Active Directory Lab on Apple Silicon

Build a Windows Server 2025 domain controller with AD, DNS, and DHCP on your Mac.

Introduction

30 Second Summary

Every time someone at a company logs into their laptop, opens email, or prints to the office printer, there's an invisible system making it all work: Active Directory. It's the backbone of enterprise IT, and understanding it from the inside out is what separates entry-level applicants from job-ready candidates.

In this project, you will build a complete Active Directory domain lab on your Mac, simulating the IT infrastructure of a 300-person medical company called Contoso Medical Group. You'll set up a domain controller, configure DNS and DHCP services, and join a Windows 11 workstation to the domain.

What You'll Build

You can open your Mac, show a running Active Directory domain with DNS and DHCP services, domain-join a workstation live, and walk an interviewer through every troubleshooting decision you made along the way.

By the end of this project, you'll have:

  • A working Windows Server 2025 domain controller running AD DS, DNS, and DHCP on a virtual network you built from scratch.
  • A Windows 11 workstation joined to the contoso-med.local domain, receiving IP configuration automatically from your DHCP scope.
  • Real troubleshooting experience diagnosing DNS resolution failures and domain join errors that mirror the exact scenarios enterprise IT interviewers ask about.
  • Secret Mission: Build an Organizational Unit structure with users, groups, and a Group Policy Object matching a real company hierarchy.

Are there any prerequisites?

You need a MacBook with Apple Silicon (any M-series chip) and at least 16GB of RAM. You should also have basic familiarity with Windows Server concepts like roles, services, and network configuration.

Before We Start

Before you build anything, let's lock in what you're creating and why it matters. You're about to build the IT backbone for a fictional 300-person medical technology company called Contoso Medical Group, and every piece of this lab will give you a hands-on answer for your next systems administrator interview.

Install UTM and Download Windows ISOs

Before you can build any infrastructure, your Mac needs two things: a virtualization platform to run Windows virtual machines, and the operating system images (ISOs) that those VMs will boot from.

Getting these tools installed and verified now prevents debugging VM issues later when you should be focused on Active Directory. In this step, you will install UTM (the virtualization app), install CrystalFetch (the ISO downloader), and download both Windows ISOs you need for the lab.

In this step, get ready to:
  • Install UTM on your Mac and verify it launches.
  • Install CrystalFetch and download both Windows ARM ISOs.
  • Confirm all tools and files are ready for VM creation.
Install UTM on your Mac

UTM is a free, open-source virtualization app built specifically for macOS. It uses Apple's Hypervisor framework to run ARM64 operating systems on Apple Silicon at near-native speeds.

  • Open Safari and navigate to mac.getutm.app.
  • Click the Download button to download the UTM.dmg file.
  • Open UTM.dmg from your Downloads folder.
  • Drag UTM into your Applications folder.
  • Press Cmd+Space to open Spotlight Search.
  • Type UTM and press Enter to launch it.

You should see the UTM main window with a "+" button in the toolbar. This confirms UTM is installed and ready.

What is UTM?

UTM employs Apple's Hypervisor virtualization framework to run ARM64 operating systems on Apple Silicon at near-native speeds. It is completely free and open source.

The Mac App Store version is identical to the free version. The only difference is automatic updates. Either installation method works for this project.

UTM won't open?

macOS may block the app because it was downloaded from the internet. If you see a security warning, open System Settings > Privacy & Security, scroll down, and click Open Anyway next to the UTM message.

Still stuck? Help me get UTM running on my Mac.

Install CrystalFetch and download Windows ISOs

CrystalFetch is a macOS utility that downloads Windows installer ISOs directly from Microsoft's servers. You need two ISOs: one for Windows 11 (the workstation) and one for Windows Server 2025 (the domain controller).

  • Open the Mac App Store on your Mac.
  • Search for CrystalFetch and install it. Alternatively, download it from GitHub.
  • Press Cmd+Space, type CrystalFetch, and press Enter to open it.

CrystalFetch opens with options for downloading a Windows 11 ISO. This is your first download.

  • Set Version to Windows 11.
  • Set Build to the latest available.
  • Set Architecture to Apple Silicon.
  • Set Language to English (United States).
  • Click Download ISO and save the file to your Downloads folder.

How long will the download take?

The Windows 11 ARM ISO is several gigabytes. Depending on your connection speed, this could take 30 minutes to over an hour. You can continue with the next download while this one finishes.

While Windows 11 downloads (or after it completes), you need to download the Windows Server 2025 ARM ISO. This requires enabling Advanced Options in CrystalFetch.

