How to Add a Domain Controller to an Existing Domain With Checks, PowerShell, and Proof

Adding a domain controller improves resilience and scalability. However, skipping prechecks or verification can cause replication errors, Domain Name System (DNS) issues, and Group Policy failures. These problems often appear when teams attempt to add a domain controller to an existing domain without validating health or dependencies.

It is vital for MSPs and IT teams to follow a verified process to add a domain controller to an existing domain. This guide provides a clear runbook using the GUI, PowerShell, and other methods that align with best practices.

Steps to add a domain controller to an existing domain

Adding a new domain controller enhances redundancy and ensures directory availability, provided that the prerequisites are verified first. Before you add a domain controller, it is imperative to have the following requirements:

📌 Prerequisites:

• You’ll need administrative access to the target server and the Active Directory (AD) domain, along with permissions to create new domain controllers (DCs) in the site.
• This step needs an AD and Domain Name System (DNS) environment that works seamlessly.
• This requires accurate time synchronization verified against an authoritative Network Time Protocol (NTP) source, particularly for the Primary Domain Controller (PDC) Emulator and the new host.
• This requires that the following network ports be open between domain controllers:
  • Active Directory Domain Services (AD DS)
  • DNS
  • Distributed File System Replication (DFSR)
  • Remote Procedure Call (RPC)
  • Server Message Block (SMB)
• The server must be prepared with the following:
  • A static IP address
  • DNS pointing to existing domain controllers
  • Updated operating system (OS)
  • Antivirus exclusions are planned for AD DS and the System Volume (SYSVOL).

Step 1: Plan roles and run health checks

This step lets you plan properly. It can ensure that the new domain controller integrates seamlessly into your operations, helping support predictable replication and authentication across the environment.

📌 Use Cases:

• Validates readiness before you add a domain controller to an existing domain.
• Prevents introducing replication or DNS issues during promotion.

📌 Prerequisites:

• You will need to access existing domain controllers and have permission to review replication and DNS configurations.
• This requires admin rights to run diagnostic commands on current servers.

Actions:

• Decide whether the new domain controller will host DNS, act as a Global Catalog, and determine which site it belongs to.
• Confirm AD site mappings, replication health, and DNS functionality before proceeding.
• Run the following commands on PowerShell: dcdiag /v, repadmin /replsummary, and check SRV records and time sync across all domain controllers.
• Resolve any identified errors before continuing with the installation.

Step 2: Install and promote the domain controller

Promoting the server makes it an active part of the domain and prepares it for replication with existing controllers.

📌 Use Cases:

• This step provides a reliable method for adding a domain controller using PowerShell or the GUI.
• It ensures the new server joins the domain with the correct roles and replication settings.

📌 Prerequisites:

• You will need admin credentials for both the target server and the existing domain.
• This requires the AD DS role and management tools installed on the server.

Actions: 

• Install AD DS binaries and the needed management tools.
• GUI path: Server Manager > Manage > Add Roles and Features > Active Directory Domain Services > Promote server to a domain controller.
• You can also use PowerShell to access this:

Install-WindowsFeature AD-Domain-Services -IncludeManagementTools

Install-ADDSDomainController -DomainName contoso.com -InstallDns:$true -SiteName “SiteA” -Credential (Get-Credential)

• Record all outputs and summaries of prerequisite checks as evidence

Step 3: Verify health, site, and replication

This step covers post-installation checks, helping you confirm that the new domain controller is functioning correctly and is synchronized with the rest of the environment.

📌 Use Cases:

• Confirms replication, DNS, and site placement after you add a new domain controller to the existing domain.
• Detects and resolves issues clearly before they affect logons or Group Policy processing.

📌 Prerequisites:

• You will need administrative rights on all domain controllers to run health and replication commands.
• This requires access to Active Directory Sites and Services to confirm site configuration and replication.

