Active Directory Domain Services concepts

Start DC01 and open PowerShell as administrator. You’ll check the server is ready, install the AD DS role (the program files only), and run the same checks the promotion wizard runs, without changing anything yet.

1Confirm DC01 is ready to be a domain controller

Run this:

[pscustomobject]@{
    Name      = $env:COMPUTERNAME
    IPv4      = (Get-NetIPAddress -InterfaceAlias Ethernet -AddressFamily IPv4).IPAddress
    DHCP      = (Get-NetIPInterface -InterfaceAlias Ethernet -AddressFamily IPv4).Dhcp
    DNS       = (Get-DnsClientServerAddress -InterfaceAlias Ethernet -AddressFamily IPv4).ServerAddresses -join ', '
    TimeZone  = (Get-TimeZone).Id
}

You should see something like this:

Name     : DC01
IPv4     : 10.0.0.10
DHCP     : Disabled
DNS      : 1.1.1.1
TimeZone : India Standard Time

A future DC needs a final name, a static address and the right time zone before promotion. DNS still points to 1.1.1.1; the promotion will install DNS on DC01 and switch it to itself.

✅ Checkpoint: DC01 has its name, 10.0.0.10, DHCP Disabled and your time zone.

2Check nobody else uses your domain name

Run this:

Resolve-DnsName saatlab.internal

You should get an error like this, which is good news:

Resolve-DnsName : saatlab.internal : DNS name does not exist
At line:1 char:1
+ Resolve-DnsName saatlab.internal
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ResourceUnavailable: (saatlab.internal:String) [Resolve-DnsName], Win32Exception
    + FullyQualifiedErrorId : DNS_ERROR_RCODE_NAME_ERROR,Microsoft.DnsClient.Commands.ResolveDnsName

Nobody on the internet answers for saatlab.internal, and nobody ever will, because .internal is reserved for private use. In a company, the same check against your proposed name catches clashes before they become permanent.

✅ Checkpoint: saatlab.internal does not exist in public DNS.

3Install the AD DS role

Run this:

Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

You should see something like this:

Success Restart Needed Exit Code      Feature Result
------- -------------- ---------      --------------
True    No             Success        {Active Directory Domain Services, Group P...

This only copies the role’s files and tools: DC01 is not a domain controller yet. -IncludeManagementTools adds Active Directory Users and Computers, Group Policy Management and the PowerShell modules.

✅ Checkpoint: Success is True and Restart Needed is No.

4See what came with the role

Run these one at a time:

Get-WindowsFeature | Where-Object { $_.Installed -and $_.Name -match 'AD|GPMC' } | Select-Object Name, DisplayName
Get-Command -Module ADDSDeployment | Select-Object Name

You should see something like this:

Name                DisplayName
----                -----------
AD-Domain-Services  Active Directory Domain Services
GPMC                Group Policy Management
RSAT-AD-Tools       AD DS and AD LDS Tools
RSAT-AD-PowerShell  Active Directory module for Windows PowerShell
RSAT-ADDS           AD DS Tools
RSAT-AD-AdminCenter Active Directory Administrative Center
RSAT-ADDS-Tools     AD DS Snap-Ins and Command-Line Tools

Name
----
Add-ADDSReadOnlyDomainControllerAccount
Install-ADDSDomain
Install-ADDSDomainController
Install-ADDSForest
Test-ADDSDomainControllerInstallation
Test-ADDSDomainControllerUninstallation
Test-ADDSDomainInstallation
Test-ADDSForestInstallation
Test-ADDSReadOnlyDomainControllerAccountCreation
Uninstall-ADDSDomainController

The ADDSDeployment module has an Install and a matching Test command for every kind of promotion: a new forest, a new domain, an extra DC, a read-only DC. The Test commands run every prerequisite check and change nothing.

✅ Checkpoint: You can see Install-ADDSForest and Test-ADDSForestInstallation.

5Run the promotion pre-check

Run this. It asks for a Directory Services Restore Mode (DSRM) password twice; use a strong one and write it down:

Test-ADDSForestInstallation -DomainName saatlab.internal -DomainNetbiosName SAATLAB -InstallDns

You should see something like this:

SafeModeAdministratorPassword: ****************
Confirm SafeModeAdministratorPassword: ****************
WARNING: This computer has at least one physical network adapter that does not have static IP address(es) assigned to
its IP Properties. If both IPv4 and IPv6 are enabled for a network adapter, both IPv4 and IPv6 static IP addresses
should be assigned to both IPv4 and IPv6 Properties of the physical network adapter. Such static IP address(es)
assignment should be done to all the physical network adapters for reliable Domain Name System (DNS) operation.

WARNING: A delegation for this DNS server cannot be created because the authoritative parent zone cannot be found or
it does not run Windows DNS server. If you are integrating with an existing DNS infrastructure, you should manually
create a delegation to this DNS server in the parent zone to ensure reliable name resolution from outside the domain
"saatlab.internal". Otherwise, no action is required.

Message                                    Context                                  RebootRequired Status
-------                                    -------                                  -------------- ------
Operation completed successfully           Test.VerifyDcPromoCore.DCPromo.General.77           False Success

Status: Success means DC01 can be promoted. The two warnings are normal in a lab: IPv6 uses an automatic address (fine, as long as IPv4 is static), and there’s no parent zone to delegate from because .internal isn’t on the internet. You’ll still see these on real promotions, so it’s worth knowing they’re safe here.

The DSRM password is for a special local administrator used only when AD is offline for repairs (Lesson 32). Store it in your password manager.

✅ Checkpoint: Test-ADDSForestInstallation finishes with Status Success. Shut down DC01 and take a snapshot called “AD role installed”.