Deploy a Windows Server Domain Controller

Deploy and harden an Active Directory domain controller on Azure.

Introduction

30 Second Summary

Every time you log in to a work computer, check your email, or access a shared drive, you're relying on a system called Active Directory. It's the invisible backbone that controls who can access what in nearly every office in the world.

In this project, you will deploy a Windows Server 2022 virtual machine in Azure, install Active Directory Domain Services, build out an enterprise-style directory with departments and users, then harden it with Group Policy security settings.

What You'll Build

A fully functional Active Directory domain controller running Windows Server 2022 in Azure, complete with a structured directory and security hardening policies.

By the end of this project, you'll have:

A Windows Server 2022 VM deployed in Azure with Active Directory Domain Services and DNS configured.
An enterprise-style directory structure with Organizational Units, security groups, and user accounts organized by department.
Group Policy Objects enforcing password complexity, account lockout, and security audit logging to harden the domain.
Secret Mission: Configure Fine-Grained Password Policies for admin accounts and enable the Active Directory Recycle Bin for disaster recovery.

Are there any prerequisites?

No prior experience with Windows Server or Active Directory is required. This project walks you through everything from creating your Azure free account to connecting via Remote Desktop.

You will need a credit or debit card to verify your Azure account, but you will not be charged. Azure gives you $200 in free credit for 30 days.

Create Your Azure Free Account

To deploy a Windows Server domain controller, you need a cloud environment where your server can run 24/7 without tying up your personal computer. Azure gives you exactly that. It lets you spin up a full Windows Server in the cloud with just a few clicks.

In this step, you will create a free Azure account that comes with $200 in credit for 30 days. You will also explore the Azure Portal and confirm your subscription is active.

In this step, get ready to:

Create a free Azure account with $200 credit.
Navigate the Azure Portal interface.
Verify your subscription and available credit.

Sign up for an Azure free account

Azure offers a free account with $200 in credit that lasts 30 days. This is more than enough to cover everything you will build in this project.

Open your web browser and go to azure.microsoft.com/free.
Click Try Azure for free.
Sign in with a Microsoft account or a GitHub account. If you do not have one, follow the prompts to create a new Microsoft account.
Enter a phone number for verification when prompted.
Enter a credit or debit card for identity verification.

Will I be charged?

No. Azure uses your card only for identity verification. You may see a temporary $1 hold that gets reversed automatically.

You will not be charged unless you explicitly upgrade to pay-as-you-go pricing later. Your $200 credit covers all the resources in this project.

Having trouble signing up?

If you see an error about your account type not being supported, try using a personal Microsoft account (like an Outlook or Hotmail address) instead of a work or school account.

If your phone number is not accepted, try a different number or check that you selected the correct country code.

Help me troubleshoot my Azure free account signup.

Explore the Azure Portal

The Azure Portal is the web-based dashboard where you create and manage all your cloud resources. You will use it throughout this project to deploy your virtual machine and monitor your spending.

Once your account is created, navigate to portal.azure.com in your browser.
Take a moment to look at the portal layout.

What am I looking at?

The Azure Portal has three main areas you will use throughout this project.

The search bar at the top lets you quickly find any Azure service or resource.
The left navigation menu provides shortcuts to common services and recent resources.
The main dashboard in the center shows your resources and quick-start links.

Verify your subscription and credit

Before you start deploying resources, confirm that your free subscription is active and your $200 credit is available.

Click the search bar at the top of the Azure Portal.
Type Subscriptions and click the Subscriptions result that appears.
Click on your subscription name (it will be called something like Azure subscription 1).
In the left menu of your subscription, click Cost Management + Billing to verify your $200 credit is visible.

What is a subscription?

An Azure subscription is a billing container that groups all the resources you create. Every virtual machine, storage account, or network you create lives inside a subscription.

Your free account comes with one subscription that has $200 in credit attached to it. All charges from this project come out of that credit.

Don't see your credit?

Make sure you are signed in with the same account you used to create the free Azure account. Check the top-right corner of the portal to confirm the correct account is active.

If you just created your account, it may take a few minutes for the subscription to appear. Try refreshing the page.

Help me find my Azure subscription and credit.

Your Azure account is ready to go. Next up, you will deploy a Windows Server 2022 virtual machine and connect to it remotely.

Deploy a Windows Server 2022 Virtual Machine

Your Azure account is active and loaded with $200 in free credit. Now it's time to deploy the server that will become your domain controller.

A domain controller needs a dedicated server running Windows Server. In this step, you'll create a Windows Server 2022 virtual machine in Azure and configure it to prevent surprise charges.

