Install Active Directory on a Windows Server 2025 VPS

Active Directory Domain Services, usually shortened to AD DS, centralises an organisation's users, computers, Kerberos authentication, group policies and resource access. It can run on a Windows Server VPS, provided you treat the domain controller as a critical component rather than an ordinary Windows server exposed to the Internet.

This guide explains how to create a new ad.example.com forest on Windows Server 2025, configure DNS, join a workstation, add a second domain controller, harden the service and prepare for recovery. Every PowerShell command comes with a check so you can verify each step.

Method and verification scope

The information in this guide was cross-checked on 29 August 2026 against Microsoft documentation for Windows Server 2025 and against the OuiHeberg pages covering Windows VPS, firewalls and backups. The commands were compared with the official PowerShell references. Before using them in production, run the procedure on a test VPS: addressing, network interfaces, firewall rules and the backup system all depend on your own infrastructure.

This guide creates a new forest. To add a controller to an existing domain, migrate an older domain or replace a controller that holds FSMO roles, use a dedicated migration plan. Promotion in an existing environment should never be improvised.

Active Directory, domain and domain controller: the differences

AD DS is the directory service. The domain is a logical boundary containing objects, policies and a DNS namespace. The domain controller, or DC, is a server that hosts a copy of the directory and answers authentication requests.

In our example:

Item	Example value	Role
AD DNS domain	`ad.example.com`	internal namespace of the forest
NetBIOS name	`EXAMPLE`	short name compatible with legacy usage
First controller	`DC01.ad.example.com`	AD DS, DNS, global catalog and initial FSMO roles
DC01 private address	`10.50.0.10`	address used by domain members
Second controller	`DC02.ad.example.com`	AD DS and DNS redundancy
DC02 private address	`10.50.0.11`	clients' second DNS server

AD DS is not Microsoft Entra ID. Entra ID is a cloud identity service aimed at Microsoft 365 and modern applications. AD DS provides the traditional Windows domain protocols, including Kerberos, LDAP, integrated DNS and GPOs. The two technologies can be connected, but one does not automatically replace the other.

Can you really run a domain controller on a VPS?

Yes, Windows Server supports virtualised domain controllers. The important question is not "physical or virtual", but how the service is isolated, backed up and kept available.

Use case	Minimum architecture	Verdict
Training or lab	one VPS, a test domain, VPN access	acceptable if losing the domain is tolerable
Small production	two DC/DNS servers on two VPS and, if possible, two separate hosts or sites	a reasonable minimum to avoid a single point of failure
Critical production	at least two DCs, several failure zones, off-server backups and a tested recovery procedure	recommended
DC with AD ports open to the whole Internet	a public VPS without a VPN	to be avoided entirely

A single controller can work, but its failure makes new authentications, internal DNS lookups and many administrative operations unavailable. Cached Windows credentials may still allow some sign-ins without making the domain genuinely operational.

Prerequisites

System and resources

You need an up-to-date Windows Server 2025 Standard or Datacenter, a local administrator account, a fixed IP address for the private or VPN interface used by Active Directory, a genuinely registered public domain name such as example.com, an internal subdomain reserved for AD such as ad.example.com, restricted RDP access or a rescue console, and a backup destination separate from the system disk.

As a starting point, plan for 2 vCPU and 4 GB of RAM for a very limited lab, then rather 4 vCPU, 8 GB of RAM and 80 GB of SSD storage for a small production controller. These are not universal Microsoft minimums: sizing depends on the number of objects, authentication frequency, DNS, logs and security software. Microsoft publishes an AD DS capacity planning method.

Our Windows VPS ship with full administrator access. Check the product page when ordering, as versions and specifications may change.

Private network or VPN

The controller must have a stable address reachable by domain members, for example 10.50.0.10. That address can come from a private network between VPS, a site-to-site VPN between the company and the VPS, a permanent VPN tunnel installed on each member machine, or a combination of these.

A remote workstation must be able to establish the tunnel before the Windows sign-in if it needs to contact the domain from the logon screen. A VPN that only starts after the user logs in is not enough for every Kerberos, GPO and first-logon scenario.

