Configuring a forest root domain on Windows Server 2008 R2


This scenario is suitable mostly for test environments because it is very rarely that someone wants to do that in production (because it already exists). But of course, maybe you start creating domain environment for new company which doesn’t have it. Then this article is also for you.

This article describes only single forest, single domain scenario.

We need some details before we will start configuration.

  • Company name – which will be helpful in choosing forest/domain name
  • Network configuration – valid IP addresses range for our company, router’s IP (as default gateway)
  • ISP DNS servers on any public DNS servers –  to be able to access the Internet resources from our company
  • Services we need to run –  what additional services will be required to fulfill a company requirements

Let’s start to prepare them all.

  • Company name – Test Environment
  • Network configuration – IP addresses range; the last available IP address is a router (default gateway)
  • Public DNS servers – and (Google public DNS servers)
  • Services – Active Directory: Directory Services, DNS server(s), DHCP server(s)

Now, we can install our first Windows Server 2008 R2 and configure it. After that we will be able to promote this box as a Domain Controller.

When our server is installed, then we need to log on there on local administrator account and we can start its preparation.

Open Network Card configuration and set up static IP address for your server (in this case it’s with network mask)

This is very important part of network configuration before promoting server as a Domain Controller. In DNS preferred IP address type (loopback interface) or the same IP address as server is configured to point the server to DNS itself.

Network card configuration

Accept configuration and start promoting server by typing in run box dcpromo

Running DC promotion

You should see Active Directory Domain Services Installation wizard. Select “Use advanced mode installation” checkbox and follow with its instructions.

Active Directory Installation wizard

This warning is not so important for us, because we have no older operating systems as Domain Controllers within network. It’s about security incompatibility between NT4 and 2008/2008R2, so let’s skip this screen.

OS security incompatibility warning

At this point, we have to choose what we want to do with domain configuration. As this article is about forest root domain, we don’t have to consider another option, now. We are creating completely new domain in a new forest.

A forest root domain creation

You will see a window with question about forest root domain name. It’s good to set up name related with your company. This is so called FQDN (Fully Qualified Domain Name or also known as DNS Domain Name). Create internal domain name to separate it from your external (if it would be necessary, i.e. for e-mail) with .local or .private suffix. These suffixes suggest that DNS domain is for local resources and this is also connected with your local DNS zone name.

DNS domain name

now, specify NetBIOS domain name

NetBIOS domain name

Now, you need to choose Forest Functional Level

Setting up FFL will also configure Domain Functional Level in the same mode.

This is very important step in forest/domain configuration. This setting determines which operating systems can be promoted to Domain Controllers. As we are configuring the only single forest/domain environment it is not so difficult.

Domain Functional Level determines which operating systems can act as Domain Controllers within that particular domain. By default (in new forest/domain configuration) it suggests Windows Server 2003 which means that older OSes cannot be promoted as DCs. So, NT4 and Windows 2000 Server cannot be used in a network with AD:DS role. They still can be a domain member servers but not Domain Controllers.

When you change DFL to Windows Server 2008 then only Windows Server 2008 and 2008 R2 can be promoted to be DCs. And the last choice is Windows Server 2008 R2 – the only possible operating system for Domain Controllers is Windows Server 2008 R2.

Each domain can be set up on a different Domain Functional Levels. But they have to fulfill Forest Functional Level to be able to operate within a forest.

If you have more than one domain in a forest then you have to evaluate which one work in the lowest mode. The lowest Domain Functional Level in a forest determines the highest Forest Functional Level.

Forest Functional Level determines that all Domain Controllers in each domain cannot work on older operating system than it’s specified in FFL.

If your FFL is set up to Windows Server 2003 that means, all of Domain Controllers in a forest are based on at least Windows Server 2003.

It’s similar to other modes (2008/2008 R2)

Important! When you set up Domain/Forest Functional level it cannot be changed to lower mode, so be careful when you choose them. If you are not sure which functional level is adequate for you, choose the lower one. You can always raise it without any business continuity disruption later.