Actions: 

1. After reboot, confirm the new domain controller is replicating properly and visible in DNS.
2. Confirm DNS registration by:
   1. Run nslookup <new-dc-hostname> to verify its A record resolves.
   2. Run nslookup -type=srv \_ldap.\_tcp.<your-domain> to ensure its LDAP SRV record is listed.
3. Verify replication health through the following steps:
   1. Run repadmin /showrepl to confirm replication partnerships are established and show no failures. Check that the Last Success time is recent.
   2. Run dcdiag /c /v for a broad health test, focusing on any errors.
   3. Run nltest /dclist:<domain> to see the new DC in the domain controller list.
4. Validate critical shares by running net share to confirm SYSVOL and NETLOGON shares are present.
5. Check site and topology via the following steps:
   1. Open Active Directory Sites and Services and confirm the new DC object is placed in the correct site.
   2. Verify that NTDS Settings under server object show expected connection objects from replication partners.

Step 4: Harden and test client impact

Hardening the new domain controller protects critical services and verifies that end users can log in, apply policies, and access resources as expected.

📌 Use Cases:

• Validates post-deployment configurations and security in accordance with domain controller best practices.
• This step will help confirm that clients and Group Policy Objects (GPOs) will operate normally after the new controller goes live.

📌 Prerequisites:

• You will need local or remote administrative access to the new domain controller.
• This requires test accounts or client systems on the same site for verification.

Actions:

• Validate time synchronization with the Primary Domain Controller (PDC) Emulator.
• Apply antivirus exclusions for NTDS and SYSVOL directories to prevent replication delays.
• Add the domain controller to backup jobs and confirm a successful system state backup.
• Perform workstation tests for logon, Kerberos authentication, and Group Policy processing using gpupdate /force and review event logs for errors.

Step 5: Review and document results

Documenting results will ensure the domain controller will meet operational standards and remain stable after deployment. This will also help in future audits and quality checks, especially when refining your entire process.

📌 Use Cases:

• This confirms long-term replication health after you add a domain controller to the existing domain.
• Creates a record of configurations, validation, and fixes for audits or peer review.

📌 Prerequisites:

• You will need access to monitoring data and command outputs from previous verification steps.
• This requires your internal QA checklist or documentation standard for domain changes.

Actions:

• Verify replication stability using scheduled checks for Distributed File System Replication (DFSR) and record updates.
• Summarize findings, resolved issues, and command outputs into a structured change record.
• Confirms that all health, replication, and site validation results meet internal QA criteria before project closure.

Step 6: Capture artifacts and rollback notes

Capturing artifacts and rollback details provides audit-ready proof of success, ensuring you can safely reverse changes if needed.

📌 Use Cases:

• Records deployment evidence for how to add a domain controller to an existing domain in compliance with change management policy.
• This ensures rollback readiness if demotion or remediation is required later.

📌 Prerequisites:

• You will need administrative rights to export logs, PowerShell transcripts, and event data from the new domain controller.
• This requires access to your organization’s change management or documentation workspace.

Action:

• Export pre- and post-promotion command outputs, event summaries, and PowerShell transcripts into an evidence packet.
• Document a rollback path using Uninstall-ADDSDomainController, and perform metadata cleanup steps if demotion becomes necessary.
• Store all artifacts in your change management workspace for audits, future references, or client validation.

⚠️ Things to look out for

Best practices for the domain controller in an existing domain

Automation touchpoint example for domain controller promotion verification and evidence

You can use a PowerShell script to automate basic health checks and collect evidence during and after domain controller promotion. You can run key health checks such as:

• dcdiag /c for general AD health
• Repadmin /replsummary for replication status
• nslookup -type=srv \_ldap.\_tcp.<domain> to confirm DNS registration
• dfsrdiag or DFSR event log queries to check SYSVOL replication
• * w32tm /query /status for time synchronization

You can save the outputs of all the abovementioned commands on the server. After this, you can zip the folder and attach it to your change record as the evidence packet.

After promotion, you can schedule the script to re-run every hour for the first 24 hours. This will let you monitor replication, DNS, and DFSR health smoothly.

Verifying and documenting the domain controller and deployment

Verifying and documenting every step ensures that the domain controller deployment is a safe and predictable process. It is prudent to run health tests first, use clear parameters during promotion, and validate replication and SYSVOL. These ensure the new controller operates predictably and supports authentication, DNS, and Group Policy without disruption.

Related topics:

• How to Add a PC to a Domain in Windows 10
• Fully Qualified Domain Name (FQDN): What It Is & What It Does
• How to Remove a PC from a Local Active Directory Domain
• How to Connect to Active Directory Remotely and Manage Users
• How to Install Active Directory (AD) Users and Computers (ADUC)