What Active Directory does and when you need it

Active Directory is the system that manages user accounts, passwords, and permissions across a network of computers. If you have a server and multiple computers that need to share files, enforce security rules, or log in with the same username and password everywhere, Active Directory is what makes that work. It runs on Windows Server and lets you control who can access what from one central place instead of managing each computer separately.

You need Active Directory if your organization has more than a handful of computers, or if you want to enforce consistent security policies across machines. Small offices often skip it and manage each computer individually. Larger offices, schools, and companies use it because the alternative — setting up the same user account on every single machine — becomes unmanageable fast.

This guide covers installing Active Directory on a single Windows Server machine. That server becomes your domain controller, the computer that holds all the account and permission information. Other computers on your network will then join that domain and trust the domain controller to verify who people are.

Key Takeaways

  • Active Directory runs on Windows Server and manages user accounts and permissions across multiple computers from one central location.
  • You need a Windows Server machine (2016, 2019, 2022, or later) with a static IP address that does not change.
  • Installation happens through Server Manager, where you add the Active Directory Domain Services role, then promote the server to a domain controller.
  • After promotion, you create a new forest and domain name (like company.local), and other computers join that domain to use the same login credentials.
  • The process takes 15 to 30 minutes and requires a server restart.

Before you start: what you need in place

Your Windows Server must have a static IP address — one that does not change when the server restarts. Active Directory relies on other computers finding it at the same address every time. If your server's IP address changes, computers will lose contact with it and fail to log in. Check your network settings or router to assign a static IP to the server before you begin.

You also need to decide on a domain name. This is the name that will appear after the backslash when users log in (for example, COMPANY\username or SCHOOL\username). Common practice is to use something like company.local or organization.local. Avoid using a real internet domain name like company.com unless you actually own that domain and control its DNS records — mixing them up causes serious network problems. Write down the domain name you want before you start, because you cannot easily change it later.

Finally, log into the server with an account that has administrator rights. You cannot install Active Directory with a regular user account.

Adding the Active Directory Domain Services role

Open Server Manager, which appears on the Start menu or taskbar of Windows Server. In the top right, click Manage, then select Add Roles and Features. A wizard window opens.

Click Next until you reach the screen labeled Select installation type. Choose Role-based or feature-based installation and click Next. On the next screen, your server should already be selected. Click Next again.

You now see a list of roles. Scroll down and check the box next to Active Directory Domain Services. A popup appears asking whether you want to add required features. Click Add Features to accept. Then click Next three times to skip through the features and confirmation screens, and click Install on the final screen.

The installation takes a few minutes. You will see a progress bar. When it finishes, you can close this window — do not restart yet.

Promoting your server to a domain controller

Back in Server Manager, look for a notification flag in the top right corner (it often has a yellow warning symbol). Click it and select Promote this server to a domain controller. If you do not see this notification, go to Manage and choose Add Roles and Features again, then click through to the end and select Promote this server to a domain controller from the final screen.

A new window opens titled Active Directory Domain Services Configuration Wizard. Under Deployment Configuration, select Add a new forest (this is your first domain controller, so you are creating a new forest from scratch). In the Root domain name field, type the domain name you decided on earlier — for example, company.local. Click Next.

On the Domain Controller Options screen, you see a Forest Functional Level and Domain Functional Level dropdown. Leave these at their default values unless you have older Windows Server machines that must join this domain. For a new setup, the defaults work fine. Make sure the DNS server checkbox is checked. Click Next.

The wizard asks for a Directory Services Restore Mode password. This is a backup password used only if Active Directory becomes corrupted and needs repair. Type a strong password (uppercase, lowercase, numbers, symbols) and confirm it. Write this password down and store it securely — you will rarely need it, but you cannot recover Active Directory without it. Click Next.

Finishing the promotion and restarting

The wizard shows a summary of what it will do. Review it to make sure the domain name is correct, then click Next. The wizard checks for any problems. If it finds issues, it lists them on the next screen. Common issues are missing DNS or network problems — fix those before continuing. If everything looks good, click Install.

The promotion process runs and shows progress. This usually takes 2 to 5 minutes. When it finishes, you see a message saying the server will restart. Click Close. The server restarts automatically within a minute or two.

When the server comes back up, log in again with your administrator account. You may notice the login screen now shows your domain name (for example, COMPANY\Administrator instead of just the computer name). This confirms Active Directory is working.

Joining other computers to the domain

Now that your domain controller is running, other Windows computers can join the domain. On each computer you want to add, open Settings and go to System, then About. Click Rename this PC (advanced). In the window that opens, click Change.

A dialog appears with fields for computer name and domain. Leave the computer name as is (or change it if you want), then select the Domain radio button and type your domain name (company.local). Click OK. Windows asks for a username and password — use an administrator account from your domain (for example, COMPANY\Administrator and the password you use on the domain controller).

Windows confirms the join and asks you to restart. After restart, users on that computer can log in with their domain account. They type their username and password, and Windows checks with the domain controller to verify them instead of checking the local computer.

Troubleshooting common problems

If computers cannot find the domain controller, the most common cause is a network connectivity issue or a static IP address that changed. Verify the domain controller's IP address has not changed by logging into it and checking Settings > Network and Internet > Ethernet (or WiFi). If it changed, set it back to static in your router or network settings.

If a computer fails to join the domain with an error message, try restarting both the computer and the domain controller, then try joining again. If the error persists, check that the computer and domain controller can reach each other by opening Command Prompt on the computer and typing ping [domain-controller-ip] (replace with the actual IP address). If the ping fails, you have a network problem to fix before the join will work.

If users can join the domain but cannot log in, the most likely cause is that no user account exists for them on the domain controller yet. You must create user accounts in Active Directory before people can log in with them. This is done through a tool called Active Directory Users and Computers, which appears in Server Manager on the domain controller after promotion completes.

Frequently Asked Questions

Can I install Active Directory on Windows 10 or Windows 11?

No. Active Directory Domain Services only runs on Windows Server editions (2016, 2019, 2022, or later). Regular Windows 10 or 11 machines can join a domain and use Active Directory, but they cannot host it. You need a Windows Server machine to be the domain controller.

What happens if the domain controller goes down?

Computers that are already logged in will continue working, but nobody can log in to a new session until the domain controller comes back up. This is why organizations with many computers often set up a second domain controller as a backup. For a small office, a single domain controller is usually fine as long as you keep the server maintained and backed up.

Can I change the domain name after I set it up?

Changing a domain name after Active Directory is installed is extremely difficult and not recommended. Plan your domain name carefully before you promote the server. If you must change it later, you typically have to rebuild Active Directory from scratch, which means recreating all user accounts and rejoining all computers.

Do I need to buy a license for Active Directory?

Active Directory is included with Windows Server. You need a Windows Server license for the machine running Active Directory, but you do not need a separate license for Active Directory itself. Client computers (Windows 10, 11, etc.) that join the domain do not need special licenses either.

How do I create user accounts after Active Directory is installed?

On the domain controller, open Server Manager and click Tools in the top right, then select Active Directory Users and Computers. Expand your domain name in the left panel, right-click on the folder where you want to add a user, and select New > User. Fill in the user information and set a password. That user can then log in on any computer joined to the domain.