How to Setup Domain Controllers on Windows Server 2025 - Part 3

Introduction

Your Journey So Far:

If you’ve completed Parts 1 and 2, you now have:

• A Windows Server 2025 installation properly configured
• Your first domain controller running Active Directory
• A functional domain with DNS integration
• The foundation of your enterprise infrastructure

But there’s a critical problem: your domain has a single point of failure.

What Happens If Your DC Fails?

With only one domain controller:

• Users cannot log in to domain-joined computers
• Network authentication stops completely
• Group Policy cannot be applied or updated
• All AD-dependent services become unavailable
• File shares requiring domain authentication are inaccessible

In this third part of my Domain Controller series, we’ll solve this problem by adding a secondary (replica) domain controller to your existing Active Directory forest. This provides redundancy, load balancing, and improved fault tolerance for your Active Directory environment.

Prerequisites:
Before proceeding, ensure you have completed Part 1 and Part 2 to set up your primary domain controller.

Benefits of Multiple Domain Controllers

• High Availability: If one DC fails, authentication and directory services continue
• Load Distribution: Multiple DCs share authentication requests across the network
• Site Redundancy: Place DCs in different physical locations for disaster recovery
• Reduced WAN Traffic: Users authenticate to local DCs instead of across slow links
• Faster Replication: Changes replicate between DCs automatically

Prepare the Secondary Domain Controller

Install Windows Server

Follow the same steps from Part 1 to install Windows Server 2025 on your second server:

1. Download and install Windows Server 2025
2. Set a strong Administrator password
3. Configure timezone settings
4. Install necessary drivers
5. Run Windows Updates

Configure Network Settings

1. Assign a Static IP Address:
   Configure a static IP in the same subnet as your primary DC.

2. Configure DNS Settings:

   • Set the Preferred DNS server to the IP address of your primary domain controller
   • Optionally set an Alternate DNS server (like 1.1.1.1 or another DC if available)

Important:
The DNS server must point to your existing domain controller, as it hosts the DNS records for your Active Directory domain.

1. Rename the Server:
   Use a meaningful name following your naming convention (e.g., ORG-DC2, ORG-DC3, etc.).

Join the Server to the Domain

Before promoting the server to a domain controller, it must first be joined to the domain.

1. Open Server Manager and click on the server name in the left pane.
2. Under Properties, click on the Computer name.
3. Click Change next to “To rename this computer or change its domain”.
4. Select Domain and enter your domain name (e.g., ad.coldogstudios.com).
5. Enter credentials of a domain administrator account when prompted.
6. Restart the server when prompted.

Note:
After joining the domain, you can log in using domain credentials instead of the local administrator account.

Install Active Directory Domain Services Role

1. Open Server Manager.
2. Navigate to Manage > Add Roles and Features.
3. Click Next through the wizard pages until you reach Server Roles.
4. Select Role-based or feature-based installation.
5. Ensure your server is selected.
6. Check Active Directory Domain Services.
7. Click Add Features when prompted to install required features.
8. Click Next through the Features and AD DS pages.
9. Check Restart the destination server automatically if required.
10. Click Install to begin the installation.

Promote the Server to a Domain Controller

1. After the AD DS role installation completes, click Promote this server to a domain controller in Server Manager.

2. Select Deployment Configuration:
   • Choose Add a domain controller to an existing domain
   • Ensure your domain name is displayed correctly
   • Click Select… to provide credentials if needed (use a Domain Admin account)
3. Domain Controller Options:
   • Ensure Domain Name System (DNS) server is checked (recommended)
   • Ensure Global Catalog (GC) is checked (recommended for most scenarios)
   • Leave Read-only domain controller (RODC) unchecked unless you specifically need an RODC
   • Select your Site name (or use the default if you haven’t configured AD Sites and Services)
   • Enter a strong Directory Services Restore Mode (DSRM) password

Note:
The DSRM password should be documented and stored securely, just like on your primary DC. It doesn’t need to be the same password as your primary DC.

1. DNS Options:
   • If you see a warning about DNS delegation, you can safely ignore it in most scenarios
   • The wizard will verify that DNS records can be created
2. Additional Options:
   • The wizard will show a domain controller from which it will replicate
   • Verify the replication source is your primary DC or another available DC
   • You can click Change… to select a different replication source if needed
3. Paths:
   • Review the default paths for the AD DS database, log files, and SYSVOL
   • Change these if needed (must use local drives, not network locations)

Tip:
For best performance, consider placing the AD DS database and logs on separate physical disks if possible.

1. Review Options:
   • Review your configuration settings
   • Optionally click View script to see the PowerShell equivalent
2. Prerequisites Check:
   • The wizard will run a prerequisites check
   • Review any warnings (some warnings are informational and can be safely ignored)
   • Common warnings include:
     • “A delegation for this DNS server cannot be created” - safe to ignore in most cases
     • “Windows Server 2025 domain controllers have a default for the security setting…” - informational
3. Click Install to begin the promotion process.