  • In CrystalFetch, click View in the menu bar at the top of your screen.
  • Click Show Advanced Options.
  • In the All Builds list, locate Windows Server Insider Preview with an ARM (Apple Silicon) architecture.
  • Select the latest available build.
  • Click Download ISO and save the file to your Downloads folder.

Can't find Windows Server Insider Preview?

Make sure you clicked View > Show Advanced Options first. Without this, CrystalFetch only shows standard Windows 11 builds. After enabling Advanced Options, scroll through the builds list to find the Server Insider Preview entries marked for ARM.

Download failing or stuck?

CrystalFetch downloads ISOs from Microsoft's servers. If the download fails, check your internet connection and try again. If a particular build consistently fails, try selecting a different (slightly older) build number from the list.

Need more help? Help me troubleshoot my CrystalFetch ISO download.

Verify your setup

Both downloads may take a while. Once they finish, confirm everything is in place before moving on.

Before you check, what two files do you expect to see in your Downloads folder?

  • Open Finder and navigate to your Downloads folder.
  • Confirm you see two ISO files: one for Windows 11 ARM and one for Windows Server ARM. The exact file names will vary depending on the builds you selected.
  • Switch back to UTM.
  • Click the + button in the UTM toolbar.
  • Confirm you see the Virtualize option in the creation wizard that appears.

You should see Virtualize as an option (along with Emulate). This confirms UTM is ready to create high-performance ARM virtual machines on your Apple Silicon Mac.

Don't see the Virtualize option?

If UTM only shows Emulate without a Virtualize option, make sure you downloaded UTM from the official site (mac.getutm.app) and that you are running macOS on an Apple Silicon Mac (M1 or later). The Virtualize option requires Apple's Hypervisor framework, which is only available on Apple Silicon.

Still having issues? Help me get UTM's Virtualize option working.

Your virtualization platform is installed and both Windows ISOs are ready. Next up, you will use UTM and the Windows Server ISO to create your first virtual machine and install Windows Server 2025.

Create and Install the Windows Server 2025 VM

Your ISO files and virtualization platform are ready. Now it is time to build the most critical piece of infrastructure in any corporate IT environment: the domain controller.

Without this server running, no workstation can authenticate, no internal DNS name resolves, and no DHCP lease gets issued. Every enterprise of 100 to 5000 employees depends on exactly this box. You are going to create it from scratch inside UTM, install Windows Server 2025, and configure the network so it is ready to become the backbone of Contoso Medical Group.

In this step, get ready to:
  • Create a Windows Server 2025 virtual machine in UTM with the correct hardware specs.
  • Install Windows Server 2025 Standard (Desktop Experience) and set the Administrator password.
  • Configure a static IP address, DNS, and rename the server to DC01.
Create the Windows Server VM in UTM

You will build a virtual machine with enough resources to run Active Directory Domain Services, DNS, and DHCP simultaneously.

  • Switch to the UTM window on your Mac.
  • Click the + button to start creating a new VM.
  • Select Virtualize.
  • Select Windows.

Why Virtualize and not Emulate?

UTM employs Apple's Hypervisor virtualization framework to run ARM64 operating systems on Apple Silicon at near native speeds. Emulation translates CPU instructions one by one, which is slow. Virtualization runs them directly on your M-series chip, which is fast.

  • Uncheck Import VHDX Image.
  • Uncheck Install Windows 10 or higher.
  • Click Browse and navigate to your Downloads folder.
  • Select the Windows Server 2025 ARM ISO file you downloaded with CrystalFetch.

Why uncheck Install Windows 10 or higher?

That checkbox tells UTM to configure the VM for a consumer Windows installation with specific driver expectations. Windows Server uses a different installer flow, so leaving it unchecked gives you the standard server installation experience.

  • On the hardware screen, set Memory to 6144 MB (6 GB).
  • Set CPU Cores to 4.
  • On the storage screen, set the drive size to 64 GB.
  • Continue through to the summary screen.
  • Check Enable TPM 2.0 and confirm UEFI Secure Boot is enabled.
  • Click Save to create the VM.

You should see your new VM listed in the UTM sidebar. Its name will default to something like the ISO filename.

Don't see TPM 2.0 or Secure Boot options?

These options appear in the VM summary or settings screen depending on your UTM version. If you do not see them during creation, right-click the VM after saving, select Edit, and look under the QEMU section for TPM and UEFI settings.

Help me find and enable TPM 2.0 in my UTM Windows Server VM settings.

Install Windows Server 2025

With the VM created, you will now boot it and walk through the Windows Server installer. This takes 10 to 20 minutes of mostly waiting.