As we don’t want to use older OSes as DCs, we plan to use only Windows Server 2008 R2, we can change Forest Functional Level to Windows Server 2008 R2. Domain Functional Level will be set up on the same level automatically.

Forest Functional Level

This is our first domain and first Domain Controller, so we need to also set up new internal DNS server to be able to use Active Directory. Whole Active Directory services rely on DNS services, so they have to be always available.

Additional roles for DC

We are configuring our first DNS server, so it doesn’t exist right now, don’t worry and continue

DNS warning

Specify Active Directory database, logs location (you can leave defaults, those files are not so huge and if server act as AD,DNS only, that’s enough space)

Active Directory files location

Set up password for Directory Services Restoration Mode which will be used in case of non-authoritative/authoritative restore or other AD database maintenance. This password should be different than Domain Administrator password and should be also changed regularly.

DSRM password

On the summary screen, you can review chosen settings and start server promotion process

Summary screen

After all, server reboot it’s required. You can do it manually, or select “Reboot on completion” checkbox and wait until promotion will be done

Active Directory:Directory Services installation

Congratulations! Your Domain Controller for a forest root domain is ready! You can log on, on it, using password specified during promotion process (the same password as Directory Services Restoration Mode)

A forest root Domain Controller

Log on, using domain administrator credentials into your new Domain Controller. We have to configure DNS server to send unresolved DNS queries to ISP DNS server(s) or any other public DNS server(s). This configuration is necessary to be able to access the Internet resources from our internal network.

Open DNS management console from Administrative Tools and select server name. In the right pane at the bottom of that window, double click on Forwarders

Configuring forwaders on DNS server

You should see a window, where you can put ISP or public DNS servers. Click on “Edit” button to add those servers IP address

Configuring forwarders on DNS server

Enter IP addresses of external DNS servers and wait for their validation. If everything is ok, you would see green shield next to IP addresses.

Configuring forwarders on DNS server

Close DNS management console.

After all, you should consider Domain Controller and DNS server redundancy in your network by placing additional server with these roles. Another very important part is performing System State backup of Domain Controllers regularly.

In case of lack hardware resources in your network, you can consider placing DHCP server on this Domain Controller. However, it’s not recommended to install additional roles on DCs because of security reasons.

Above, topics would be described in another articles.

It’s done.

Author: Krzysztof Pytko


8 responses to “Configuring a forest root domain on Windows Server 2008 R2”

  1. kflabs says :

    If you are saying about test environments, it would be nice to explain the basis such as what is default gateway in your configuration and how did you configure VMs settings. With those small topics it would be great start-up guide for people who want to prepare their first domain-based test env.

    Anyway, it’s really good job! You’re always first, even though I’ve started to think about something similar about half year ago. 🙂

    Looking forward for some beer with you!

    • iSiek says :

      Thank you! I wanted to make this article as clear as possible about Directory Services.
      VM is another category in my mind for the future articles (Hyper-V and VMWare solutions). And I’m sorry about undiscussed networking part in the article. I think I can try to describe some basis.
      Thank you for highlighting this part.

  2. Best Price for Garmin 1490t says :

    Greetings, You write some great blogs. I examine back right here always to learn if you have kept up to date. I idea you’ll be able to wish to know, once I click your RSS feed it re-directs me to an additional website.

  3. Santosh Bhandarkar says :

    Nice Articles. Quite useful and informative. Keep up the good work. Cheers 🙂

  4. L Li says :

    Thank you. This article is very useful.

  5. Denny says :

    Hi ,

    This is Denny, the creator of this free automated employee
    provisioning/termination app– Z-hire. I wrote this app for the TechNet community a year ago.

    Since you run a very informative blog, I would like your help
    spread the word. Since my application is free, i need supporters from the
    community. It would means a lot if you can help.

    Here is a link to my app



Leave a Reply

Your email address will not be published. Required fields are marked *