Troubleshooting Active Directory on a Windows node

Active Directory on a Windows node lets you manage your Windows nodes as one domain. Promote one Windows Server node into a domain controller, then join the rest to its domain. These are the Windows nodes you create in MyAccount; see Connect to a Windows node to get onto one. Both steps are below, with the issues that come up most often during setup.

Promote a node to a domain controller

Only a Windows Server edition can act as a domain controller. You add the role, then run the promotion wizard; the server reboots into its domain controller role at the end.

Add the Active Directory Domain Services role

Open Server Manager and click Add Roles and Features. The wizard asks which server and which role: check Active Directory Domain Services and accept the features it adds with it. When the wizard finishes, a yellow triangle warning appears in the Server Manager menu bar. That warning means the role is installed and waiting for post-deployment configuration.

Promote the server

Click the warning, then click Promote this server to a domain controller to open the promotion wizard. Then go through its screens:

1. On Deployment Configuration, choose Add a new forest and enter the Root Domain Name of your domain, such as corp.example.com. Click Next.
2. On Domain Controller Options, leave the defaults and set a Directory Services Restore Mode (DSRM) password. DSRM is the recovery mode of a domain controller; the password is a separate administrator credential, not the one you sign in with normally. Record this password securely. You use it only to recover the domain controller, not to sign in normally, but you need it if that recovery ever happens.
3. On DNS Options, the wizard warns that it cannot create a delegation because it cannot find the authoritative parent zone. Expect this warning on the first domain controller of a new forest. Click Next.
4. On Additional Options, confirm the NetBIOS domain name, then click Next. NetBIOS is the short network name Windows uses for the domain, such as CORP; it is an older naming system that Windows still relies on for compatibility.
5. On the paths screen, leave Database, Log files, and SYSVOL at their defaults. Click Next. SYSVOL is the shared folder that stores the domain’s group policy and logon scripts, which the domain’s computers read from.
6. Review the summary. To change anything, use Previous; otherwise click Next.
7. The wizard runs its Prerequisites Check. Fix anything it lists and re-run; when every check passes, click Install.
8. The server restarts automatically once promotion completes. After the restart it is a domain controller and AD DS is running.

Join a client node to the domain

On each Windows node you want in the domain:

1. Open Server Manager → Local Server and click WORKGROUP.
2. Click Change.
3. Enter the Domain Name of your domain controller. Click OK.
4. In the Computer Name / Domain Changes dialog, click OK, then restart the client node.

On the domain controller, confirm the join in Server Manager → Tools → Active Directory Users and Computers → Domain Controllers. On the client, open Network & Internet settings and confirm the domain membership.

Common Active Directory issues

Symptom	What to do
Promotion refuses with a “static IP required” message	Set a static IPv4 address on the server before promoting it. A domain controller cannot use a DHCP-assigned address.
The yellow warning triangle does not appear after the role install	The role may not be installed. Add it from Server Manager → Add Roles and Features → Active Directory Domain Services.
“Cannot create DNS delegation” warning	Expected on the first domain controller of a new forest. Click Next.
Prerequisites check fails with a NetBIOS name conflict	Choose a different NetBIOS domain name that is not in use on the network.
Forgot the DSRM password	Reset it with ntdsutil from an elevated Command Prompt on the domain controller, or boot into DSRM if a normal domain logon is not available. Store the new password securely.
Client cannot find the domain	Point the client’s primary DNS server at the domain controller’s IP. The client must use the domain controller for DNS, not a public resolver.
Domain join fails with an “incorrect credentials” message	Use a domain account with rights to join machines, usually the domain administrator.
Server Manager → Tools shows no AD tools after promotion	Sign out and back in, or reboot. The Remote Server Administration Tools register on first logon after promotion.
Client joined but Group Policy is not applying	Confirm DNS points at the domain controller, then run gpupdate /force on the client.
Time skew error during a domain join	The domain controller and client must agree on time. Sync the client’s clock; the default w32time configuration with the domain controller as the time source is usually enough. w32time is the Windows service that keeps the clock in sync with a time source, which the domain controller provides.

Contact support

Contact support with the node’s name, IP address, and your customer reference number (CRN), the exact error text, and when it happened.