1. Choose the Active Directory domain name correctly

Use a subdomain of a name your organisation controls:

ad.example.com
corp.example.com
internal.example.com

Avoid a single-label name such as COMPANY, an invented suffix such as .lan, the .local extension reserved for link-local use by the mDNS standard and therefore liable to produce ambiguous resolution, and the bare public domain example.com if your website and Internet services already use that same zone and you are not in control of split DNS.

Microsoft recommends registering the top DNS level or using a subdomain of an already registered name in order to avoid collisions. See the Microsoft guidance on AD domain names and RFC 6762, which gives special semantics to names ending in .local.

The NetBIOS name is still limited to 15 characters. For ad.example.com we will use EXAMPLE.

2. Prepare the VPS before promotion

Connect over RDP, open PowerShell as administrator and start by recording the current configuration:

Get-ComputerInfo |
    Select-Object WindowsProductName, WindowsVersion, OsBuildNumber

Get-NetIPConfiguration
Get-NetAdapter
Get-DnsClientServerAddress
Get-NetFirewallProfile |
    Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction

Keep this information in your operations records. A mistake in the gateway, prefix or interface can cut RDP off immediately.

Install updates

Install the available Windows updates and reboot before adding AD DS. Our guide on getting started with a Windows VPS covers the initial connection and Windows Update.

After the reboot:

Get-HotFix |
    Sort-Object InstalledOn -Descending |
    Select-Object -First 10

Rename the server

Choose a lasting name before promotion:

Rename-Computer -NewName "DC01" -Restart

Reconnect once the server has restarted, then check with hostname. Renaming a controller after it has gone into production is possible in some scenarios, but needlessly risky for a first deployment.

3. Fix the addressing without losing access to the VPS

A domain controller must not change address at the whim of a DHCP lease. On a VPS the public IPv4 address is usually already reserved, but the way it is configured depends on the host. Never replace the address, prefix or gateway with the examples below.

To display the current values:

Get-NetIPConfiguration -All
Get-NetIPAddress -AddressFamily IPv4 |
    Sort-Object InterfaceIndex
Get-NetRoute -DestinationPrefix "0.0.0.0/0"

The Microsoft syntax for creating a fixed address is as follows:

# SYNTAX EXAMPLE: replace every value with the ones actually assigned to you.
New-NetIPAddress `
    -InterfaceAlias "Ethernet" `
    -IPAddress "<ASSIGNED_IP>" `
    -PrefixLength <PREFIX> `
    -DefaultGateway "<GATEWAY>"

If the public address is already configured correctly, do not recreate it.

Recommended case: separate public and private interfaces

Assume an Ethernet Public interface carrying the public IPv4 address used for restricted administration, and an AD-Private interface carrying the 10.50.0.10 address used by AD DS and DNS.

Check the exact names first:

Get-NetAdapter |
    Select-Object Name, InterfaceDescription, Status, MacAddress

Prevent the public address from being published in the domain's DNS zone:

Set-DnsClient `
    -InterfaceAlias "Ethernet Public" `
    -RegisterThisConnectionsAddress $false

Set-DnsClient `
    -InterfaceAlias "AD-Private" `
    -RegisterThisConnectionsAddress $true

Microsoft documents this precaution for multihomed controllers with an interface that must not be registered in DNS. After promotion, check for and delete any unwanted leftover A record.

Configure the future DC's client DNS

For the new domain's first and only DNS server, point the private interface at its own stable address:

Set-DnsClientServerAddress `
    -InterfaceAlias "AD-Private" `
    -ServerAddresses "10.50.0.10"

Get-DnsClientServerAddress `
    -InterfaceAlias "AD-Private" `
    -AddressFamily IPv4

This replaces any DNS servers supplied by DHCP on that interface. After installation, the local DNS service will resolve the AD zone and pass other queries to forwarders. See the Microsoft DNS recommendations for domain controllers.

4. Install the AD DS role

Open PowerShell as administrator:

Install-WindowsFeature `
    -Name AD-Domain-Services `
    -IncludeManagementTools

Check the result:

Get-WindowsFeature AD-Domain-Services |
    Select-Object Name, InstallState

InstallState must read Installed.

This step installs the role files but does not yet turn the server into a domain controller. Since Windows Server 2012, installing the role and promoting the server have been two distinct operations; dcpromo.exe is no longer the method to use. The current procedure is described in Install Active Directory Domain Services.