In this step, get ready to:

Deploy a Windows Server 2022 VM named DC01 in Azure.
Configure auto-shutdown to protect your free credit.
Note the VM's public IP address for remote access.

Create a new virtual machine

Azure hosts your server as a virtual machine, so you don't need any physical hardware. Let's configure and launch one now.

In the Azure Portal search bar at the top of the page, type Virtual machines and click the result.
Click Create, then select Azure virtual machine.

What is a virtual machine?

A virtual machine (VM) is a computer that runs inside a data center instead of on your desk. You interact with it remotely, but it behaves exactly like a physical server.

You'll land on the Basics tab of the VM creation form. Fill in each field as described below.

Under Resource group, click Create new.
Enter AD-Lab-RG as the name and click OK.
In the Virtual machine name field, enter DC01.
For Region, select a region close to your physical location.
For Image, select Windows Server 2022 Datacenter: Azure Edition - x64 Gen 2.
For Size, select Standard_B2s (2 vCPUs, 4 GB RAM).
Under Administrator account, enter azureadmin as the username.
Set a strong password that is at least 12 characters long with uppercase, lowercase, numbers, and symbols.

Remember your password

Write down or save your password somewhere safe. You'll need it every time you connect to the server.

Why Standard_B2s?

Standard_B2s gives you 2 vCPUs and 4 GB of RAM, which is enough to run Active Directory comfortably. At roughly $0.04 per hour, you can run this server for days without making a dent in your $200 credit.

Configure network access and auto-shutdown

You need to allow RDP (Remote Desktop Protocol) access so you can connect to the server from your computer. You also want auto-shutdown enabled to prevent the VM from running overnight.

Scroll down to Inbound port rules on the same Basics tab.
Under Select inbound ports, choose RDP (3389).
Click the Management tab at the top of the form.
Check the box for Enable auto-shutdown.
Set the shutdown time to 11:00 PM (or a time that works for you) and select your time zone.

Why enable auto-shutdown?

Auto-shutdown turns off your VM at the scheduled time every day. This prevents the VM from running overnight and eating into your $200 credit while you sleep.

Deploy the VM and note your public IP address

Everything is configured. Time to launch the VM and grab the IP address you'll use to connect.

Click Review + create at the bottom of the page.
Azure will validate your settings. Once you see Validation passed, click Create.
Wait 2-3 minutes for the deployment to complete.
When you see Your deployment is complete, click Go to resource.
On the VM Overview page, find the Public IP address field on the right side.
Write down or copy this IP address. You'll use it in the next step to connect via Remote Desktop.

Deployment failed?

If you see a deployment error, the most common cause is the selected VM size not being available in your chosen region. Try selecting a different region and creating the VM again.

If you see a quota error, your subscription may not have enough cores available in that region. Switch to a less popular region (such as one in a different continent) and retry.

Help me troubleshoot my VM deployment

Your Windows Server 2022 VM is now running in the cloud. Next up, you'll connect to it via Remote Desktop and install Active Directory.

Connect to Your Server and Install Active Directory

Your VM is deployed and running in Azure. Now you need to connect to it and transform it from a plain Windows Server into the identity backbone of your network.

You will use Remote Desktop to connect to DC01, then install Active Directory Domain Services and promote the server to a domain controller. This creates a brand new AD forest called corp.local.

In this step, get ready to:

Connect to DC01 via Remote Desktop Connection.
Install the Active Directory Domain Services role.
Promote DC01 to a domain controller and create the corp.local forest.

Connect to DC01 via Remote Desktop

Remote Desktop Connection lets you control your Azure VM as if you were sitting in front of it. You will use the public IP address you noted in the previous step to connect.

Press the Windows key to open your search bar.
Type mstsc and press Enter to open Remote Desktop Connection.
In the Computer field, enter your VM's public IP address (the one you noted from the Overview page in Step 2).
Click Connect.
When prompted for credentials, enter your username as DC01\azureadmin and the password you set during VM creation.
A certificate warning will appear. Click Yes to accept it and proceed.

Why the certificate warning?

Your VM generates a self-signed certificate for the RDP connection. Since it is not issued by a trusted certificate authority, Windows warns you. This is normal for lab environments.

After a few seconds, the Windows Server desktop loads inside your Remote Desktop window.

macOS users

Download Microsoft Remote Desktop from the Mac App Store. Add a new PC connection using your VM's public IP address, then connect with the same credentials.

Can't connect to the VM?

Make sure the VM is running (not stopped or deallocated) in the Azure Portal. Check that you are using the correct public IP address from the VM's Overview page. Verify that RDP port 3389 is allowed in your Network Security Group inbound rules.