  • Select your new VM in the UTM sidebar and click the Play button (triangle icon) to boot it.
  • When the VM window appears, you may see a "Press any key to boot from CD or DVD" message. Press any key immediately to start the installer.

Missed the boot prompt?

If Windows does not boot from the ISO, stop the VM, right-click it, select Edit, and verify the ISO is still attached under the drive settings. Then restart the VM.

  • On the language and region screen, leave the defaults and click Next.
  • Click Install now.
  • When prompted for an edition, select Windows Server 2025 Standard (Desktop Experience).
  • Accept the license terms and click Next.
  • Select Custom: Install Microsoft Server Operating System only (advanced).
  • Select the unallocated drive (it shows the full 64 GB) and click Next.
  • Wait for the installation to complete. The VM will restart several times automatically.

Why Desktop Experience?

Desktop Experience gives you the full Windows GUI with Server Manager. Most IT support interviews expect you to be familiar with this interface.

Server Core (command-line only) is an advanced skill for a later project.

  • After the final restart, Windows prompts you to set the Administrator password. Enter a strong password you will remember. You will use it throughout this entire lab.
  • Press Ctrl+Alt+Delete to reach the login screen. Use the UTM menu bar if the keyboard shortcut does not pass through to the VM.
  • Log in with the Administrator password you just set.

You should see the Windows Server Desktop with Server Manager opening automatically. Your server is alive.

Server Manager does not open?

If you see a desktop but no Server Manager window, click Start and type Server Manager to launch it manually. It should appear on every login by default.

Help me troubleshoot Server Manager not opening after Windows Server 2025 installation.

Configure the static IP and rename the server

Right now your server has a random name and gets its IP from UTM's virtual DHCP. A domain controller needs a predictable, static IP address so every client on the network knows exactly where to find it.

You will assign 192.168.64.10 as the static IP and rename the machine to DC01.

  • Open PowerShell as Administrator. Right-click the Start button and select Windows PowerShell (Admin) or Terminal (Admin).
  • Find your network adapter's interface alias by running this command:
Get-NetIPInterface -AddressFamily IPv4

What does this show?

This lists all IPv4 network interfaces on the server. Look for the row with InterfaceAlias showing Ethernet (or similar). You will use this alias in the next commands.

You should see a table with columns including ifIndex and InterfaceAlias. Note the alias name for your primary adapter.

  • Set the static IP address by running this command (replace Ethernet with your actual interface alias if it differs):
New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 192.168.64.10 -PrefixLength 24 -DefaultGateway 192.168.64.1

What does this command do?

  • -IPAddress 192.168.64.10 assigns your server its permanent address on the virtual network.
  • -PrefixLength 24 sets the subnet mask to 255.255.255.0 (a /24 network with 254 usable addresses).
  • -DefaultGateway 192.168.64.1 tells the server where to send traffic destined for other networks.
  • Set the DNS server to point to itself by running this command:
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses 127.0.0.1

Why point DNS to 127.0.0.1?

Active Directory cannot function without DNS. Once you promote this server to a domain controller, it will host the DNS zone for contoso-med.local.

Pointing DNS to 127.0.0.1 (the loopback address) ensures the server always uses its own DNS records. This is the standard configuration for every domain controller.

  • Rename the computer to DC01 and trigger a restart by running:
Rename-Computer -NewName "DC01" -Restart

What is DC01?

DC01 stands for Domain Controller 01. This naming convention is standard in enterprise environments. When a company has multiple domain controllers for redundancy, they name them DC01, DC02, DC03, and so on.

The server will restart automatically to apply the new name. Wait for it to come back up, then log in again as Administrator.

Before you run the verification command, think about what you expect to see. What IP address should appear? What hostname should display? What DNS server should be listed?

  • After logging back in, open PowerShell as Administrator again and verify the configuration by running:
ipconfig /all

Confirm three things in the output: the IPv4 Address shows 192.168.64.10, the DNS Servers line shows 127.0.0.1, and the Host Name at the top shows DC01.

Static IP not showing up?

If you still see a DHCP-assigned address, the New-NetIPAddress command may have failed silently. Re-run Get-NetIPInterface -AddressFamily IPv4 to confirm your interface alias matches exactly what you used. The alias is case-sensitive.

If you see an error about a duplicate address, another device on the UTM network may already be using 192.168.64.10. Shut down any other running VMs and try again.

Help me fix my static IP configuration on Windows Server 2025.

DC01 is alive with a static identity on the network. Next, you will transform it from a plain server into the authentication authority for Contoso Medical Group by promoting it to a domain controller.

