Your Lab's First Domain Controller, Built with PowerShell

Hi there! It's BOB.

Almost every Windows lab starts in the same place: Active Directory. Group Policy, certificates, file shares, Entra Connect, Windows Admin Center, all those fun projects need a domain first.

You can build one by clicking through Server Manager. But today we're going to use PowerShell, because:

1. It's faster.
2. You can save the commands and rebuild your lab in minutes.
3. It makes you look extremely cool. 😎

Let's build a forest!

Step 0: Pick a Good Domain Name

This is the one decision that's hard to change later, so let's get it right.

If you own a domain name, a subdomain of it is the "by the book" choice. If you don't, or you just like it, .local works fine for a lab. Pick one and stick with it.

We'll use lab.contoso.com with the short (NetBIOS) name LAB today.

1. Prepare the Server

Start with a fresh Windows Server VM (from a template, if you've read my Sysprep article). The domain controller needs a static IP address and a good name before it's promoted.

# Give it a static IP (adjust to your network)
New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 192.168.50.10 -PrefixLength 24 -DefaultGateway 192.168.50.1

# For now, point DNS at itself (it'll be the DNS server soon)
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses 127.0.0.1

# Give it a sensible name, then reboot
Rename-Computer -NewName "DC01" -Restart

💡 BOB's tip: Name it before you promote it. Renaming a domain controller later is possible, but it's an afternoon you'll never get back.

2. Install the AD DS Role

Install-WindowsFeature AD-Domain-Services -IncludeManagementTools

This installs the bits but doesn't create a domain yet. Think of it as unpacking the furniture before you build it.

3. Create the Forest

Here's the big one:

Install-ADDSForest `
    -DomainName "lab.contoso.com" `
    -DomainNetbiosName "LAB" `
    -InstallDns `
    -SafeModeAdministratorPassword (Read-Host -AsSecureString "DSRM password")

What's going on:

• -DomainName: the full DNS name of your new domain.
• -DomainNetbiosName: the short name you'll see in LAB\username.
• -InstallDns: makes this server the DNS server for the domain. Active Directory runs on DNS, so yes, you want this.
• -SafeModeAdministratorPassword: the DSRM password, used to boot the DC into Directory Services Restore Mode for repairs. Save it in your password manager. You'll need it exactly once, and on that day you'll really need it.

The server checks prerequisites, asks you to confirm, builds the forest, and reboots. When it comes back, sign in as LAB\Administrator. Congratulations, you've got a domain! 🎉

💡 BOB's tip: Want to practice first? Add -WhatIf to see what would happen without doing it, or run Test-ADDSForestInstallation with the same parameters.

4. Tidy Up DNS

Your DC is now a DNS server, but it only knows about your domain. Teach it how to find the rest of the internet with forwarders:

Add-DnsServerForwarder -IPAddress 1.1.1.1, 9.9.9.9      # or your router, or your favorite DNS

# A reverse lookup zone, so IP addresses resolve back to names (nice for troubleshooting)
Add-DnsServerPrimaryZone -NetworkId "192.168.50.0/24" -ReplicationScope Forest

Then hand out the DC's IP as the DNS server to every machine in the lab (in your DHCP settings, or on each VM).

⚠️ Heads up: Domain members must use only your domain controllers for DNS. If a lab PC has your DC and your router (or 8.8.8.8) as DNS servers, it'll work… most of the time. Then one day it'll ask the wrong one, and domain joins and logons will fail in baffling ways. Let the DC forward everything else.

5. Set the Time

Active Directory uses Kerberos, and Kerberos is very picky about time: clocks more than 5 minutes apart and sign-ins fail. Every domain member gets its time from the domain controllers, and the domain controller with the PDC emulator role should get its time from somewhere reliable:

w32tm /config /manualpeerlist:"pool.ntp.org" /syncfromflags:manual /reliable:yes /update
Restart-Service w32time
w32tm /query /status          # check where it's getting time from

6. Check Your Work

Get-ADDomain                       # domain info
Get-ADDomainController             # this DC's info
dcdiag /q                          # health check; no output means no errors 🙌
Resolve-DnsName lab.contoso.com    # DNS is answering for the domain

Then join a test machine:

Add-Computer -DomainName "lab.contoso.com" -Restart    # run on the machine you're joining

7. Add a Second Domain Controller (Recommended!)

One DC is a single point of failure. If it's off, your whole lab domain is off. A second DC also lets you practice real-world stuff like replication and FSMO roles.

On a second server (static IP, DNS pointed at DC01, named DC02):

Install-WindowsFeature AD-Domain-Services -IncludeManagementTools

Install-ADDSDomainController `
    -DomainName "lab.contoso.com" `
    -InstallDns `
    -Credential (Get-Credential "LAB\Administrator") `
    -SafeModeAdministratorPassword (Read-Host -AsSecureString "DSRM password")

After it reboots, check replication:

repadmin /replsummary      # 0 failures = happy

Then point each DC's DNS settings at the other DC first and itself second.

A Few Lab-Friendly Habits

• Make some OUs right away (Servers, Workstations, Users, Groups), so you're not stuffing everything into the default containers.
• Make a personal admin account. Don't use the built-in Administrator for everyday work.
• Turn on the AD Recycle Bin. It lets you restore deleted objects in seconds:

Enable-ADOptionalFeature "Recycle Bin Feature" -Scope ForestOrConfigurationSet -Target "lab.contoso.com"

• Save your script! Copy every command from this article into a .ps1 file. Next time, your whole domain is one script away.

Wrapping Up

• Pick a domain name you own a subdomain of, like ad.contoso.com.
• Static IP, good name, then Install-WindowsFeature and Install-ADDSForest.
• Add DNS forwarders, and point every lab machine at the DCs only for DNS.
• Sync the PDC emulator's time with a reliable source.
• Build a second DC as soon as you can.

Now go have fun with your new domain. And when you're ready to give it certificates, check out my article on building a home lab PKI with AD CS!

See you next time!

— BOB

Sources

• Microsoft Learn: Install Active Directory Domain Services (Level 100)
• Microsoft Learn: Install-ADDSForest
• Microsoft Learn: Install-ADDSDomainController
• Microsoft Learn: Selecting the forest root domain
• Microsoft Learn: Add-DnsServerForwarder
• Microsoft Learn: Configure the Windows Time service (w32tm)
• Microsoft Learn: Active Directory Recycle Bin
• IETF: RFC 6762, Multicast DNS (the .local domain)