Help me troubleshoot my RDP connection to my Azure VM

Install the Active Directory Domain Services role

Before your server can become a domain controller, you need to install the AD DS role. This adds all the binaries and management tools that Active Directory needs to run.

Inside your Remote Desktop session, right-click the Start button.
Select Windows PowerShell (Admin) to open an elevated PowerShell window.
Install the AD DS role by running this command:

Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

What does this command do?

Install-WindowsFeature is a PowerShell cmdlet that adds server roles and features to Windows Server.

-Name AD-Domain-Services specifies the Active Directory Domain Services role. -IncludeManagementTools adds the GUI tools like Active Directory Users and Computers, which you will use in the next step.

Wait 1-2 minutes for the installation to complete. You should see a table with Success under the Exit Code column and True under Success.

Seeing 'Access is denied'?

Make sure you opened PowerShell as Administrator. Close the current window, right-click Start again, and select Windows PowerShell (Admin).

Help me fix the access denied error when installing AD DS

Promote the server to a domain controller

Installing the role only adds the files. Promotion is what actually turns this server into a domain controller and creates your new forest. A forest is the top-level container in Active Directory that holds one or more domains.

In the same elevated PowerShell window, promote your server to a domain controller by running this command:

Install-ADDSForest -DomainName "corp.local" -InstallDns -Force

What does this command do?

Install-ADDSForest creates a brand new Active Directory forest from scratch. This is the highest-level operation in AD deployment.

-DomainName "corp.local" sets your domain's fully qualified name. -InstallDns installs the DNS server role, which Active Directory requires to locate domain resources. -Force skips non-critical confirmation prompts.

PowerShell will prompt you to set and confirm a SafeModeAdministratorPassword (also called the DSRM password). Enter a strong password and remember it. This password is used to recover Active Directory in an emergency.
After you confirm the password, the promotion process runs for 1-2 minutes. The server will automatically restart when it finishes.
Your Remote Desktop session will disconnect. Wait 2-3 minutes for the server to fully restart.

Why does the server restart?

Promoting a server to a domain controller changes fundamental things about how Windows handles authentication and network identity. The restart applies these changes and starts all the Active Directory services.

After 2-3 minutes, open Remote Desktop Connection again (press the Windows key, type mstsc, press Enter).
Enter the same public IP address as before.
This time, enter your username as CORP\azureadmin and your original password.

Why did the username change?

Before promotion, your account was local to the machine (DC01\azureadmin). Now that the server is a domain controller, your account lives in the CORP domain. You log in as CORP\azureadmin to authenticate against Active Directory.

Once connected, you should see the Windows Server desktop again. Server Manager opens automatically and shows the AD DS and DNS roles in the left sidebar.

Can't reconnect after the restart?

Give the server a full 3 minutes. Domain controller promotion takes longer to boot than a normal restart. If it still does not connect after 5 minutes, go to the Azure Portal, open your DC01 VM, and verify the status shows Running. Check that auto-shutdown has not stopped the VM.

Help me reconnect to my VM after domain controller promotion

Your server is now a fully functional domain controller. Next up, you will build out the Active Directory structure with departments, groups, and user accounts.

Build Your Active Directory Structure

Your domain controller is live and your Active Directory forest is created. Now it's time to give your domain some structure.

In a real enterprise, Active Directory organizes employees into departments, assigns them to groups, and controls what they can access. You'll build that same structure now by creating departments, groups, and user accounts inside your corp.local domain.

In this step, get ready to:

Create Organizational Units for IT, HR, and Finance.
Create security groups for each department.
Create user accounts and assign them to their department groups.

Create Organizational Units

An Organizational Unit (OU) is a container inside Active Directory that groups related objects together. Think of OUs as folders for your departments.

In your Remote Desktop session on DC01, open Server Manager from the taskbar at the bottom of the screen.
Click Tools in the top-right menu bar of Server Manager.
Select Active Directory Users and Computers from the dropdown.

You should see your corp.local domain listed in the left panel. This is the top-level container for your entire directory.

Right-click corp.local in the left panel.
Select New, then Organizational Unit.
Type IT in the Name field and click OK.
Repeat the same steps to create a second OU named HR.
Repeat once more to create a third OU named Finance.

You should now see three new OUs listed under corp.local in the left panel: IT, HR, and Finance.

What is an Organizational Unit?

An Organizational Unit is a container that lets you group users, computers, and other objects by department, location, or function. OUs also let you apply different policies to different groups of people.