Promote DC01 to Domain Controller with DNS

DC01 has a static IP and the right hostname, but it is still just a server sitting in a workgroup. No workstation can authenticate against it. No internal DNS name resolves. No security policy applies.

This step transforms DC01 into the authentication authority for your entire fictional company. Active Directory cannot function without DNS, so you will install both together and then diagnose the most common post-promotion failure that real administrators face in production.

In this step, get ready to:
  • Install the Active Directory Domain Services role on DC01.
  • Promote DC01 to domain controller for the contoso-med.local forest.
  • Diagnose and resolve a DNS resolution failure after promotion.
Install the Active Directory Domain Services role

Before you can promote a server to a domain controller, the AD DS binaries must be present on the machine. The Install-WindowsFeature cmdlet adds the role and its management tools in one shot.

  • Right-click the Start button and select Windows PowerShell (Admin).
  • Install the AD DS role by running this command:
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

What does this command do?

  • -Name AD-Domain-Services tells Windows Server to add the Active Directory Domain Services role.
  • -IncludeManagementTools installs GUI tools like Active Directory Users and Computers alongside the role. Without this flag, only the core binaries are installed.
  • Wait for the command to finish. You should see output showing Success as True and Restart Needed as No.

Seeing a failure or restart required message?

If the output shows Restart Needed: Yes, restart the VM from within Windows (Start > Restart), then re-run the command after logging back in. If the installation fails entirely, confirm you are running PowerShell as Administrator (the title bar should say "Administrator").

Help me troubleshoot this installation issue

Promote DC01 to domain controller

Installing the role just places the AD DS binaries on disk. Promotion is what actually creates your new forest, registers the domain name, and starts the DNS Server service.

  • Promote DC01 to domain controller for a brand-new forest by running this command:
Install-ADDSForest -DomainName "contoso-med.local" -DomainNetbiosName "CONTOSOMED" -InstallDns -SafeModeAdministratorPassword (ConvertTo-SecureString "YourDSRMpassword1!" -AsPlainText -Force)

What does this command do?

  • -DomainName "contoso-med.local" sets the fully qualified domain name for your new Active Directory forest.
  • -DomainNetbiosName "CONTOSOMED" gives the domain a short name used in legacy login formats like CONTOSOMED\Administrator.
  • -InstallDns installs and configures the DNS Server role alongside AD DS. Active Directory depends on DNS to locate domain controllers and services.
  • -SafeModeAdministratorPassword sets the Directory Services Restore Mode (DSRM) password. You would use this password to boot the DC in recovery mode if Active Directory ever becomes corrupted.

Why is the DSRM password important?

DSRM is a safe-boot mode that lets you repair or restore Active Directory offline. In an enterprise, losing this password means you cannot perform authoritative restores. For this lab, the password is set inline for simplicity.

  • When prompted to confirm, type Y and press Enter.
  • The server will automatically restart after about 10 seconds. This is expected. Wait for the VM to reboot completely.
  • After the restart, log in as CONTOSOMED\Administrator using your Administrator password. The login screen now shows the domain name because DC01 is a domain controller.

Cannot log in after restart?

If you see a blank screen or the VM appears stuck, give it 2-3 minutes. The first boot after promotion takes longer because AD DS is initializing the database. If the login screen does not show CONTOSOMED, press Ctrl+Alt+Delete (use the UTM menu bar to send this key combination) and try the credentials CONTOSOMED\Administrator.

Help me troubleshoot the login issue after DC promotion

Diagnose and fix the post-promotion DNS failure

You just created a brand-new domain controller with an integrated DNS zone. Everything should be working, right? Let's find out.

  • Right-click the Start button and select Windows PowerShell (Admin).

Before you run the next command, take a moment to predict: do you think a DNS lookup for contoso-med.local will succeed or fail right now? Why?

  • Test DNS resolution by running:
nslookup contoso-med.local

You will likely see a timeout or an error message indicating the DNS request failed. This is the number one post-promotion issue in real Active Directory environments. Do not panic. This is intentional.

Why does DNS fail right after promotion?

After DC promotion with -InstallDns, the DNS Server service needs time to fully load the AD-integrated zones. Additionally, the server's own DNS client NIC setting sometimes reverts to an external address during the promotion process.

This exact scenario appears in almost every enterprise AD deployment and is the most commonly asked troubleshooting question in systems administrator interviews.

Time to diagnose. Run these three commands one at a time to gather evidence.