5. Test the prerequisites, then create the forest

Load the deployment module and start with the prerequisite check:

Import-Module ADDSDeployment

Test-ADDSForestInstallation `
    -DomainName "ad.example.com" `
    -InstallDNS

The test verifies the server's ability to create the forest without performing the promotion. Fix any blocking errors before continuing.

Choosing the DSRM password

The Directory Services Restore Mode password lets you open a recovery session when AD DS is not running. It must be different from the domain Administrator password, long and random, stored in the organisation's password vault, and accessible to the people responsible for disaster recovery.

Create the forest

$DsrmPassword = Read-Host `
    "DSRM password" `
    -AsSecureString

Install-ADDSForest `
    -DomainName "ad.example.com" `
    -DomainNetbiosName "EXAMPLE" `
    -InstallDNS `
    -SafeModeAdministratorPassword $DsrmPassword `
    -NoRebootOnCompletion:$false `
    -Force

Install-ADDSForest creates the root domain, installs DNS by default, initialises SYSVOL and restarts the server. The Microsoft cmdlet reference details every parameter.

For a forest made up entirely of Windows Server 2025 controllers you can use the highest functional level. Be careful, though: the 2025 level only accepts Windows Server 2025 as a domain controller operating system. Stay on the 2016 level if you need to be able to add DCs running 2016, 2019 or 2022. See the official AD DS functional levels matrix. When you do not specify the level parameters, the module works out default values; check them after promotion rather than assuming them.

Equivalent graphical method

Manage > Add Roles and Features;
select Active Directory Domain Services;
install the role and the tools;
click the notification, then Promote this server to a domain controller;
choose Add a new forest;
enter ad.example.com;
keep DNS and Global Catalog, then set the DSRM password;
check the NetBIOS name, the paths and the prerequisites;
start the installation and let the server reboot.

PowerShell remains preferable for reproducible documentation and a usable change log.

6. Check that the domain controller is working

After the reboot, sign in as EXAMPLE\Administrator or [email protected], then open PowerShell as administrator:

Get-ADDomain |
    Select-Object DNSRoot, NetBIOSName, DomainMode, PDCEmulator, RIDMaster

Get-ADForest |
    Select-Object Name, ForestMode, SchemaMaster, DomainNamingMaster

Get-ADDomainController -Filter * |
    Select-Object HostName, IPv4Address, Site, IsGlobalCatalog

Get-Service NTDS, DNS, Netlogon, Kdc |
    Select-Object Name, Status, StartType

Check the essential shares:

Get-SmbShare -Name SYSVOL, NETLOGON

Then test overall health and DNS:

dcdiag /v
dcdiag /test:dns /v

Resolve-DnsName `
    -Type SRV `
    "_ldap._tcp.dc._msdcs.ad.example.com"

dcdiag analyses the state of domain controllers. The DNS test checks, among other things, the SRV records used to locate LDAP, Kerberos, the global catalog and the PDC. See verify DNS for AD replication.

With a single DC, having no replication partner is normal. Do not confuse it with a DNS or SYSVOL error.

7. Configure DNS correctly

Active Directory depends on DNS to locate controllers and services. Member workstations must use only the AD DNS servers on their private or VPN adapter. Do not configure 1.1.1.1, 8.8.8.8 or your router's DNS as a member workstation's secondary DNS: Windows may query it and conclude that the internal domain does not exist.

Public or host-provided DNS servers must be configured as forwarders on the AD DNS servers, not directly on the clients.

Display the configuration:

Get-DnsServerForwarder
Get-DnsServerZone

An example forwarder configuration, to be replaced by the resolvers your organisation approves:

Set-DnsServerForwarder `
    -IPAddress 1.1.1.1, 9.9.9.9 `
    -UseRootHint $true

Forwarders are used for names the AD DNS server cannot resolve locally. Their behaviour is documented in DNS Forwarding in Windows Server.

Restrict DNS to the private interface

On a VPS with a public and a private interface, restrict DNS listening to the AD address:

$DnsSettings = Get-DnsServerSetting -All
$DnsSettings.ListeningIpAddress = @("10.50.0.10")
Set-DnsServerSetting $DnsSettings

Restart-Service DNS

Check it:

Get-DnsServerSetting -All |
    Select-Object -ExpandProperty ListeningIpAddress

Make sure the private address really is reachable before removing listening on another interface.

