Skip to content
WinBookUnofficial

AD DS first domain on Windows Server 2025: a lab you can rebuild

Verified 2 min read

Promote a Windows Server 2025 Evaluation VM to a first forest/domain controller with static IP, DNS, DSRM and verification — snapshotted, not production.

Tested onStandard / Datacenter (Evaluation) · Build 26100.33650 · x64
E1
Build
26100.33650
Edition
Standard / Datacenter (Evaluation)
Architecture
x64
Support
Lab (E1)
Evidence
E1Official documentation
Verified
2026-10-28
Page type
Server role

The short answer

Section titled “The short answer”

A first lab domain is four decisions:

  1. A name you will not regret (lab.internal, not LAB or a public domain you do not own).
  2. A static IP and correct DNS.
  3. A DSRM password stored outside the VM.
  4. A snapshot before promotion, so you can rebuild without reinstalling.

Then install AD DS, promote a new forest, reboot, and verify DNS/SYSVOL/ replication. Do not join clients until those checks pass.

Before promotion

Section titled “Before promotion”
Check Value
Computer name dc1 (rename before promotion)
IP Static, e.g. 10.10.10.10/24
DNS 127.0.0.1 only after DNS is installed; no public DNS on the DC
Time Correct time zone; sync to a reliable source
Domain name lab.internal (single-label names are a bad habit)
DSRM password In a password manager, not a desktop note
Snapshot srv2025-pre-ad
Terminal window
Rename-Computer -NewName dc1 -Restart
Get-NetIPAddress -AddressFamily IPv4

Install and promote

Section titled “Install and promote”
Terminal window
Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
Install-ADDSForest `
  -DomainName 'lab.internal' `
  -DomainNetbiosName 'LAB' `
  -InstallDns `
  -ForestMode 'Win2025' `
  -DomainMode 'Win2025'

The cmdlet asks for a DSRM password and reboots. Win2025 functional levels are fine for a new lab forest; lower levels only if you are intentionally mixing older DCs.

Verify before adding clients

Section titled “Verify before adding clients”
Terminal window
Get-Service NTDS,DNS,Netlogon,SYSVOL
dcdiag /test:dns /v
nltest /dsgetdc:lab.internal
Get-SmbShare SYSVOL,NETLOGON

Expected:

  • NTDS, DNS, Netlogon running;
  • SYSVOL/NETLOGON shares present;
  • dcdiag DNS tests pass;
  • the DC locator finds dc1.

Then set DNS forwarders on the DC (do not use the router as the DC’s only forwarder if it cannot resolve external names reliably). Test with Resolve-DnsName microsoft.com.

Join a client

Section titled “Join a client”
  1. Set the client’s DNS to the DC only.
  2. Join lab.internal, reboot.
  3. Log in with a domain account.
  4. Verify whoami /fqdn, nltest /sc_query:lab.internal.

If join fails, check DNS first: a client that cannot resolve the SRV records will never find the domain.

Lab boundaries

Section titled “Lab boundaries”
  • One DC is a lab, not a highly available domain.
  • No public domain name, no production CA, no external federation.
  • Rebuild from srv2025-clean + this page instead of “repairing” a broken lab.
  • Evaluation expiry applies; record it.

Sources