For example, you might apply stricter security rules to the Finance OU than to the IT OU. This granular control is what makes Active Directory so powerful in enterprise environments.

Don't see the New menu option?

Make sure you are right-clicking the corp.local domain itself, not one of the built-in folders (like Users or Computers) underneath it.

If Active Directory Users and Computers is not showing in the Tools menu, confirm you are logged in as CORP\azureadmin and that the AD DS role installed successfully in the previous step.

Help me troubleshoot why I can't create an Organizational Unit in Active Directory Users and Computers.

Create security groups for each department

Security groups let you assign permissions to a collection of users at once, instead of managing access for each person individually.

In Active Directory Users and Computers, right-click the IT OU in the left panel.
Select New, then Group.
Type IT-Staff in the Group name field.
Leave Group scope set to Global and Group type set to Security.
Click OK.

Now repeat the same process for the other two departments.

Right-click the HR OU, select New, then Group.
Name it HR-Staff, keep the scope as Global and type as Security, then click OK.
Right-click the Finance OU, select New, then Group.
Name it Finance-Staff, keep the scope as Global and type as Security, then click OK.

Click on each OU in the left panel to confirm you see the corresponding security group inside it.

Why Global Security groups?

Active Directory has different group scopes (Domain Local, Global, Universal) that control where the group can be used. Global groups can contain members from the same domain and can be granted permissions in any domain in the forest.

For a single-domain environment like yours, Global is the standard choice. The Security type means the group can be used for permissions assignments, unlike Distribution groups which are only for email.

Create user accounts and assign group membership

With your OUs and groups in place, you can create user accounts that represent employees in each department.

Right-click the IT OU and select New, then User.
Enter Alice in the First name field.
Enter Smith in the Last name field.
Enter asmith in the User logon name field.
Click Next.
Set a password (use the same strong password format you used for your admin account).
Uncheck User must change password at next logon.
Click Next, then click Finish.

Why uncheck the password change requirement?

In a production environment, you would leave this checked so new employees are forced to set their own password on first login. For this lab, unchecking it simplifies testing so you can verify account lockout policies later without dealing with password-change prompts.

Now add Alice to the IT-Staff security group.

Click on the IT OU to see its contents in the right panel.
Right-click Alice Smith and select Add to a group....
Type IT-Staff in the object names field and click Check Names.
The name should resolve with an underline. Click OK.

You should see a confirmation dialog saying the operation completed successfully.

Now create the remaining two users using the same process.

Right-click the HR OU, select New, then User.
Enter first name Bob, last name Jones, and user logon name bjones.
Click Next, set a password, uncheck User must change password at next logon, then click Next and Finish.
Right-click Bob Jones, select Add to a group..., type HR-Staff, click Check Names, then click OK.

Right-click the Finance OU, select New, then User.
Enter first name Carol, last name Davis, and user logon name cdavis.
Click Next, set a password, uncheck User must change password at next logon, then click Next and Finish.
Right-click Carol Davis, select Add to a group..., type Finance-Staff, click Check Names, then click OK.

To verify your work, click on each OU in the left panel. You should see the security group and the user account inside each one.

Check Names not resolving the group?

Make sure you typed the group name exactly as you created it, including the hyphen. IT-Staff is not the same as IT Staff or ITStaff.

If the group still doesn't resolve, click Advanced, then Find Now to browse all available groups and select the correct one from the list.

Help me troubleshoot why Check Names isn't finding my security group in Active Directory.

Your Active Directory now has a structured directory that mirrors a real organization. Next up, you'll lock it down with Group Policy to enforce security standards across all these accounts.

Harden Your Domain with Group Policy

Your Active Directory structure is in place with departments, groups, and users. Now it is time to enforce security rules across the entire domain.

Without security policies, any user could set a one-character password or attempt unlimited logins. Group Policy Objects let you define rules that every account in the domain must follow. In this step, you will configure password requirements, account lockout protection, and audit logging.

In this step, get ready to:

Enforce a strong password policy (12-character minimum, complexity, 90-day expiry).
Configure account lockout to block brute-force attacks.
Enable audit logging for logon events and account lockouts.

Configure the domain password policy

Password policies in Active Directory must be set in the Default Domain Policy to take effect for all domain users. You will open this policy and navigate to the password settings.

In Server Manager, click Tools in the top menu bar.
Click Group Policy Management.
In the left pane, expand Forest: corp.local.
Expand Domains, then expand corp.local.
Right-click Default Domain Policy and select Edit.

The Group Policy Management Editor opens. This is where you change settings that apply to every computer and user in the domain.

