Windows Server core roles: AD DS, DNS, DHCP and Group Policy

The Windows Server toolkit

Windows Server is built from roles (major services) and features (supporting components) that you add as needed. The current long-term release is Windows Server 2025. You can install it with the full desktop or as Server Core, which has no graphical shell, a smaller attack surface and fewer updates. Most roles are managed remotely with Server Manager, Windows Admin Center or PowerShell.

Active Directory Domain Services

AD DS is the directory: a database of users, groups, computers and policies. A server running AD DS is a domain controller (DC). When someone signs in to a domain-joined PC, a DC checks their password using Kerberos and gives them a ticket to reach other services. Changes made on one DC are copied to the others by replication, so you should always run at least two DCs.

Use organisational units (OUs) to mirror how you manage things, not the company org chart. A common layout separates users, workstations and servers so different policies and admin rights can apply to each. Give permissions to groups, never directly to individual users.

DNS and DHCP

AD depends on DNS. Clients find domain controllers by looking up special SRV records such as _ldap._tcp.dc._msdcs.example.local. For this reason, domain-joined machines must use the internal DNS servers, not a public resolver. DCs usually run the DNS role with AD-integrated zones, which replicate with the directory.

DHCP gives clients an IP address, gateway and DNS server. On Windows Server you create a scope per subnet, add exclusions for static devices and set reservations for printers. DHCP failover pairs two servers so leases continue if one goes down. In AD, a DHCP server must be authorised before it will hand out leases, which helps stop rogue servers.

# Install roles (run in an elevated PowerShell session)
Install-WindowsFeature AD-Domain-Services, DNS, DHCP -IncludeManagementTools

# Create a new forest (prompts for the recovery password)
Install-ADDSForest -DomainName "example.local" -InstallDns

# Add a DHCP scope for 192.168.10.0/24
Add-DhcpServerv4Scope -Name "Staff" -StartRange 192.168.10.50 -EndRange 192.168.10.200 -SubnetMask 255.255.255.0
Set-DhcpServerv4OptionValue -ScopeId 192.168.10.0 -Router 192.168.10.1 -DnsServer 192.168.10.10

Group Policy

A Group Policy Object (GPO) is a bundle of settings, such as password rules, mapped drives, firewall settings or software restrictions. You link GPOs to sites, domains or OUs. They apply in the order local, site, domain, OU (LSDOU), and the last one applied wins when settings conflict. Clients refresh policy roughly every 90 minutes; gpupdate /force refreshes immediately and gpresult /r shows what applied.

Tip: never edit the Default Domain Policy for everyday settings. Create small, clearly named GPOs (for example "WS - Screen lock 10 min") so you can see and undo each change.

Common mistakes include using a public domain name you do not own for AD, pointing DCs at external DNS, running a single DC, and giving everyday accounts Domain Admin rights. Microsoft's tiered admin model recommends separate admin accounts used only for administration.