  • Check if the DNS Server service is running:
Get-Service DNS
  • Check which DNS server the NIC is pointing to:
Get-DnsClientServerAddress
  • Check if the forward lookup zone for your domain exists:
Get-DnsServerZone

What are you looking for?

  • Get-Service DNS should show Status as Running. If it is stopped, the DNS Server did not start after reboot.
  • Get-DnsClientServerAddress should show 127.0.0.1 as the DNS server for your network interface. If it shows a different address, the NIC DNS setting reverted during promotion.
  • Get-DnsServerZone should list contoso-med.local as an AD-integrated primary zone. If the zone is missing, it has not loaded yet.

The root cause is almost always that the NIC DNS client is not pointing to 127.0.0.1 (itself). Fix it now.

  • Force the DNS client to point to the local DNS Server by running:
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses 127.0.0.1

Interface name might differ

If you get an error about the interface name, check the exact name by looking at the output from Get-DnsClientServerAddress you ran earlier. Replace "Ethernet" with the name shown in your output (it might be "Ethernet Instance 0" or similar in UTM).

Now predict again: with the DNS client pointing to 127.0.0.1, should nslookup succeed this time?

  • Verify DNS resolution is working by running:
nslookup contoso-med.local 127.0.0.1

You should see a response showing the name contoso-med.local resolving to 192.168.64.10. That confirms DNS is working correctly.

  • Confirm Active Directory is operational by running:
Get-ADDomain

The output should show DNSRoot as contoso-med.local and NetBIOSName as CONTOSOMED. DC01 is officially a domain controller.

nslookup still timing out?

If DNS still fails after setting the client to 127.0.0.1, the zone may not have loaded yet. Wait 60 seconds, then run Get-DnsServerZone to confirm contoso-med.local appears in the list. If it does not, restart the DNS Server service:

Restart-Service DNS

Then try nslookup contoso-med.local 127.0.0.1 again.

Help me troubleshoot this DNS resolution issue

DC01 is now the authentication authority for the contoso-med.local forest. Every user login and every computer account will flow through this server. Next up, you will configure DHCP so that client workstations can receive their network settings automatically.

Configure DHCP and Prepare the Network for Clients

DC01 is now your domain controller with Active Directory and DNS running. The next piece of enterprise infrastructure is automatic network configuration for client workstations.

In a real company with 300 employees, every new laptop needs an IP address, a DNS server address, and a default gateway. Without DHCP, you would manually configure each one. That does not scale. In this step, you will install the DHCP Server role on DC01 and create a scope that automatically hands out network settings to any workstation that joins the network.

In this step, get ready to:
  • Install the DHCP Server role on DC01.
  • Authorize DHCP in Active Directory and create a client IP scope.
  • Verify DHCP is serving the correct network configuration.
Install the DHCP Server role

Just like you installed AD DS in the previous step, server roles are added through PowerShell using Install-WindowsFeature. The DHCP role turns DC01 into a server that can automatically assign IP addresses to any device on its network.

  • In the PowerShell window on DC01 (still running as Administrator), install the DHCP Server role by running this command:
Install-WindowsFeature -Name DHCP -IncludeManagementTools

You should see output with a table showing Success as True, Restart Needed as No, and Feature Result listing DHCP Server. No reboot is required.

What does this command do?

The -Name DHCP parameter specifies the DHCP Server role. The -IncludeManagementTools flag installs the PowerShell cmdlets and management console you need to configure scopes and options.

Without -IncludeManagementTools, the role installs but you cannot manage it from this server.

Seeing a failure or restart required?

If the output shows Restart Needed: Yes, restart the server with Restart-Computer and log back in as CONTOSOMED\Administrator before continuing.

If you see a permission error, confirm you are running PowerShell as Administrator (right-click the PowerShell icon and select Run as Administrator).

Still stuck? Ask for help.

Authorize DHCP in Active Directory

A DHCP server on a domain network must be authorized in Active Directory before it can issue leases to clients. This is a security mechanism that prevents rogue DHCP servers from handing out incorrect network settings.

  • Authorize DC01 as a DHCP server in Active Directory by running this command:
Add-DhcpServerInDC -DnsName "DC01.contoso-med.local" -IPAddress 192.168.64.10

Why does DHCP need authorization?

In an Active Directory environment, only authorized DHCP servers can respond to client requests. If someone accidentally plugs in a home router or unauthorized DHCP server, it will not be authorized and clients will ignore its offers.

This is one of the most common interview questions for enterprise IT: "What happens if you install DHCP but forget to authorize it?" The answer is that clients will never receive leases from it.

