Docs

Elastic Compute Service

Setting up AD Domain Services on Windows OS

Setting up AD Domain Services with a single domain controller

This topic uses the Windows Server 2022 Datacenter operating system as an example to describe how to deploy Windows Active Directory (AD) Domain Services with a single domain controller.

About AD Domain Services

AD Domain Services is a core directory service provided by Microsoft for the Windows Server operating system. Essentially, it is a centralized, hierarchical database designed to store and manage information about all resources in a network environment. Its core value lies in the unified management and authentication of users, computers, policies, and resources. This enables administrators and network users to easily locate and utilize such information, thereby achieving efficient and secure centralized management. Learn more.

Scenarios suitable for deploying a single domain controller:

Small-sized organizations (such as teams with fewer than 50 members) that require low costs and minimal maintenance efforts.

Testing/experimental environments used for functional verification or short-term projects.

Temporary branch offices that do not demand high availability and can restore services via domain service backups from the headquarters.

Prerequisites

Purchase two ECS instances running the Windows Server operating system (Windows Server 2022 Datacenter is used in this topic). One of them will serve as a domain controller (DC) and the other one as a client. Learn more.

Prepare the instance network environment

Network information: A VPC is adopted as the network type in this topic, with the CIDR block set to 192.168.0.0/24.

Domain name information: Prepare the domain name information. example.com is used as the sample domain name in this topic.

Private IP addresses of instances:

Private IP address of the instance serving as the DC: 192.168.3.126

Private IP address of the instance serving as the client: 192.168.3.128

warning

Make sure that both instances support the DNS service and the TCP/IP protocol.

After you set up an AD domain, make sure that the IP address associated with the ECS instance is fixed all the time. Otherwise, you may fail to access the ECS instance.

We recommend that you do not create a custom image from an existing domain controller instance and then deploy new domain controller instances using this custom image. If this method has to be used, make sure that the hostname of the newly created instance is the same as that of the original domain controller instance. Otherwise, an error message "The security database on the server does not have a trust relationship for this workstation" may appear. Or, after you create the instance, change its hostname to the existing instance hostname to avoid this issue.

Procedure

Step 1: Deploy DC for the AD domain

Click "Start > Server Manager".

In the "Server Manager" window, click "Add roles and features".

In the pop-up "Add Roles and Features Wizard" window, click the "Next" button to enter the "Select installation type" page.

On the "Select installation type" interface, select "Role-based or feature-based installation", and then click the "Next" button.

On the "Select destination server" page, keep the default settings and click "Next".

On the "Select server roles" page, select "Active Directory Domain Services" and "DNS Server" in sequence.

On the "Confirm installation selections" page, click "Install" to start the installation process.

After the installation is complete, click "Close" to exit the wizard.

On the "Server Manager" page, click the triangle icon in the upper right corner, and in the pop-up window, click "Promote this server to a domain controller".

On the "Deployment Configuration" page of AD Domain Services, select "Add a new forest", enter the AD domain name (example.com is used in this topic), and then click the "Next" button.

On the "Domain Controller Options" page, configure "Type the Directory Services Restore Mode (DSRM) password", then click "Next".

On the "DNS Options" page, click the "Next" button.

On the "Additional Options" page, retain the default setting and click the "Next" button.

Specify the path to store AD data, and then click the "Next" button. In the example provided in this topic, the default settings are retained.

On the "Review Options" page, confirm the configuration information. Then, click the "Next" button.

After the prerequisite check is passed, click the "Install" button to start installing the AD domain server. After the installation is complete, the instance will automatically restart.

After logging in to the instance again, click "Start > Control Panel > System and Security > System". In the "Related settings" section, click "Rename this PC" to view the installation result.

Step 2: Modify the Security Identifier (SID) of the client

Access the official website of the sidchg tool via a browser and download sidchg.

Execute the following command in Windows PowerShell to run sidchg.

C:\Users\Administrator\Downloads\sidchg64-3.0n.exe /R

tip

Replace C:\Users\Administrator\Downloads\sidchg64-3.0n.exe with the actual path where sidchg is located.

Follow the on-screen instructions to input the license key or trial key and press "Enter" to confirm.

tip

You can go to the Stratesave official website to obtain a trial key.

If the sidchg tool is blocked by Windows Security Center and cannot run, add the sidchg tool process to the exclusion list in Security Center based on the error message.

Click "Start > Windows Security".

In the left directory tree, select "Virus & threat protection". Then in the "Virus & threat protection settings" section, click "Manage settings".

In the "Exclusions" section, click "Add or remove exclusions".

Click "Add an exclusion" and select "Process". Enter the process name of the sidchg tool specified in the error message (in the example provided in this topic, C:\Windows\Temp\sidchg64_.exe is used), and then click "Add".

Follow the on-screen instructions to enter Y and press "Enter" to confirm SID resetting.

tip

During the reset, the system is restarted.

Log in to the instance again, and execute the following command in Windows PowerShell to check whether the SID is modified.

whoami /user

If the following output is displayed, the SID is modified.

Step 3: Add the client to the AD domain

Modify the DNS server address.

Click "Start > Control Panel > Network and Internet > Network and Sharing Center". In the "Network and Sharing Center" window, click "network_0".

In the "network_0 Status" window, click "Properties".

In the "network_0 Properties" window, select "Internet Protocol Version 4 (TCP/IPv4)", and then click "Properties".

In the "Internet Protocol Version 4 (TCP/IPv4) Properties" window, select "Use the following DNS server addresses" and enter the private IP address of the DNS server.

tip

Since both AD Domain Services and the DNS server are installed on the instance serving as the DC in Step 1, the address here should be set to the private IP address of the DC instance. In this topic, 192.168.3.126 is used as an example.

Click the "OK" button to save the changes and exit the "network_0" properties settings.

Execute the following command in Windows PowerShell to check whether the instance serving as the client can ping the IP address of the DNS server.

ping example.com

Click "Start > Control Panel > System and Security > System". In the "Related settings" section, click "Rename this PC".

In the pop-up "System Properties" window, click the "Change..." button.

In the pop-up "Computer Name/Domain Changes" window, modify the computer name as needed, select "Domain" under "Member of", enter the domain name configured in your DC instance (in this topic, the domain name is example.com), and then click "OK".

In the pop-up "Windows Security" window, enter the username and login password of the DC, and click the "OK" button.

If the window for confirmation pops up as below, this means that the instance has joined the domain.

Click the "OK" button, and restart the instance to make the configuration take effect.

tip

When you create an ECS instance serving as the client, avoid using the custom image created based on an instance that has joined an AD domain. Otherwise, in the newly created instance using such a custom image, an error is reported as "The security database on the server does not have a trust relationship for this workstation". If you need to create a custom image based on an AD-associated instance, we recommend removing the instance from the domain before using it to create a new custom image.

Last updated: 2026.06.18 17:49:51