Promote the first domain controller

DC01 is powered off after Lesson 10. Steps 1 and 2 happen on your laptop and DC01; after the restart everything is on DC01 in PowerShell as administrator.

1Take a snapshot before promotion

On your laptop:

VBoxManage snapshot DC01 take "Before promotion"
VBoxManage startvm DC01

✅ Checkpoint: DC01 has a “Before promotion” snapshot and is starting.

2Promote DC01

On DC01, run this. Enter the DSRM password twice, then answer Y:

Install-ADDSForest -DomainName saatlab.internal -DomainNetbiosName SAATLAB -InstallDns

You should see something like this before DC01 restarts by itself:

SafeModeAdministratorPassword: ****************
Confirm SafeModeAdministratorPassword: ****************

The target server will be configured as a domain controller and restarted when this operation is complete.
Do you want to continue with this operation?
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"): Y
WARNING: This computer has at least one physical network adapter that does not have static IP address(es) ...
WARNING: A delegation for this DNS server cannot be created because the authoritative parent zone cannot be found ...

You’ll see a progress bar for a few minutes, then DC01 signs you out and restarts. The first start after promotion takes longer than usual (“Applying computer settings”).

✅ Checkpoint: DC01 restarted on its own after the promotion finished.

3Sign in and check the domain and forest

Press Right Ctrl + Delete. The sign-in screen now says SAATLAB\Administrator; use the same password as before. Open PowerShell as administrator.

Run these one at a time:

Get-ADDomain | Select-Object DNSRoot, NetBIOSName, DomainMode
Get-ADForest | Select-Object Name, ForestMode, GlobalCatalogs
netdom query fsmo

You should see something like this:

DNSRoot          NetBIOSName DomainMode
-------          ----------- ----------
saatlab.internal SAATLAB     Windows2025Domain

Name             ForestMode        GlobalCatalogs
----             ----------        --------------
saatlab.internal Windows2025Forest {DC01.saatlab.internal}

Schema master               DC01.saatlab.internal
Domain naming master        DC01.saatlab.internal
PDC                         DC01.saatlab.internal
RID pool manager            DC01.saatlab.internal
Infrastructure master       DC01.saatlab.internal
The command completed successfully.

The forest and domain run at the 2025 functional level, DC01 is the only global catalog, and it holds all five FSMO roles. netdom query fsmo is the fastest way to answer “where are the roles?” on any domain.

✅ Checkpoint: Get-ADDomain shows saatlab.internal and SAATLAB, and netdom lists DC01 for all five roles.

4Check DNS: zones, SRV records and the forwarder

Run these one at a time:

Get-DnsServerZone | Select-Object ZoneName, ZoneType, IsDsIntegrated
Resolve-DnsName -Type SRV _ldap._tcp.dc._msdcs.saatlab.internal | Select-Object Name, NameTarget, Port
Get-DnsServerForwarder | Select-Object IPAddress
Get-DnsClientServerAddress -InterfaceAlias Ethernet -AddressFamily IPv4 | Select-Object ServerAddresses

You should see something like this:

ZoneName                ZoneType IsDsIntegrated
--------                -------- --------------
_msdcs.saatlab.internal Primary            True
0.in-addr.arpa          Primary           False
127.in-addr.arpa        Primary           False
255.in-addr.arpa        Primary           False
saatlab.internal        Primary            True
TrustAnchors            Primary            True

Name                                   NameTarget            Port
----                                   ----------            ----
_ldap._tcp.dc._msdcs.saatlab.internal  DC01.saatlab.internal  389

IPAddress
---------
{1.1.1.1}

ServerAddresses
---------------
{::1, 127.0.0.1}

Both AD zones are AD-integrated, the SRV record points at DC01 on port 389 (LDAP), and 1.1.1.1 became a forwarder so internet names still resolve. Promotion pointed DC01’s own DNS at itself (127.0.0.1 and ::1).

Best practice is to use the DC’s real address instead of loopback, so set it now:

Run this:

Set-DnsClientServerAddress -InterfaceAlias Ethernet -ServerAddresses 10.0.0.10

✅ Checkpoint: Both zones show IsDsIntegrated True, the SRV record points to DC01, and the forwarder is 1.1.1.1.

5Check SYSVOL and NETLOGON

Run this:

Get-SmbShare | Where-Object Name -in 'SYSVOL','NETLOGON' | Select-Object Name, Path

You should see this:

Name     Path
----     ----
NETLOGON C:\Windows\SYSVOL\sysvol\saatlab.internal\SCRIPTS
SYSVOL   C:\Windows\SYSVOL\sysvol

These two shares appear only when the DC has finished initialising. If they’re missing after promotion, Group Policy won’t work and the DC isn’t really ready, even if everything else looks fine.

✅ Checkpoint: Both SYSVOL and NETLOGON are shared.

6Run dcdiag

Run this:

dcdiag /q

/q prints only errors.

On a healthy new DC you’ll see nothing at all, or a couple of lines about the System event log containing warnings from the first start. Read any failure and check it against the troubleshooting table below. Lesson 45 covers dcdiag in depth.

✅ Checkpoint: dcdiag /q shows no failed tests (or only event log warnings from the first boot).

7Confirm the network profile and take a snapshot

Run this:

Get-NetConnectionProfile | Select-Object Name, NetworkCategory

You should see this:

Name             NetworkCategory
----             ---------------
saatlab.internal DomainAuthenticated

The connection moved from Public to DomainAuthenticated, so the Domain firewall profile now applies. Shut down DC01 and take a snapshot called “DC promoted” from your laptop.

✅ Checkpoint: NetworkCategory is DomainAuthenticated and DC01 has a “DC promoted” snapshot.