  • Confirm DC01 is listed as an authorized DHCP server by running:
Get-DhcpServerInDC

You should see DC01.contoso-med.local with IP address 192.168.64.10 in the output.

DC01 not showing as authorized?

If the output is empty, verify you are logged in as CONTOSOMED\Administrator (domain admin privileges are required for authorization).

If you see a DNS-related error, confirm nslookup DC01.contoso-med.local resolves to 192.168.64.10. The DNS name must resolve for authorization to succeed.

Help me authorize DHCP in Active Directory.

Create the client IP scope

A DHCP scope defines the pool of IP addresses available for client devices. You will create a scope that hands out addresses from 192.168.64.100 to 192.168.64.200, giving Contoso Medical Group room for up to 101 workstations on this subnet.

  • Create the DHCP scope for client workstations by running this command:
Add-DhcpServerv4Scope -Name "Contoso-Med Clients" -StartRange 192.168.64.100 -EndRange 192.168.64.200 -SubnetMask 255.255.255.0 -State Active

What does this command do?

The -Name gives the scope a human-readable label. -StartRange and -EndRange define the first and last IP addresses clients can receive.

The -SubnetMask tells clients how large the local network is. -State Active means the scope starts handing out addresses immediately.

  • Set the scope options so clients know which DNS server and gateway to use by running:
Set-DhcpServerv4OptionValue -ScopeId 192.168.64.0 -DnsServer 192.168.64.10 -Router 192.168.64.1

What do scope options do?

When a client receives an IP address from DHCP, it also receives these options. -DnsServer 192.168.64.10 tells the client to use DC01 for DNS lookups, which is critical for domain name resolution.

The -Router 192.168.64.1 sets the default gateway so the client can reach networks outside its own subnet.

Before you verify, predict what you expect to see. Do you think the scope will show as Active with the range you configured?

  • Verify the scope is configured correctly by running:
Get-DhcpServerv4Scope

You should see a scope with ScopeId 192.168.64.0, Name Contoso-Med Clients, State Active, StartRange 192.168.64.100, and EndRange 192.168.64.200.

Why DHCP on a domain controller?

Microsoft best practice discourages running DHCP on a domain controller in production environments with thousands of users. In a lab environment and small businesses under 500 employees, it is standard practice and simplifies the infrastructure.

For this project, running DHCP on DC01 keeps the lab focused on Active Directory concepts rather than managing multiple servers.

Scope not showing or state is Inactive?

If the scope does not appear, re-run the Add-DhcpServerv4Scope command and check for typos in the IP addresses. All four octets must be correct.

If the State shows Inactive, you can activate it by running Set-DhcpServerv4Scope -ScopeId 192.168.64.0 -State Active.

Help me fix my DHCP scope.

DC01 is now a complete network infrastructure server. It provides authentication (AD DS), name resolution (DNS), and automatic IP configuration (DHCP). Next up, you will deploy a Windows 11 workstation and join it to the domain, putting all three services to the test.

Deploy Windows 11 Workstation and Join the Domain

Your domain controller is running with DHCP ready to hand out addresses. Now it is time to deploy the most common unit of IT infrastructure: the employee workstation.

Joining a workstation to the domain tests DNS resolution, network connectivity, Active Directory authentication, and computer account creation simultaneously. When any one of those breaks, the domain join fails. Diagnosing which layer is broken is the skill interviewers ask about most.

In this step, get ready to:
  • Create a Windows 11 VM in UTM and install the operating system.
  • Attempt a domain join and diagnose the expected DNS failure.
  • Fix the DNS configuration and successfully join contoso-med.local.
Create and install the Windows 11 VM

This VM represents an employee laptop at Contoso Medical Group. Every new hire gets a workstation provisioned and joined to the company domain on their first day.

  • Switch to your Mac desktop (click outside the DC01 VM window or press Cmd+Tab).
  • In UTM, click the + button to start creating a new VM.
  • Select Virtualize.
  • Select Windows.
  • Check the box for Install Windows 10 or higher.
  • Check the box for Install drivers and SPICE tools.
  • Click Browse and select the Windows 11 ARM ISO from your Downloads folder.
  • Set RAM to 4096 MB (4 GB).
  • Set CPU cores to 2.
  • Set storage size to 40 GB.
  • Click Save to create the VM, then click the play button to start it.

The VM boots to the Windows 11 installer. You should see the Windows Setup language selection screen.

What about those VM settings?

4 GB RAM and 2 CPU cores are the minimum for Windows 11. Your Mac has 16 GB total, so 6 GB for DC01 + 4 GB for this workstation leaves enough for macOS. You can shut down DC01 during the Windows 11 installation if things feel sluggish, since the install itself does not need the domain controller.

