Active Directory on Windows 11 requires Windows 11 Pro or Enterprise, not Home edition

Active Directory is a directory service that manages user accounts, computers, and permissions across a network. If you are running Windows 11 Home, you cannot install Active Directory at all — it is only available on Windows 11 Pro, Enterprise, or Education editions. If you have one of those versions, the installation process involves enabling the Active Directory Domain Services role through Server Manager, then promoting your machine to a domain controller.

This is a significant change to your computer. Once you promote a machine to a domain controller, it becomes a server rather than a workstation. It will handle authentication requests from other computers on your network, store user and computer objects, and manage group policies. This is not a reversible process without substantial work — demoting a domain controller requires careful planning and can cause network problems if done incorrectly.

Most small offices and home networks do not need Active Directory. If you are setting this up to learn, to test software, or to manage a small office network, understand what you are building before you start.

Key Takeaways

  • Windows 11 Home cannot run Active Directory; you need Pro, Enterprise, or Education edition.
  • Active Directory installation happens through Server Manager by adding the Active Directory Domain Services role, then promoting the machine to a domain controller.
  • Promoting a machine to a domain controller is a permanent network change that affects how the computer boots, logs in, and handles authentication.
  • After promotion, you will need to configure DNS, set up domain users, and join other computers to the domain before the network is functional.
  • If you are testing or learning, use a virtual machine rather than a production computer so you can safely undo mistakes.

Check your Windows 11 edition and hardware requirements

Open Settings, then go to System and About. Look for the Edition field. If it says Home, you cannot proceed — Active Directory Domain Services is not available on Home edition. If you see Pro, Enterprise, or Education, you can continue.

Your computer also needs at least 2 GB of RAM, though 4 GB or more is strongly recommended if you plan to run other services. You need at least 32 GB of disk space for the operating system and Active Directory database. Your machine must have a static IP address on your network — if it gets a new IP address from DHCP, domain-joined computers will lose contact with it. Before you start, assign a static IP through your router or through Windows Network Settings.

If you are setting this up on a virtual machine, that is the safest approach. You can take a snapshot before you begin, and if something goes wrong, you can revert to that snapshot without affecting your main computer.

Install Active Directory Domain Services through Server Manager

Open Server Manager. If you do not see it in your Start menu, press the Windows key, type "Server Manager", and open it. In the top right, click "Manage" and select "Add Roles and Features". The Add Roles and Features Wizard will open.

On the Installation Type screen, select "Role-based or feature-based installation". On the Server Selection screen, your local computer should already be selected. On the Server Roles screen, check the box next to "Active Directory Domain Services". A dialog will appear asking about additional features — click "Add Features" to accept them. Continue through the wizard and click "Install" at the end. The installation will take a few minutes.

After installation completes, you will see a notification flag in Server Manager with a message about promoting this server to a domain controller. You can click that notification, or you can go to the Tools menu and select "Active Directory Users and Computers" to verify the role was installed.

Promote your machine to a domain controller and create a new forest

In Server Manager, click the notification flag and select "Promote this server to a domain controller". The Active Directory Domain Services Configuration Wizard will open. On the Deployment Configuration screen, select "Add a new forest" if this is your first domain controller. Type a root domain name — for example, "company.local" or "home.local". Do not use a real internet domain name like "company.com" unless you own it and have set up DNS properly.

On the Domain Controller Options screen, set the Forest Functional Level and Domain Functional Level. For a small network, "Windows Server 2016" or later is fine. You will be asked to set a Directory Services Restore Mode (DSRM) password — this is a recovery password used if Active Directory becomes corrupted. Write this down and store it securely. On the DNS Options screen, you can create a DNS zone automatically — this is usually the right choice for a new forest.

Continue through the wizard. The machine will restart automatically. After restart, your computer is now a domain controller. The login screen will change — instead of a username field, you will see a domain selector. Log in with your domain administrator account, which is usually "Administrator" in the domain you created.

Configure DNS and verify Active Directory is working

After promotion, DNS must be working correctly for domain-joined computers to find the domain controller. Open Server Manager and go to Tools, then DNS. In DNS Manager, expand your server name and then expand Forward Lookup Zones. You should see your domain name listed. Click on it and verify that you see an "A" record pointing to your domain controller's IP address, and an "SRV" record for "_ldap._tcp.dc._msdcs" pointing to the same address.

If these records are missing, right-click your domain name and select "New Host". Create an A record with the domain controller's hostname and its static IP address. If you are unsure whether DNS is set up correctly, open Command Prompt and type "nslookup company.local" (replacing "company.local" with your domain name). If it returns your domain controller's IP address, DNS is working.

To verify Active Directory itself is working, open Active Directory Users and Computers from Server Manager Tools. You should see your domain name in the left panel. Expand it and you will see organizational units like "Computers", "Users", and "Domain Controllers". If you see these, Active Directory is running.

Join other computers to the domain

On each Windows computer you want to join to the domain, open Settings, go to System, then About. Click "Rename this PC (advanced)". In the System Properties dialog, click "Change". In the Computer Name/Domain Changes dialog, select the "Domain" radio button and type your domain name (for example, "company.local"). Click OK. You will be prompted for a domain administrator username and password — use the Administrator account you created during promotion.

The computer will restart. After restart, the login screen will show a domain selector. You can now log in with a domain user account instead of a local account. To create domain user accounts, go back to the domain controller, open Active Directory Users and Computers, right-click the Users organizational unit, and select New, then User. Fill in the user details and set a password.

Once computers are joined to the domain, they will authenticate against the domain controller instead of using local accounts. If the domain controller is offline, domain users cannot log in to those computers.

Understand the ongoing responsibilities of running a domain controller

A domain controller is not a set-it-and-forget-it service. Your machine must stay online and reachable on the network at all times. If it goes offline, users on domain-joined computers cannot log in, and network services that depend on Active Directory will fail. You need to plan for backups of the Active Directory database, monitor disk space, and keep Windows updates current.

If you are running this on a single machine in a small office, consider what happens if that machine fails. You will have no way to authenticate users or manage the network until it is repaired. Many organizations run at least two domain controllers for this reason, though that adds complexity.

If you are testing or learning, use a virtual machine and take regular snapshots. If you are setting this up for a real network, document your domain name, DSRM password, and the IP address of your domain controller in a safe place. You will need these if something goes wrong.

Frequently Asked Questions

Can I install Active Directory on Windows 11 Home?

No. Active Directory Domain Services is only available on Windows 11 Pro, Enterprise, and Education editions. If you have Home edition, you cannot install it. You would need to upgrade to Pro or use a different machine.

What happens if I demote the domain controller after I set it up?

Demotion is possible but risky. You must demote carefully using the Active Directory Domain Services Configuration Wizard, and all domain-joined computers must be able to reach the domain controller during the process. If you demote incorrectly, domain-joined computers may become unable to log in. Always test demotion in a virtual machine first.

Do I need a second domain controller for a small network?

Not required, but recommended if the network is important. A single domain controller is a single point of failure — if it goes offline, users cannot log in. A second domain controller provides redundancy. For a home lab or small test network, one is fine.

What is the difference between a domain controller and a regular computer on the domain?

A domain controller stores the Active Directory database and handles authentication for the entire domain. A regular computer joined to the domain authenticates against the domain controller but does not store the database. You need at least one domain controller; you can have many regular computers.

Can I use a domain name like "company.com" for my local network?

Only if you own that domain and have set up DNS correctly. If you use a real internet domain name without owning it, you may have conflicts with the actual internet domain. Use a local-only name like "company.local" or "office.local" instead.