Controller. AD relies heavily on DNS registration, and if the IP changes, clients may fail to locate authentication services, leading to login failures and replication errors. Always assign a static IP reserved in your DHCP scope if you must use DHCP, but static assignment is preferred.
How do I connect two buildings without running new cables?
You can use wireless bridges or fiber optic transceivers over existing conduit if available. Ensure your core switches support VLAN tagging so that traffic from both buildings remains logically separated. The physical link must be treated as a trunk port carrying all necessary VLAN IDs between the sites.
What happens if I lose the DSRM password?
The DSRM password is required to restore the Active Directory database in emergency situations. If you lose it, you cannot perform an authoritative restore of AD. It is highly recommended to store this password securely in a password manager or write it down in a physically secure location during initial setup.
Is it safe to expose the Domain Controller to the internet?
Never expose the Domain Controller directly to the internet. It should always sit behind a firewall. If remote access is needed, use a VPN or Remote Desktop Gateway (RDG) with multi-factor authentication. Direct exposure invites brute-force attacks and exploitation of known vulnerabilities.
How do I add a client computer to the domain?
On the client PC, go to System Properties, click Change, and enter the domain name. You will need credentials for an account with permission to join computers to the domain, typically the Administrator or a delegated helpdesk account. Ensure the client can resolve the DC's IP via DNS before attempting to join.