  • Follow the Windows 11 installer prompts: select your language, click Install now, accept the license terms, and choose Custom: Install Windows only.
  • Select the virtual drive and click Next. The installation takes 10-15 minutes. The VM restarts automatically.

What happens during OOBE?

After installation, Windows 11 launches the Out of Box Experience (OOBE). This is the first-time setup wizard that asks about region, keyboard, and account type. You will use the OOBE to create a local admin account without needing a Microsoft account.

  • Select your region and keyboard layout.
  • When asked how you would like to set up this device, select Set up for work or school.
  • Click Sign-in options.
  • Select Domain join instead. This creates a local account without requiring a Microsoft account.
  • Create a local admin username and password. Write these down. You will use them until the domain join succeeds.
  • Complete the remaining setup prompts (privacy settings). Click Accept and wait for the desktop to appear.

You should now see the Windows 11 desktop inside your VM.

Don't see the OOBE screen?

If the VM boots to a black screen or restarts in a loop, ensure you selected the correct Windows 11 ARM ISO (not the Windows Server ISO). Right-click the VM in UTM, select Edit, and verify the ISO path under the boot drive.

help me troubleshoot my Windows 11 VM not booting in UTM

Attempt to join the domain

With Windows 11 installed, the next step is exactly what you would do on an employee's first day: join the workstation to the company domain. This process contacts the domain controller, authenticates, and creates a computer account in Active Directory.

  • Make sure DC01 is running in UTM. If you shut it down during the install, start it back up and log in as CONTOSOMED\Administrator.
  • Switch back to the Windows 11 VM.
  • Right-click the Start menu and select Terminal (Admin) to open PowerShell as Administrator.

Before you try the domain join, what do you think will happen? The domain controller is on the same virtual network. Do you expect it to succeed on the first try?

  • Attempt to join the domain by running this command:
Add-Computer -DomainName "contoso-med.local" -Credential (Get-Credential)
  • When the credentials window appears, enter CONTOSOMED\Administrator as the username and the Administrator password you set on DC01.
  • Click OK.

The command fails. You see an error stating that the domain cannot be contacted or the specified domain does not exist. This is expected and intentional.

This failure is the lesson

This is the most common domain join failure in real enterprise environments. Every Field Technician encounters it. The workstation cannot find the domain because its DNS is pointing to the wrong server.

Your Windows 11 VM got its network settings from UTM's built-in virtual DHCP (not your DC01 DHCP scope). That means the workstation's DNS server is pointing to an external DNS server that has never heard of contoso-med.local.

Time to diagnose. Run these commands one at a time to confirm the root cause:

  • Check if the workstation can reach the domain controller by running:
ping 192.168.64.10
  • Check what DNS server the workstation is currently using by running:
ipconfig /all

Look at the DNS Servers line in the output. It shows an address that is NOT 192.168.64.10. That is the problem.

  • Confirm the workstation cannot resolve the domain name by running:
nslookup contoso-med.local

This fails because the workstation is asking an external DNS server to resolve a private domain name that only your DC01 knows about.

Why does this happen?

UTM's shared network mode provides its own DHCP server to VMs. The Windows 11 VM received an IP address and DNS settings from UTM's virtual router, not from your DC01 DHCP scope. The UTM DNS server points to your Mac's upstream DNS (like 8.8.8.8 or your ISP), which knows nothing about contoso-med.local.

The fix is the same one you would apply in a real office: point the workstation's DNS to the domain controller.

Fix DNS and join the domain

Now that you have confirmed the root cause, the fix is straightforward. Point the workstation's DNS client to DC01 at 192.168.64.10.

  • First, find your network adapter name by running:
Get-NetAdapter

Note the adapter name in the Name column (typically Ethernet).

  • Set the DNS server to point to DC01 by running this command (replace Ethernet with your adapter name if it differs):
Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses 192.168.64.10

What does this command do?

This tells the workstation to send all DNS queries to 192.168.64.10 (your domain controller). Since DC01 runs the DNS Server role with the contoso-med.local zone, it can now resolve the domain name. This is the exact fix you would apply when troubleshooting a domain join failure in a real office.

  • Verify DNS resolution now works by running:
nslookup contoso-med.local

You should now see a response showing 192.168.64.10 as the answer. DNS is working.

  • Retry the domain join by running:
Add-Computer -DomainName "contoso-med.local" -Credential (Get-Credential) -Restart
  • Enter CONTOSOMED\Administrator and the Administrator password when prompted.
  • Click OK. The command succeeds and the workstation restarts automatically.