8. Configure domain time

Kerberos depends on consistent clocks. In the AD hierarchy, members synchronise their time with the domain, and the controller holding the root forest's PDC Emulator role must use a reliable external NTP source. Microsoft states that only the root PDC should reach that source directly; other DCs follow the domain hierarchy. See the AD DS time hierarchy.

Identify the PDC:

netdom query fsmo

On that PDC only, replace the names with two approved NTP sources:

w32tm /config `
    /manualpeerlist:"<NTP1>,0x8 <NTP2>,0x8" `
    /syncfromflags:manual `
    /reliable:yes `
    /update

Restart-Service w32time
w32tm /resync /rediscover
w32tm /query /source
w32tm /query /status

Allow outbound UDP 123 to those sources. After any change, check the source that is actually displayed instead of assuming the command was enough.

9. Create an OU structure, a user and a group

Do not put every object in the default containers. Organisational units make delegation, GPOs and the separation between workstations, servers and accounts far easier.

Import-Module ActiveDirectory

$BaseDn = (Get-ADDomain).DistinguishedName

@(
    "Users",
    "Groups",
    "Workstations",
    "Servers",
    "Service accounts"
) | ForEach-Object {
    New-ADOrganizationalUnit `
        -Name $_ `
        -Path $BaseDn `
        -ProtectedFromAccidentalDeletion $true
}

Create a security group:

New-ADGroup `
    -Name "GG-Support" `
    -SamAccountName "GG-Support" `
    -GroupCategory Security `
    -GroupScope Global `
    -Path "OU=Groups,$BaseDn" `
    -Description "Support team"

Create a user without writing the password in clear text:

$UserPassword = Read-Host `
    "Temporary password" `
    -AsSecureString

New-ADUser `
    -Name "Alice Martin" `
    -GivenName "Alice" `
    -Surname "Martin" `
    -DisplayName "Alice Martin" `
    -SamAccountName "amartin" `
    -UserPrincipalName "[email protected]" `
    -Path "OU=Users,$BaseDn" `
    -AccountPassword $UserPassword `
    -Enabled $true `
    -ChangePasswordAtLogon $true

Add-ADGroupMember `
    -Identity "GG-Support" `
    -Members "amartin"

Check the result:

Get-ADUser amartin -Properties MemberOf |
    Select-Object Name, Enabled, UserPrincipalName, MemberOf

Create a named administration account separate from the everyday office account. Do not add every technician to Domain Admins: Microsoft recommends a least-privilege model and secure administrative workstations in its best practices for securing Active Directory.

10. Join a Windows workstation to the domain

The workstation must run a Windows edition that supports domain join, for example Pro or Enterprise. Windows Home cannot join an AD DS domain. See Join a computer to a domain.

Check the network and DNS on the workstation

The VPN or private network must be up. Point the workstation's DNS at the DC:

Get-NetAdapter

Set-DnsClientServerAddress `
    -InterfaceAlias "Ethernet" `
    -ServerAddresses "10.50.0.10"

Then test:

Resolve-DnsName "ad.example.com"
Resolve-DnsName `
    -Type SRV `
    "_ldap._tcp.dc._msdcs.ad.example.com"

nltest /dsgetdc:ad.example.com /force

If SRV resolution fails, do not try to join the domain using the IP address. Fix DNS.

Perform the join

$Credential = Get-Credential "EXAMPLE\Administrator"

Add-Computer `
    -DomainName "ad.example.com" `
    -Credential $Credential `
    -Restart `
    -Verbose

In production, delegate the right to join computers to a limited group instead of always using Domain Admins.

After the reboot, sign in as EXAMPLE\amartin and check the secure channel:

Test-ComputerSecureChannel -Verbose
whoami
gpresult /r

11. Which ports should the VPN allow?

Installing the role creates the necessary Windows rules, but the network firewall and the VPN must permit the traffic too. The exact list varies with the features you use.