Warning:
The server will automatically reboot after the promotion completes.

Verify Replication

After the server reboots and you log back in, verify that Active Directory replication is working correctly.

Check Replication Status

Open PowerShell as Administrator and run:

# Show replication partners
repadmin /showrepl

# Check replication status
repadmin /replsummary

# Force replication from all partners
repadmin /syncall /AdeP

Verify SYSVOL Replication

# Check DFS Replication state
dfsrdiag ReplicationState

Ensure the SYSVOL share is being replicated:

# List SYSVOL contents
Get-ChildItem \\$env:COMPUTERNAME\SYSVOL

Verify DNS Records

Check that the new DC has registered its DNS records:

# Query DNS for DC records
nslookup -type=SRV _ldap._tcp.dc._msdcs.yourdomain.com

# Check for your new DC's host record
nslookup DC2.yourdomain.com

Test Domain Controller Functionality

# Test DC diagnostic
dcdiag /v

# Run a comprehensive DC test
dcdiag /c /v

# Check Active Directory health
Get-ADDomainController -Filter * | Select-Object Name, IPv4Address, OperatingSystem, IsGlobalCatalog

Configure Sites and Services (Optional)

If you have multiple physical locations, configure Active Directory Sites and Services to optimize replication:

1. Open Active Directory Sites and Services from Server Manager > Tools
2. Create new sites for each physical location
3. Create subnet objects and associate them with sites
4. Configure site links and replication schedules
5. Move domain controllers to their appropriate sites

Post-Deployment Best Practices

Update DNS Settings

Now that you have multiple DCs:

1. Update DHCP scope to provide both DC IP addresses as DNS servers
2. Update static clients to use both DCs for DNS (primary and alternate)
3. Update firewall/router DNS settings if applicable

Configure Time Synchronization

Ensure time synchronization is properly configured:

# On secondary DC, configure to sync from primary DC
w32tm /config /syncfromflags:domhier /update
w32tm /resync

# Verify time source
w32tm /query /status

Backup Both Domain Controllers

Configure Windows Server Backup or your enterprise backup solution to backup both domain controllers, including System State.

Monitor Replication Health

Set up monitoring to alert on replication failures:

# Create a scheduled task to check replication daily
repadmin /showrepl > C:\Logs\replication-status.txt

Troubleshooting Common Issues

Replication Not Starting

# Force knowledge consistency checker (KCC) to run
repadmin /kcc

# Check for replication errors
repadmin /showrepl /errorsonly

DNS Issues

# Re-register DNS records
ipconfig /registerdns

# Restart DNS service
Restart-Service DNS

SYSVOL Not Replicating

# Check DFS Replication service
Get-Service DFSR

# Restart DFS Replication
Restart-Service DFSR

# Check SYSVOL state
dfsrmig /GetGlobalState

Time Synchronization Issues

# Resynchronize time
w32tm /resync /force

# Check time difference between DCs
w32tm /stripchart /computer:DC1.yourdomain.com

Summary

You now have a redundant Active Directory infrastructure with multiple domain controllers. This setup provides:

• High availability for authentication services
• Automatic failover if one DC becomes unavailable
• Load balancing for client authentication requests
• Protection against data loss through multi-master replication

Remember to regularly monitor replication health and maintain consistent configurations across all domain controllers.

Next Steps

Your Active Directory Infrastructure is Now Production-Ready

With two writable domain controllers, you have:

• High availability and fault tolerance
• Automatic failover capabilities
• Load-balanced authentication
• Protection against data loss

Going Further:

• Part 4: Deploy a Read-Only Domain Controller on Server Core (Advanced)
  • Learn command-line server administration
  • Understand RODCs for branch offices or DMZ scenarios
  • Reduce resource usage with Server Core
  • Advanced security concepts with credential caching

Additional Infrastructure Tasks:

• Configure Group Policy Objects (GPOs)
• Set up Organizational Units (OUs)
• Implement proper backup and disaster recovery procedures
• Consider setting up an Enterprise Certificate Authority

When Would You Need Part 4 (RODC)?
Read-Only Domain Controllers are ideal for:

• Branch offices with limited physical security
• DMZ/perimeter networks where you want to minimize risk
• Remote sites with unreliable connectivity
• Learning scenarios for advanced AD concepts and Server Core management

For most homelabs, two writable DCs (Parts 2-3) are sufficient. Part 4 is for those wanting to dive deeper into advanced enterprise scenarios.

Resources

• Install a Replica Windows Server Domain Controller
• Active Directory Replication Concepts
• Repadmin Command Reference
• Active Directory Sites and Services