How to Set Up Active Directory on Windows Server 2019: Full Guide

Active Directory (AD) is the backbone of identity management in Windows-based networks. It lets you manage users, groups, computers and policies from a single centralised directory, and it remains the foundation on which most corporate networks, file shares and line-of-business applications authenticate. This guide walks you through setting up Active Directory Domain Services (AD DS) on Windows Server 2019 from a clean install all the way through to day-to-day administration.

Why Active Directory still matters

Even in an era of cloud-first deployments, on-premises AD remains central to hybrid identity. It integrates with Azure AD Connect, enforces Group Policy across thousands of endpoints, and underpins services such as file servers, print servers and SQL Server authentication. If you are weighing Windows Server against a workstation deployment, our article on Windows Server vs Windows 10 explains why AD is exclusive to the server family.

Prerequisites

• A clean installation of Windows Server 2019 (Standard or Datacenter).
• A static IP address assigned to the server.
• The server renamed to something meaningful (e.g. DC01).
• DNS configured to point to the server's own IP (AD requires DNS).
• An administrator account with a strong password and the latest cumulative updates applied.

Before you begin, decide on a forest root domain name. Use an internal namespace you control, such as corp.example.com, rather than a top-level domain you do not own. Changing a domain name after the fact is painful and often requires a full rebuild.

Step 1: Install Active Directory Domain Services

Open Server Manager > Add Roles and Features. Choose Role-based or feature-based installation, select your local server, then tick Active Directory Domain Services and accept the required management features. Click through the wizard to complete installation -- no reboot is needed at this stage. The role installs the core binaries but does not yet configure the server as a domain controller.

Step 2: Promote the Server to Domain Controller

After the role installs, click the yellow notification flag in Server Manager and select Promote this server to a domain controller. Choose Add a new forest for a greenfield deployment and enter your root domain name. Set the forest and domain functional levels to Windows Server 2016 (the highest available in 2019) and create a Directory Services Restore Mode (DSRM) password -- store this securely; you will need it for offline recovery. Accept the defaults for DNS delegation and the NetBIOS name, then let the wizard validate prerequisites and reboot.

Step 3: Configure DNS and Sites

AD installs a DNS server role automatically. After the reboot, open DNS Manager and verify that the forward lookup zone for your domain exists and contains _msdcs, _sites, _tcp and _udp SRV records. Create a reverse lookup zone for your subnet so that PTR records resolve correctly. For multi-site deployments, open Active Directory Sites and Services to define sites, subnets and replication schedules -- this ensures clients authenticate against their nearest domain controller.

Step 4: Create Users, Groups and OUs

Open Active Directory Users and Computers. Create organisational units (OUs) that mirror your company structure -- for example, by department or geography -- then add users and security groups inside them. Assign Group Policy objects (GPOs) to OUs to enforce password policies, drive mappings, software deployment and desktop configuration. Keep the default Users and Computers containers empty: GPOs cannot be linked to them, which limits your control.

Step 5: Harden and back up your domain controller

A compromised domain controller is a compromised network. Disable SMBv1, enable LDAP signing, restrict membership of the Domain Admins group, and enable Windows Defender alongside your preferred endpoint protection. Schedule regular System State backups and test authoritative restores in a lab before you ever need them in production.

Step 6: Ongoing Administration

Use Windows Admin Centre or the classic RSAT tools to manage AD day-to-day. For user and group management tips, see our guide on managing users and groups in Server 2019. For broader server care, check our monitoring and maintenance article, and if you are planning an upgrade path, our overview of Windows Server 2022's key features is a useful companion read.

Get Your Licence

Active Directory requires a valid Windows Server licence plus appropriate Client Access Licences (CALs). Licendi offers genuine Windows Server 2019 Standard licences at competitive prices with instant delivery, alongside our full range of Windows Server and CAL licences. For help choosing the right user or device CALs, see our dedicated guide on CAL licensing.

Best regards,
The Licendi Team