Active Directory on Windows Server

A beginner-friendly guide to understanding Active Directory and building a domain controller with Microsoft Windows Server

1. What is Active Directory?

Active Directory (AD) is Microsoft's identity and directory service. At its heart it is a giant, centralised phone book for your network: it stores every user, computer, group, and policy, and it answers the two questions every IT system needs — "Who are you?" (authentication) and "What are you allowed to do?" (authorization).

2. Why use Active Directory? (The Benefits)

Scenario	Without AD	With AD
A new employee joins	Admin creates accounts on the PC, the printer, the email server, the file server… separately	Create one user in AD — access flows to every joined system
An employee leaves	Hunt down every system they could log into	Disable one account — their access dies everywhere
Force password changes for 200 PCs	Walk to every computer	One Group Policy pushes to all of them

🔑 Centralised identity
One user, one password, one badge — everywhere on the network.

🛂 Authentication & authorization
AD verifies who you are and what you may access, via Kerberos and LDAP.

📦 Group Policy
Push software, settings, and security rules to the whole domain at once.

🗂️ Organization
Organise users and computers into a tree of organisational units (OUs).

🧩 Single sign-on (SSO)
Log in once and access email, file shares, and apps without re-entering passwords.

🔁 Replication
Multiple domain controllers stay in sync, so there's no single point of failure.

3. Core Concepts

4. Workgroup vs Domain

5. Step-by-Step: Spin Up a Domain Controller

Concept	What it is
Domain	A logical group of users/computers managed together, e.g. `corp.example.com`
Domain Controller (DC)	A server that hosts AD and handles logins — the "source of truth"
Forest	The top-level container holding one or more domains under a shared namespace
Organisational Unit (OU)	A folder inside a domain for grouping users/computers, e.g. "Sales", "IT". OUs are the natural target for Group Policy
User / Computer	Objects in AD — every identity and endpoint in the domain
Group	A collection of users used to grant permissions (e.g. "HR-ReadOnly")
LDAP	The protocol/interface AD exposes for reading and writing the directory
Kerberos	The authentication protocol — issues "tickets" proving you logged in, so services trust you
Group Policy (GPO)	Central rules applied to computers and users (policies, software, security)

Workgroup	Active Directory (Domain)
Small networks, no central server	Central server(s) manage everything
Each PC logs in locally (SAM database)	Each PC trusts the domain for logins
Account exists only on that one machine	One account works on every joined machine
No central policy or reuse	GPOs, centralised AD, single sign-on

Prepare the server

Install a Windows Server VM (e.g. Windows Server 2022), give it a static IP address and a fixed hostname. A domain controller's identity must never change (DHCP leases are unreliable for it).

hostname			# e.g. DC-01

Install the AD DS role

Open Server Manager → Add roles and features, tick Active Directory Domain Services, or use PowerShell in an admin console:

> Install-WindowsFeature AD-Domain-Services -IncludeManagementTools

Promote to a domain controller

Click the flag → Promote this server to a domain controller. Choose Add a new forest and type the root domain name (e.g. corp.example.com). Set the Directory Services Restore Mode (DSRM) password.

Create organisational units and groups

Open Active Directory Users and Computers (dsa.msc). Right-click the domain → New → Organisational Unit. Build for example:

corp.example.com
├── Users            ← user accounts live here
├── Groups           ← e.g. "Sales-ReadOnly", "IT-Admins"
└── Computers        ← domain-joined machines

Create users

Right-click the Users OU → New → User. Fill in name and logon name, set (and enforce) a password. Done — that user can now log into any joined PC.

Put users in groups

Group	Purpose
`Sales-ReadOnly`	Access to shared sales folder (read only)
`IT-Admins`	Admin rights on department computers

Select a user → Properties → Member Of → Add the group. Group membership is how you grant permissions once and change them everywhere later.

Join a client computer to the domain

On the Windows PC: Settings → System → About → Rename this PC (advanced) → Change → Member of: Domain. Enter corp.example.com and an admin account name. Reboot — now the PC trusts AD for logins.

6. Group Policy (The Superpower)

Group Policy lets you control hundreds of computers at once. Policies apply to OUs, so structure your OUs to match the rules you want to enforce — e.g. a "Kiosk-PCs" OU for the lobby machines.

7. Quick Reference — Everyday Tools & Commands

8. Best Practices & Next Steps

Tool / Command	What it does
`dsa.msc`	Active Directory Users and Computers (main console)
`gpmc.msc`	Group Policy Management
`dns.msc`	DNS snap-in — DCs also host DNS
`dsadd user / dsrm`	Create / delete users from CLI
`Get-ADUser`, `Set-ADUser`	PowerShell read / modify users
`Get-ADGroupMember <group>`	List members of a group
`New-ADUser -Name ...`	Create a user in PowerShell

🗿 Don't run DCs from DHCP
Domain controllers must have static IPs and stable hostnames.

🔄 Run at least two DCs
Redundancy means one DC can fail without logging everyone else out.

📦 Organise by OU, not group-spaghetti
OUs map to your departments and security rules; keep groups for permission grants.

🔐 Set real password policy
Enforce complexity, expiry, and lockout via a GPO from day one.

🗞️ Back up AD
DCs are critical — use your favorite backup method and test a restore.

🧭 Go deeper
Next: federation (ADFS), Azure AD/Entra, or add the Linux Samba side — see the Linux guide!

Active Directory turns a thousand passwords and per-PC setups into one directory that runs the network.
Build it once, and identity, policy, and security become a single connected system.

🪟 Active Directory on Windows Server