Setting Up Active Directory on a Windows VPS for Small Business

For a small business running on a Windows VPS, Active Directory Domain Services (AD DS) is the foundation of user management, policy enforcement, and authentication. Even with just 10–50 employees, a proper domain controller centralizes password policies, controls access to file shares, and enables Group Policy to standardize settings across workstations. This guide walks through setting up AD DS on a Windows VPS for small business use, from prerequisites to post-installation configuration.

Prerequisites and Server Sizing

Before installing AD DS, verify that your Windows VPS meets the baseline requirements:

Windows Server edition: Standard or Datacenter (Windows Server 2019, 2022, or 2025). The Essentials edition also supports AD DS but is limited to 50 users.
RAM: Minimum 2 GB for AD DS, but 4 GB is recommended for a small business environment with DNS and DHCP on the same server.
Disk space: At least 40 GB for the operating system plus the NTDS database, SYSVOL, and logs. The database grows slowly for a small business; 4 GB is typically enough for thousands of objects.
Static IP address: The domain controller must have a static IP. Configure it in the Windows network adapter settings, not via DHCP.
DNS: AD DS requires DNS. The installation wizard can install and configure the DNS Server role automatically.

When choosing a hosting plan, ensure the VPS provider offers full administrative access and the ability to set a static internal IP. Review the Windows VPS plans on our homepage to find a plan that meets these requirements.

Step 1: Set a Static IP Address

A domain controller cannot rely on DHCP for its IP address because DNS clients need a stable address to find the domain. Set a static IP through the network adapter settings:

Open Network and Sharing Center → Change adapter settings.
Right-click the active network adapter and select Properties.
Select Internet Protocol Version 4 (TCP/IPv4) and click Properties.
Set the IP address, subnet mask, default gateway, and DNS server (point DNS to itself, e.g., 127.0.0.1).

Alternatively, use PowerShell:

New-NetIPAddress -InterfaceAlias "Ethernet0" `
  -IPAddress 10.0.0.10 -PrefixLength 24 -DefaultGateway 10.0.0.1
Set-DnsClientServerAddress -InterfaceAlias "Ethernet0" `
  -ServerAddresses 127.0.0.1

Step 2: Install Active Directory Domain Services

Use the Server Manager or PowerShell to install the AD DS role. The PowerShell method is faster and reproducible:

# Install the AD DS role and DNS Server
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools
Install-WindowsFeature -Name DNS -IncludeManagementTools

After the role installation completes, promote the server to a domain controller. For a small business, create a new forest (the first domain controller in a new domain):

# Create a new forest with a domain name like contoso.local
Install-ADDSForest -DomainName "contoso.local" `
  -DomainNetbiosName "CONTOSO" `
  -SafeModeAdministratorPassword (ConvertTo-SecureString "YourD$RecoveryP@ss" -AsPlainText -Force) `
  -InstallDNS:$true -Force

The server will restart automatically. After reboot, log in with the domain administrator account (CONTOSOAdministrator).

Step 3: Configure DNS Forwarders

By default, the DNS server will attempt to use root hints for external DNS resolution, but configuring forwarders is more reliable. Open DNS Manager from the Tools menu, right-click the server, select Properties, and add forwarders like Google (8.8.8.8, 8.8.4.4) or Cloudflare (1.1.1.1):

Add-DnsServerForwarder -IPAddress 8.8.8.8, 1.1.1.1

Step 4: Create Organizational Units and Users

Organizational Units (OUs) let you organize users and computers and apply Group Policy at different levels. For a small business, a simple structure works well:

# Create OUs
New-ADOrganizationalUnit -Name "Employees" -Path "DC=contoso,DC=local"
New-ADOrganizationalUnit -Name "Computers" -Path "DC=contoso,DC=local"
New-ADOrganizationalUnit -Name "Groups" -Path "DC=contoso,DC=local"

# Create a security group
New-ADGroup -Name "IT_Staff" -GroupScope Global `
  -Path "OU=Groups,DC=contoso,DC=local"

# Create a user
New-ADUser -Name "Jane Doe" -GivenName "Jane" -Surname "Doe" `
  -SamAccountName "jane.doe" -UserPrincipalName "[email protected]" `
  -Path "OU=Employees,DC=contoso,DC=local" `
  -AccountPassword (ConvertTo-SecureString "InitialP@ssw0rd" -AsPlainText -Force) `
  -Enabled $true -PassThru

Step 5: Configure Group Policy

Group Policy is one of the main benefits of AD DS. Start with a baseline password policy through the Default Domain Policy:

Open Group Policy Management Console from the Tools menu.
Edit the Default Domain Policy.
Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Account Policies → Password Policy.
Set: Minimum password length 8, enforce password history 10, maximum password age 90 days.

Create additional policies for specific needs, such as mapped drives, printer connections, or security settings for remote workers.

Step 6: Join Workstations to the Domain

With the domain controller running, join client workstations to the domain. On each Windows workstation:

Go to Settings → System → About → Rename this PC (Advanced).
Under Computer Name/Domain Changes, select Domain and enter contoso.local.
Enter domain administrator credentials when prompted.
Restart the workstation.

From PowerShell on the target workstation:

Add-Computer -DomainName "contoso.local" -Restart

Step 7: Enable Remote Administration

For ongoing management, install the Remote Server Administration Tools (RSAT) on an admin workstation so you can manage AD DS, DNS, and Group Policy without RDPing to the domain controller. RSAT is available as a Windows feature: Settings → Apps → Optional Features → Add a feature → RSAT: Active Directory Domain Services and Lightweight Directory Services Tools.

Best Practices for a Small Business Domain Controller

Use a separate service account for day-to-day administration. Do not use the built-in Domain Administrator account for routine tasks.
Enable the Recycle Bin. This is enabled through Active Directory Administrative Center and allows you to restore accidentally deleted objects without a backup restore.
Back up the System State regularly. The System State includes the AD DS database, SYSVOL, and registry. Use Windows Server Backup or a third-party tool.
Monitor for replication issues. If you have more than one domain controller, run repadmin /replsummary periodically to check replication health.
Keep the server updated. Apply Windows Update monthly, especially security patches.
Consider a second domain controller for redundancy. If budget allows, a second DC on a separate VPS ensures authentication continues if the primary fails.

Security Considerations

A domain controller is the crown jewel of your network. If an attacker compromises it, they control everything. Secure your AD DS environment with these additional measures:

Disable LM and NTLMv1 authentication through Group Policy.
Enable SMB signing to prevent relay attacks.
Restrict administrative access to the DC using Protected Users security group.
Audit account logon events and review them regularly.
If the DC is internet-facing, place it behind a VPN or RD Gateway — never expose domain controller ports (389, 636, 445) directly to the internet.

Setting up Active Directory on a Windows VPS gives your small business centralized user management, policy enforcement, and a foundation for growth. If you are looking for a hosting provider that supports AD DS with full admin access, the Windows VPS plans on our homepage offer the control and resources you need for a reliable domain controller.