Edit: This post has been updated with a new walkthrough as I changed my mind on a few things. Most notably, I'll be working with a new isolated domain rather than a child domain off of my production domain.
In this post, I'll go through the steps of building an Active Directory domain. I'll assume you already have Windows Server installed, a host name set and a static IP address assigned to the network interface. Here, I'm using Windows Server 2016 Technical Preview 4, just because I want to kick the tires on the lastest bits. The process should be pretty much the same in any other Technical Preview build or Server 2012/2012R2 but has changed vastly from Windows Server 2008R2 and earlier. Server Manager is vastly different, and the dcpromo command is only there to process an answer file at this point, everything is done via Server Manager.
This is going to be a long post with a lot of screen shots.
When you log into the server, you'll see Server Manager pop up. In the main field, you'll see common steps numbered from 1 - 5. We're looking for number 2, Add roles and features.
Next, it asks if you want to perform a role-based/feature-based installation, or a remote desktop services installation. Leave the default selected.
Next, you will be asked to select which server you wish to install roles or features on. One of the nice additions to Server 2012 is the ability to manage multiple servers from a common instance of Server Manger. You can add additional servers to be managed in, and from here install roles and features on other servers in your environment. And if you install the latest Windows Management Framework for Server 2008 or Server 2008R2, you can manage those (although more limited) from Server 2012/2012R2 as well.
In this case, we're don't have a domain set up yet, so the local host should be the only server appearing on the list. Click Next.
Next, you'll want to tick the box next to Active Directory Domain Services. A box will then pop up labeled Add Roles and Features wizard that informs you of any additional prerequisite roles and features for what you just selected for installation. Click Add Feature to install these additional options.
Once you have Active Directory selected, do the same for DNS Server. DNS is an integral part of Active Directory and simply cannot be left out. I've read conflicting reports on whether or not non-Windows DNS Servers can be used, but I've never gotten it working with recent versions of Windows Server if it is indeed still possible. I'm not really studying advanced Windows Server topics, so I never kept at it. Has anyone gotten it to work?
Select any other roles you care to install as well.
Here you can select various features to install if your server isn't going to be limited to a domain controller, but I'm not adding anything that hasn't already been automatically selected so I'm just clicking Next again.
Next you'll see this informational box on ADDS. Feel free to read it, or don't, your call. Click Next.
Another similar box for DNS. Again, read it or don't and click next.
Here is the final confirmation of what you've chosen to install, and a checkbox at the top selecting whether or not you want the server to reboot if required once the installation has completed, if necessary. Obviously for a production machine that is performing other tasks, you'll want to hold off until a scheduled maintenance window, but in the lab go ahead and let it reboot. Click Install when you're ready to let it begin. Interestingly enough, this server didn't reboot after installing the Active Directory bits.
One you let it begin, it's going to take some time to complete, especially if this is in a virtual machine so go ahead and grab a sandwich.
Once the roles and features have finished installing, note the yellow exclamation mark at the top of Server Manger trying to get your attention. If you click that, you'll see the following box indicating that your server is ready to be promoted to a domain controller. Click on "Promote this server to a domain controller" to begin.
The first thing that comes up will ask you about the environment. I'm building a new domain here and naming it firewallninja.info (clever, eh?), so I selected Add a new forest and entered the name. Fill in the boxes appropriately for you, and then click next. A bit of a wait here, and a command prompt comes and goes without warning.
Next it will ask you some questions regarding this domain controller. The first is the FFL and DFL of the domain. Since this is a lab domain, I'm going to select the highest avaiable to ensure I have all the latest/greatest bits to experiment with. We need to check off DNS and Global Catalog since its the first domain controller in the domain. Finally, give it a DSRM password that you'll be able to remember. Or not, because in the lab you'll probably be better off just rolling back to a snapshot of this server than trying to fix an problem of the magnitude necessary to use Directory Service Restore Mode.
Next is the DNS Options. Nothing to change here as it is the first domain controller for the domain.
Next is the Additional Options, which consists of nothing more than the NetBIOS domain name. Whatever comes up as the default is fine because who uses NetBIOS anymore?
Next is the directory paths for various parts of Active Directory. Spread the love around to multiple spindels in production, but the defaults are fine in the lab.
Finally we have a summary of all the options selected. If this were a domain controller for an existing domain, you could click view script to get a PowerShell script to run on any additional servers you want to promote to domain controllers. Click Next again.
Prerequisites will be checked here. There shouldn't be anything stopping you from proceeding at this point, but it will tell you if there is. The one warning is letting you know about a default cryptography option that is not best practice, but chosen for compatibility reasons. This can be fixed in group policy later if you care to lock this setting down.
Click Install to begin the promotion.
The process will run for some time, and the server will reboot once it's done. The local administrator will be converted to the domain administrator once the process has completed. There are no local user accounts on a domain controller.
