--- title: "Troubleshooting Active Directory on a Windows node" description: "Promote a Windows node to a domain controller, join other Windows nodes to its domain, and fix common Active Directory issues." content_type: "troubleshooting" product: "node" platform: "MyAccount" url: "/myaccount/node/troubleshooting/active-directory/" relationships: {"troubleshooting-for":["/myaccount/node/how-to/connect-to-a-windows-node/"]} --- # Troubleshooting Active Directory on a Windows node Active Directory on a Windows node lets you manage your Windows nodes as one domain. Promote one Windows Server node into a domain controller, then join the rest to its domain. These are the Windows nodes you create in MyAccount; see [Connect to a Windows node](/myaccount/node/how-to/connect-to-a-windows-node/) to get onto one. Both steps are below, with the issues that come up most often during setup. ## Promote a node to a domain controller Only a Windows Server edition can act as a domain controller. You add the role, then run the promotion wizard; the server reboots into its domain controller role at the end. ### Add the Active Directory Domain Services role Open **Server Manager** and click **Add Roles and Features**. The wizard asks which server and which role: check **Active Directory Domain Services** and accept the features it adds with it. When the wizard finishes, a yellow triangle warning appears in the Server Manager menu bar. That warning means the role is installed and waiting for post-deployment configuration. ### Promote the server Click the warning, then click **Promote this server to a domain controller** to open the promotion wizard. Then go through its screens: 1. On **Deployment Configuration**, choose **Add a new forest** and enter the **Root Domain Name** of your domain, such as `corp.example.com`. Click **Next**. 2. On **Domain Controller Options**, leave the defaults and set a **Directory Services Restore Mode (DSRM) password**. DSRM is the recovery mode of a domain controller; the password is a separate administrator credential, not the one you sign in with normally. Record this password securely. You use it only to recover the domain controller, not to sign in normally, but you need it if that recovery ever happens. 3. On **DNS Options**, the wizard warns that it cannot create a delegation because it cannot find the authoritative parent zone. Expect this warning on the first domain controller of a new forest. Click **Next**. 4. On **Additional Options**, confirm the **NetBIOS domain name**, then click **Next**. NetBIOS is the short network name Windows uses for the domain, such as `CORP`; it is an older naming system that Windows still relies on for compatibility. 5. On the paths screen, leave **Database**, **Log files**, and **SYSVOL** at their defaults. Click **Next**. SYSVOL is the shared folder that stores the domain's group policy and logon scripts, which the domain's computers read from. 6. Review the summary. To change anything, use **Previous**; otherwise click **Next**. 7. The wizard runs its **Prerequisites Check**. Fix anything it lists and re-run; when every check passes, click **Install**. 8. The server restarts automatically once promotion completes. After the restart it is a domain controller and AD DS is running. ## Join a client node to the domain On each Windows node you want in the domain: 1. Open **Server Manager → Local Server** and click **WORKGROUP**. 2. Click **Change**. 3. Enter the **Domain Name** of your domain controller. Click **OK**. 4. In the **Computer Name / Domain Changes** dialog, click **OK**, then restart the client node. On the domain controller, confirm the join in **Server Manager → Tools → Active Directory Users and Computers → Domain Controllers**. On the client, open **Network & Internet settings** and confirm the domain membership. ## Common Active Directory issues | Symptom | What to do | | ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Promotion refuses with a "static IP required" message | Set a static IPv4 address on the server before promoting it. A domain controller cannot use a DHCP-assigned address. | | The yellow warning triangle does not appear after the role install | The role may not be installed. Add it from **Server Manager → Add Roles and Features → Active Directory Domain Services**. | | "Cannot create DNS delegation" warning | Expected on the first domain controller of a new forest. Click **Next**. | | Prerequisites check fails with a NetBIOS name conflict | Choose a different NetBIOS domain name that is not in use on the network. | | Forgot the DSRM password | Reset it with `ntdsutil` from an elevated Command Prompt on the domain controller, or boot into DSRM if a normal domain logon is not available. Store the new password securely. | | Client cannot find the domain | Point the client's primary DNS server at the domain controller's IP. The client must use the domain controller for DNS, not a public resolver. | | Domain join fails with an "incorrect credentials" message | Use a domain account with rights to join machines, usually the domain administrator. | | **Server Manager → Tools** shows no AD tools after promotion | Sign out and back in, or reboot. The Remote Server Administration Tools register on first logon after promotion. | | Client joined but Group Policy is not applying | Confirm DNS points at the domain controller, then run `gpupdate /force` on the client. | | Time skew error during a domain join | The domain controller and client must agree on time. Sync the client's clock; the default w32time configuration with the domain controller as the time source is usually enough. w32time is the Windows service that keeps the clock in sync with a time source, which the domain controller provides. | ## Contact support Contact support with the node's name, IP address, and your customer reference number (CRN), the exact error text, and when it happened.