After the restart, you see the Windows login screen. Before you log in, what account do you think you should use to prove the domain join worked?

  • Click Other user on the login screen.
  • Log in as CONTOSOMED\Administrator with the domain Administrator password.

You are now logged into the workstation with a domain account. The domain join is complete.

  • Confirm the domain membership by opening PowerShell and running:
(Get-WmiObject Win32_ComputerSystem).Domain

You should see contoso-med.local in the output.

  • Switch to your DC01 VM and open PowerShell as Administrator.
  • Verify the workstation's computer account exists in Active Directory by running:
Get-ADComputer -Filter *

You should see at least two entries: DC01 and the Windows 11 workstation's computer name. This confirms the domain controller created the computer account during the join process.

Domain join still failing after DNS fix?

If nslookup contoso-med.local works but the domain join still fails, check that both VMs are on the same UTM network mode. Right-click each VM in UTM, select Edit, go to Network, and confirm both use Shared Network.

Also verify DC01 is still running and reachable with ping 192.168.64.10 from the workstation.

help me troubleshoot my Windows 11 domain join failure after fixing DNS

Secret mission

Build the Company OU Structure and First Group Policy

A flat Active Directory with everything dumped in the default containers is a sign of a poorly managed environment. Real enterprises organize objects into Organizational Units by department. Can you design the OU structure for Contoso Medical Group, populate it with users and groups, and prove a Group Policy Object actually applies to the workstations?

Clean Up Your Resources

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely locally with no cloud resources or paid services, so there are no ongoing costs. The VMs do consume significant disk space (100+ GB combined).

Resources you used:

  • DC01 VM (Windows Server 2025) in UTM, approximately 64 GB disk.
  • Windows 11 Workstation VM in UTM, approximately 40 GB disk.
  • Windows Server 2025 ARM ISO in your Downloads folder.
  • Windows 11 ARM ISO in your Downloads folder.
  • UTM application installed on macOS.
  • CrystalFetch application installed on macOS.

Keep everything running

No action needed. Choose this if you are still actively building or plan to continue with additional Active Directory projects.

  • UTM saves VM state when you close the VM window. You can resume anytime.
  • Both VMs, ISO files, UTM, and CrystalFetch remain on your Mac.
  • You can pick up right where you left off for future labs such as user management, file shares, or Group Policy expansion.

Pause - I'll come back to this later

Shut down running processes to free up RAM and CPU. Your VMs stay on disk and can be resumed later without rebuilding anything.

  • In the Windows 11 workstation VM, click Start and select Shut down.
  • In the DC01 VM, click Start and select Shut down.
  • Close UTM. Both VMs remain on disk but consume no RAM or CPU while shut down.
  • To resume later, open UTM and start each VM. Log back in as CONTOSOMED\Administrator.

Delete - I don't want to use this again

Remove all project resources from your Mac to reclaim disk space. You would need to rebuild from ISOs for any future projects.

  • In UTM, shut down both VMs if they are running (click Start > Shut down inside each VM, or use the power button in UTM's toolbar).
  • Right-click (or secondary click) the DC01 VM in UTM's sidebar and select the remove option. Confirm when prompted. This deletes the VM and all its data.
  • Right-click the Windows 11 workstation VM in UTM's sidebar and select the remove option. Confirm when prompted.
  • Delete the ISO files from your Downloads folder by running:
rm ~/Downloads/*.iso
  • To remove UTM, open Finder, navigate to Applications, and drag UTM to the Trash. Empty the Trash to reclaim space.
  • To remove CrystalFetch, open Finder, navigate to Applications, and drag CrystalFetch to the Trash. Empty the Trash.

Nice Work!

Nice Work!

You just built the IT backbone of a fictional 300-person medical technology company from scratch on your Mac. You now have a real, working Active Directory domain environment you can demo in interviews and extend in future projects.

You've learned how to:

  • Promoted a Windows Server 2025 VM to a domain controller using PowerShell, with AD DS, DNS, and DHCP roles serving the contoso-med.local domain.
  • Diagnosed and resolved real DNS resolution failures and domain join errors caused by network misconfiguration, the two most common interview troubleshooting scenarios in enterprise IT.
  • Provisioned a Windows 11 workstation and joined it to the domain, verifying the computer account in Active Directory from the domain controller.
  • Built a complete Organizational Unit hierarchy with user accounts, security groups, and a working Group Policy Object applied to the Workstations OU (Secret Mission).

Ready to quiz yourself?