Service	Main ports	Purpose
DNS	TCP/UDP 53	domain resolution and SRV records
Kerberos	TCP/UDP 88	authentication
NTP	UDP 123	time synchronisation
RPC Endpoint Mapper	TCP 135	RPC service discovery
LDAP	TCP/UDP 389	directory, SASL and locator traffic
SMB	TCP 445	SYSVOL, NETLOGON and group policies
Kerberos password change	TCP/UDP 464	password management
LDAPS	TCP 636	encrypted LDAP for compatible applications
Global Catalog	TCP 3268 and 3269	forest-wide searches
Dynamic RPC	TCP 49152-65535	administration, replication and RPC operations

The complete official reference is Service overview and network port requirements for Windows.

These ports must be allowed only between approved private or VPN subnets. Do not add an Any/Any Internet rule to make troubleshooting easier. RDP must also be restricted to the VPN or to known administration addresses: see our guides on configuring the Windows Server firewall on a VPS and on blocking RDP brute-force attacks.

12. LDAP, signing and LDAPS on Windows Server 2025

New Active Directory deployments on Windows Server 2025 require LDAP signing by default, through the "Domain controller: LDAP server signing requirements enforcement" policy. This protection prevents LDAP messages from being altered in transit and rejects unsigned SASL binds as well as unprotected simple binds. Microsoft describes the behaviour in LDAP signing for Active Directory Domain Services.

Do not disable LDAP signing to get an old application working quickly. Prefer, in this order:

Kerberos or Negotiate with LDAP signing;
StartTLS if the application supports it;
LDAPS on TCP 636 with a valid server certificate;
updating or replacing the application if it can only perform an unencrypted simple bind.

For LDAPS, the controller's certificate must in particular carry its FQDN in the CN or SAN, include the Server Authentication usage, hold its private key and chain to an authority the client trusts. See Configure LDAP over SSL certificates.

Even LDAPS should not be open to the whole Internet. If an external integration cannot use the VPN, restrict source addresses tightly, monitor attempts and consider an application gateway rather than exposing the DC directly.

13. Add a second domain controller

For production, create DC02 on another VPS and, if possible, in another failure zone. Connect it to the same private network or VPN.

Before joining, set its preferred DNS to DC01:

Set-DnsClientServerAddress `
    -InterfaceAlias "AD-Private" `
    -ServerAddresses "10.50.0.10"

Join DC02 to the domain:

$Credential = Get-Credential "EXAMPLE\Administrator"

Add-Computer `
    -DomainName "ad.example.com" `
    -Credential $Credential `
    -Restart

After the reboot, install AD DS then check the prerequisites:

Install-WindowsFeature `
    -Name AD-Domain-Services `
    -IncludeManagementTools

Test-ADDSDomainControllerInstallation `
    -DomainName "ad.example.com" `
    -InstallDNS

Promote DC02:

$DsrmPassword = Read-Host `
    "DC02 DSRM password" `
    -AsSecureString

Install-ADDSDomainController `
    -DomainName "ad.example.com" `
    -InstallDNS `
    -SafeModeAdministratorPassword $DsrmPassword `
    -NoRebootOnCompletion:$false `
    -Force

The syntax is described in Install-ADDSDomainController.

Once replication is running, configure client DNS crosswise: DC01 with 10.50.0.11 as preferred and 10.50.0.10 as secondary, DC02 the other way round, and members with both addresses.

Check replication:

repadmin /replsummary
repadmin /showrepl
dcdiag /e /c
dcdiag /test:dns /e /v

Two DCs on the same hypervisor, the same storage and the same network reduce software failures, but not the failure of that shared infrastructure.

14. Enable the Active Directory Recycle Bin

The AD Recycle Bin lets you restore certain deleted objects along with their attributes. It is not enabled by default and enabling it is irreversible, although using it is generally recommended once the forest has been validated.

Get-ADOptionalFeature `
    -Filter 'Name -eq "Recycle Bin Feature"' |
    Enable-ADOptionalFeature `
        -Scope ForestOrConfigurationSet `
        -Target "ad.example.com"

Check it:

Get-ADOptionalFeature `
    -Filter 'Name -eq "Recycle Bin Feature"' |
    Select-Object Name, EnabledScopes

Only objects deleted after it is enabled can be restored this way. The Recycle Bin replaces neither a system state backup nor a recovery plan. See Enable Active Directory Recycle Bin.

