Deploy a Windows Active Directory domain controller with users, computers, Group Policy, DNS, and DHCP for enterprise network management.
Deploy a Windows Active Directory domain controller with users, computers, Group Policy, DNS, and DHCP for enterprise network management. This comprehensive guide covers everything from design through implementation, testing, and deployment.
Install Windows Server 2022. Set static IP (192.168.10.10). Set hostname (DC01). Open Server Manager → Add Roles → Active Directory Domain Services (AD DS). Post-install: Promote to Domain Controller. Create new forest: root domain name catb.local (use .local for internal). Forest/Domain functional level: Windows Server 2016. Configure Directory Services Restore Mode (DSRM) password. DNS role installed automatically. After reboot: domain controller is operational.
10 components required for this project.
| # | Component | Purpose | Qty |
|---|---|---|---|
| 1 | Windows Server 2022 (VM) | Primary and secondary DC | x2 |
| 2 | Windows 10/11 client VMs | Domain member workstations | x3 |
| 3 | Hyper-V or VMware | Virtualization host | x1 |
| 4 | Static IPs (via DHCP reservations) | Fixed addressing for servers | x1 |
| 5 | DNS server (built into AD DS) | Name resolution | x1 |
| 6 | Group Policy Management Console | Policy administration | x1 |
| 7 | Active Directory Users and Computers | User/computer management | x1 |
| 8 | Security Event Log | Audit trail for compliance | x1 |
| 9 | PowerShell 7 | Automation and bulk management | x1 |
| 10 | RADIUS server (optional) | WiFi authentication against AD | x1 |
Follow these 3 steps carefully.
Install Windows Server 2022. Set static IP (192.168.10.10). Set hostname (DC01). Open Server Manager → Add Roles → Active Directory Domain Services (AD DS). Post-install: Promote to Domain Controller. Create new forest: root domain name catb.local (use .local for internal). Forest/Domain functional level: Windows Server 2016. Configure Directory Services Restore Mode (DSRM) password. DNS role installed automatically. After reboot: domain controller is operational.
Design OU (Organizational Unit) hierarchy: catb.local → IT, HR, Finance, Management, Computers, Servers, ServiceAccounts. Users placed in department OUs for Group Policy application. Create user accounts: Name, UPN (john.doe@catb.local), department, office, manager. Security groups: Domain_Admins (full control), IT_Staff (server access), HR_Staff (HR system access), File_Server_Read/Write (share access). Nest groups: IT_Staff → Domain_Admins for granular control.
GPOs apply settings to users and computers based on OU membership. Essential GPOs: Password Policy GPO → domain level (14 chars, complexity, 90-day expiry), Desktop Lockout (screensaver after 5 mins idle), Software Deployment (MSI packages pushed to computers), Drive Mapping (map \\fileserver\share based on group membership), Printer Mapping, Security Baseline (CIS Benchmark settings: disable unneeded services, enable auditing, configure IE/Edge). Use Resultant Set of Policy (rsop.msc) to verify applied policies.
Core code for ad_setup.ps1:
# Active Directory Setup and Configuration Script # Install AD DS role Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools # Promote to Domain Controller Install-ADDSForest -DomainName "catb.local" -DomainNetBIOSName "CATB" -ForestMode "WinThreshold" -DomainMode "WinThreshold" -InstallDNS -SafeModeAdministratorPassword (ConvertTo-SecureString "SecureP@ssw0rd" -AsPlainText -Force) -Force # Create Organizational Units New-ADOrganizationalUnit -Name "IT" -Path "DC=catb,DC=local" New-ADOrganizationalUnit -Name "HR" -Path "DC=catb,DC=local" New-ADOrganizationalUnit -Name "Finance" -Path "DC=catb,DC=local" # Create users in bulk from CSV Import-Csv users.csv | ForEach-Object { New-ADUser -Name "$($_.FirstName) $($_.LastName)" \` -GivenName $_.FirstName -Surname $_.LastName \` -SamAccountName $_.Username \` -UserPrincipalName "$($_.Username)@catb.local" \` -Department $_.Department \` -Path "OU=$($_.Department),DC=catb,DC=local" \` -AccountPassword (ConvertTo-SecureString $_.Password -AsPlainText -Force) \` -Enabled $true Write-Host "Created user: $($_.Username)" } # Create security groups New-ADGroup -Name "IT_Staff" -GroupScope Global -Path "OU=IT,DC=catb,DC=local" New-ADGroup -Name "Domain_Admins_Custom" -GroupScope Global -Path "OU=IT,DC=catb,DC=local" Add-ADGroupMember -Identity "Domain Admins" -Members "Domain_Admins_Custom"Test Active Directory Domain Controller by verifying each subsystem individually before full integration.
Verify power voltages, check ground connections, use serial monitor for debug.
An interactive simulator will be available here — simulate circuits and run code in-browser without hardware.