Active Directory DNS and DHCP Setup Order on Windows Server 2025
Active Directory, DNS and DHCP are not three separate chores — they are one system in three parts. Install them in the order they depend on each other and each wizard feels easy. Install them out of order and each one blames the others.
✍️ Technical Anshu🪟 Windows Server 2025⏱️ Domain setup guide
🎥 Watch the complete Server 2025 setup in the video — install, roles and hardening, step by step
New admins often ask which role to install "first" as if it were a matter of taste. It is a matter of dependency. Active Directory cannot work without DNS, so its promotion wizard builds the DNS zone for you. DHCP in a domain must be authorized by Active Directory before it will serve a single address. The order writes itself: AD DS with DNS first, DHCP second, proof with a real client third.
The dependency order (checklist)
✅ Static IP, final name, time zone set
✅ All Windows updates installed, no restart pending
✅ AD DS role installed, server promoted — DNS zone created with it
✅ DNS reverse lookup zone and forwarders configured
✅ DHCP role installed, authorized in AD, scope activated
✅ One client PC joined and tested with a domain login
Six boxes, in this order. Tick them top to bottom and the domain builds itself.
1
Active Directory First — Because DNS Rides With It
Active Directory lives and dies by DNS: clients find the domain controller by asking DNS, not by shouting into the network. That is why installing the AD DS role and promoting the server automatically installs the DNS Server role and creates the zone for your domain, with the records AD needs, in one pass.
In Server Manager choose Add Roles and Features → Active Directory Domain Services, and accept the management tools it offers
Or in PowerShell: Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
Promotion comes next — installing the role alone does not make a domain controller yet
2
Promote Carefully — Forest, Domain Name and the DSRM Password
The deployment wizard asks three questions whose answers are hard to change later, so answer them like you mean them.
Add a new forest — this is the first domain controller in a brand-new domain
Root domain name — the modern pattern is a subdomain of a domain you own, such as ad.company.com. A name ending in .local still works inside a closed office, but the subdomain pattern ages better. Avoid a name that belongs to somebody else
DSRM password — the Directory Services Restore Mode password is the emergency key for repairing or restoring AD itself. Set it strong and store it in the vault; forgetting it is a very bad day
Let the wizard run its prerequisite checks, accept the DNS delegation warning for a first forest (it is expected), and restart when promotion finishes
The PowerShell route for the same job is Install-ADDSForest -DomainName 'ad.company.com' -InstallDns — same decisions, fewer clicks.
3
Finish DNS Like an Adult — Reverse Zone and Forwarders
Promotion creates the forward zone; two small jobs remain that separate a tidy domain from a mysterious one.
Create a reverse lookup zone for your subnet in the DNS console, so addresses translate back to names — some software quietly insists on it
Set forwarders to your ISP's resolvers or a public DNS service, so the server can resolve internet names for clients
Test honestly: nslookup ad.company.com (your domain) should be answered by your server, and a public name should resolve through the forwarders
Confirm the server's own network adapter still points DNS at itself — promotion usually sets this, but verify rather than trust
4
DHCP Second — and It Must Be Authorized Before It Serves
Now the address service. Install the DHCP Server role, then complete the post-install configuration, whose key act is authorization in Active Directory. In a domain, an unauthorized DHCP server simply refuses to hand out addresses — a deliberate defence against rogue servers appearing on the network.
Create the scope for your LAN, for example Add-DhcpServerv4Scope -Name 'Office LAN' -StartRange 192.168.1.100 -EndRange 192.168.1.200 -SubnetMask 255.255.255.0
Keep the server's own static range outside the scope, and add exclusions for any other fixed devices inside it
Set the scope options clients live by: router = your gateway, DNS server = the domain controller's address — never a public DNS, or domain logins will suffer
If the router was handing out addresses until today, switch its DHCP off. Two DHCP servers on one LAN is a lottery nobody wins
5
Prove It With One Client Before You Announce Anything
A domain is not finished when the wizards close. It is finished when a real PC proves the whole chain.
Connect a test PC and confirm it receives an address from the new scope, with DNS pointing at the server
Join it to the domain and restart
Sign in with a domain user account you created in Active Directory Users and Computers
Browse a share, resolve an internet name, and check the time — five small proofs that AD, DNS, DHCP and the network are one working system
Only after this test do you roll the rest of the office in — in small groups, not all on Monday morning.
🔴 Order is the whole lesson: AD builds DNS, AD authorizes DHCP, DNS makes AD findable. Any other sequence creates the exact "it worked in the video" confusion that fills forums. Follow the dependency, not your impatience.
🎥 Watch AD, DNS and DHCP Being Built in the Video
See the promotion, the DNS finishing touches and the authorized DHCP scope on a real Server 2025 install.
Why does DHCP refuse to work until it is authorized?
Authorization is a deliberate Active Directory safeguard: only DHCP servers an admin has approved can serve addresses in a domain. It stops a random device or test server from hijacking the network's addressing. Complete the post-install wizard or use Add-DhcpServerInDC and the service starts serving.
Should my DHCP scope hand out a public DNS like 8.8.8.8 as backup?
No — not for domain clients. A PC that asks a public resolver about the domain gets no answer, and logins and drive mappings fail at random. Clients must use only the domain controller for DNS; the server's forwarders handle internet names.
Can DNS and DHCP live on the same server as Active Directory?
Yes — for a small office this is the normal, supported layout, and it is exactly what this guide builds. The roles are light. What you should keep separate is not these roles, but your data and backup targets, which belong on different volumes and disks.
This guide is based on Technical Anshu's Windows Server 2025 complete setup video • Stuck on any step? Ask in the video comments — you will get help there 🙏