15. Apply a Windows Server 2025 security baseline

Microsoft provides a baseline specific to the domain controller role through OSConfig. Test it on a non-critical environment first: it hardens protocols and changes the behaviour of drive redirection in RDP sessions, which may disrupt older software or your working habits.

Install the module:

Install-Module `
    -Name Microsoft.OSConfig `
    -Scope AllUsers `
    -Force

Apply the DC baseline:

Set-OSConfigDesiredConfiguration `
    -Scenario SecurityBaseline/WindowsServer/2025/DomainController `
    -Default

Check compliance:

Get-OSConfigDesiredConfiguration `
    -Scenario SecurityBaseline/WindowsServer/2025/DomainController |
    Format-Table `
        Name, `
        @{Name="Status"; Expression={$_.Compliance.Status}}, `
        @{Name="Reason"; Expression={$_.Compliance.Reason}} `
        -AutoSize `
        -Wrap

Microsoft documents the prerequisites, effects and commands in Configure Windows Server 2025 security baselines.

Other essential measures:

keep Windows Defender running and monitored;
install security updates promptly;
ban web browsing, email and office software on the DC;
do not host IIS, SQL Server, a game server or end-user tools on the controller;
use separate, named privileged accounts;
restrict RDP to the VPN or to administration IP addresses;
audit the Domain Admins, Enterprise Admins and Administrators groups;
keep the DSRM secret in a vault;
monitor the Directory Service, DNS Server, DFS Replication, System and Security logs.

16. Back up Active Directory properly

A VPS snapshot is useful for certain infrastructure scenarios, but it must not be your only Active Directory recovery method. Microsoft provides restore mechanisms suited to virtualised DCs and recommends a System State backup in its forest recovery guide.

Install Windows Server Backup:

Install-WindowsFeature Windows-Server-Backup

Run a system state backup to a separate volume, here E::

wbadmin start systemstatebackup `
    -backuptarget:E: `
    -quiet

List the available versions:

wbadmin get versions -backuptarget:E:

The destination media must not be the VPS's only system disk. Copy or replicate the backup to separate storage, with a retention policy and access control. Our guide on backing up a Windows VPS presents several general methods; for a domain controller, make sure the method you choose really covers system state.

A backup is only credible once you have tested restoring it on an isolated network. Document who may trigger the restore, where the media and keys are, the DSRM password, the order in which controllers are recovered, the non-authoritative or authoritative restore procedure, and the date and duration of the last successful test.

17. Health checks worth automating

Run these regularly:

dcdiag /e /c
dcdiag /test:dns /e /v
repadmin /replsummary
netdom query fsmo
w32tm /query /status
w32tm /query /source

Also check the shares and services:

Get-SmbShare -Name SYSVOL, NETLOGON

Get-Service NTDS, DNS, Netlogon, Kdc, DFSR |
    Select-Object Name, Status, StartType

Some useful metrics: free space on the system volume, replication queues and errors, DNS failures and missing SRV records, time offset and source, stoppages of NTDS, DNS, Netlogon, Kdc or DFSR, changes to privileged groups, authentication failures and unusual lockouts, and the age and outcome of the last backup.

18. Troubleshooting common errors

Symptom	Likely cause	Check and fix
"The specified domain either does not exist or could not be contacted"	the workstation is using a public DNS server or is not on the VPN	`ipconfig /all`, `Resolve-DnsName` and `nltest /dsgetdc:ad.example.com /force`
Promotion reports a dynamic IP address	interface still on DHCP or an unstable VPN address	check `Get-NetIPConfiguration` and fix the address to match your infrastructure
The server answers with its public IP in DNS	the public interface is registering dynamically	disable its DNS registration, restrict listening and delete the incorrect A record
`SYSVOL` or `NETLOGON` missing	incomplete AD or DFSR initialisation	review `dcdiag`, the DFS Replication log and the promotion errors
GPOs do not apply	DNS, SMB 445, RPC or SYSVOL unavailable	`gpresult /h`, `Test-NetConnection`, `Get-SmbShare` and the GroupPolicy logs
Kerberos error although the password is correct	clock offset or wrong NTP source	`w32tm /query /status`, `w32tm /query /source` and the PDC role
RDP lost after promotion	firewall profile switched from Public to Domain, or a badly scoped rule	use the rescue console, check the profiles and the RDP rules
`repadmin` reports 1722 RPC unavailable	port 135, dynamic RPC, DNS or VPN routing blocked	test DNS, TCP 135 and the RPC range between DCs only
An old LDAP application no longer connects	Windows Server 2025 requires LDAP signing	update the application or configure signed SASL, StartTLS or LDAPS; do not disable the protection globally
The workstation joins the domain but cannot open a first session off site	VPN only available after sign-in	deploy a machine tunnel or perform the first sign-in on the private network
The second DC does not replicate	its DNS pointed at a public resolver before promotion	point DC02 at DC01, rerun the DNS diagnostics then replication

Always start with DNS, time and the logs. A large share of Active Directory errors that look like Kerberos, replication or GPO problems are actually caused upstream by faulty name resolution.

Go-live checklist

The domain uses a subdomain of a name you genuinely control.
DC01 has a fixed private or VPN address.
No AD port is exposed to the whole Internet.
RDP is restricted to the VPN or to administration addresses.
The public interface does not register its address in AD DNS.
Clients use only DC01 and DC02 as DNS servers.
External forwarders are configured on the AD DNS server.
dcdiag and the DNS test show no blocking errors.
The PDC's NTP source has been verified.
SYSVOL and NETLOGON are present.
A second DC and DNS server exists for production.
Replication between DCs is healthy.
The AD Recycle Bin has been evaluated and enabled if chosen.
The Windows Server 2025 baseline was tested before being applied.
An off-server System State backup is scheduled.
A restore has actually been tested.
Administrator accounts are separate from everyday accounts.
Privileged groups and logs are monitored.

Frequently asked questions

Can Active Directory use only the VPS public IPv4 address?

Technically the service can listen on that address, but exposing its ports to the Internet is inadvisable. Use a stable private address carried by a private network or a VPN. The public address should serve controlled administration, ideally over a VPN as well.

Is a single VPS enough?

For a lab, yes. For a company, a single DC is a single point of failure for DNS, Kerberos and the directory. Add at least a second controller in a different failure zone and configure clients with both DNS servers.

Can I use a .local domain?

It is better to use a subdomain of a registered name, such as ad.company.com. That choice avoids collisions with mDNS resolution and simplifies certificates, identities and future integrations.

Why should a workstation not have a public DNS server as its secondary?

Windows does not treat the second DNS server as a mere fallback queried only when the first one is offline. It may use it and receive an answer stating that the internal zone does not exist. Domain workstations must query the AD DNS servers, which in turn pass Internet queries to their forwarders.

Does Active Directory require LDAPS?

Windows mechanisms use Kerberos and signed LDAP among others. For an application performing an LDAP bind with a username and password, use a protected method such as signed SASL, StartTLS or LDAPS. Windows Server 2025 enforces LDAP signing by default on new deployments.

Is a snapshot enough to back up the DC?

Not as your only strategy. Keep a System State backup compatible with AD recovery, an off-server copy and a tested procedure. Hypervisor snapshots can complement the setup, not replace preparation for a forest restore.

Can other software be hosted on the controller?

Avoid it. A DC should be dedicated to AD DS, DNS and the components strictly required for its administration and protection. Adding a web application, a database or a game server increases the attack surface and the risk of conflicts.

What happens if the VPN goes down?

Workstations that have already signed in may use their cached credentials, but they no longer have the full set of domain services. Kerberos, new GPOs, internal DNS lookups and access to some resources can all fail. The VPN is therefore part of the availability of your AD architecture.

Conclusion

Installing AD DS on Windows Server 2025 takes only a handful of commands. Building a reliable domain takes more: a DNS name you control, a private network, consistent DNS, correct time, two controllers, limited privileges and a tested restore.

The most important point is the network architecture. Do not turn your VPS into a public domain controller by opening all the required ports to the Internet. Connect the machines over a VPN, publish only private addresses in AD DNS and restrict RDP to authorised administrators. Once those foundations are in place, Microsoft's tools let you automate promotion, health checks, the security baseline and backups.