In the editor, navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy.
Double-click Minimum password length. Set the value to 12 characters. Click OK.
Double-click Password must meet complexity requirements. Set it to Enabled. Click OK.
Double-click Maximum password age. Set the value to 90 days. Click OK.

What does this do?

These three settings work together to enforce strong passwords across your domain.

Minimum password length of 12 means short, guessable passwords are rejected outright.
Complexity requirements force a mix of uppercase, lowercase, numbers, and symbols.
Maximum password age of 90 days ensures passwords are rotated regularly, limiting the window if a password is compromised.

Why edit the Default Domain Policy?

Password policies in Active Directory only take effect when configured in the Default Domain Policy (or a policy linked at the domain root with higher precedence). A password policy placed on an OU will not apply to domain accounts.

Set up account lockout protection

Account lockout stops attackers from guessing passwords by locking the account after repeated failures. You will configure this in the same Group Policy Editor window.

In the left pane of the Group Policy Management Editor, click Account Lockout Policy (directly below Password Policy, still under Account Policies).
Double-click Account lockout threshold. Set the value to 5 invalid logon attempts. Click OK.
Windows will suggest values for the related settings. Click OK to accept the suggested defaults, then manually adjust them.
Double-click Account lockout duration. Set the value to 30 minutes. Click OK.
Double-click Reset account lockout counter after. Set the value to 30 minutes. Click OK.

What does this do?

After 5 failed login attempts, the account locks for 30 minutes. The counter resets after 30 minutes of no failed attempts.

This protects against brute-force attacks where an attacker tries thousands of password combinations. A legitimate user who misremembers their password can simply wait 30 minutes for the lockout to clear.

Enable audit logging and apply the policies

Audit logging records who logs in and which accounts get locked out. This gives you a security trail for investigating suspicious activity.

In the Group Policy Management Editor, navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Logon/Logoff.
Double-click Audit Logon. Check both Success and Failure. Click OK.
Double-click Audit Account Lockout. Check both Success and Failure. Click OK.
Close the Group Policy Management Editor window.

What does audit logging do?

Every successful and failed login attempt is now recorded in the Windows Security event log. Every account lockout event is also captured.

In a real enterprise, security teams use these logs to detect unauthorized access attempts, investigate breaches, and satisfy compliance requirements.

Group Policy changes do not take effect immediately. You need to force an update so the new settings apply right now.

Open PowerShell (it should still be open from earlier steps).
Apply the updated Group Policy settings immediately by running this command:

gpupdate /force

What does this command do?

The gpupdate /force command reapplies all Group Policy settings immediately, regardless of whether they have changed. Without this, the domain controller would wait up to 5 minutes for its next automatic policy refresh.

Wait for the command to complete. You should see two confirmation messages stating that the Computer Policy and User Policy updates have completed successfully.

Not seeing successful updates?

Make sure you closed the Group Policy Management Editor before running the command. Open GPO editors can sometimes lock policy files.

If you see an error about network connectivity, verify you are still connected to the VM via RDP and try the command again.

Help me troubleshoot my gpupdate /force command failing on my domain controller.

Your domain is now locked down with enterprise-grade security policies. Next up, you will verify that everything works by testing the policies against real accounts.

Verify Your Configuration

Your domain is locked down with password policies, account lockout protection, and audit logging. The next question is: how do you know it all actually works?

In this step, you'll run PowerShell commands to verify every part of your configuration. You'll even simulate a brute-force attack to prove your lockout policy triggers correctly.

In this step, get ready to:

Verify your Active Directory domain and user accounts.
Confirm Group Policy security settings are applied.
Test account lockout by simulating a brute-force attack.

Verify your domain and user accounts

Before you trust any infrastructure, you need to confirm it reports back the expected values. Let's start by checking that your Active Directory forest and user accounts are in place.

Open PowerShell as Administrator on your DC01 server (if it's not already open).
Verify your domain by running this command:

Get-ADDomain

You should see output that includes DomainName showing corp and Forest showing corp.local.

Verify all your created users by running this command:

Get-ADUser -Filter *

You should see your three user accounts listed: asmith, bjones, and cdavis, along with default accounts like Administrator and Guest.

Not seeing your users?

Make sure you're logged in as CORP\azureadmin (not the local administrator). If you see only default accounts, go back to Active Directory Users and Computers and confirm the users exist in their OUs.

Help me troubleshoot why my AD users aren't showing up in Get-ADUser results

Confirm Group Policy is applied

Creating a Group Policy is one thing. Confirming it's actually enforced on the domain is another. Let's verify your security policies are active.

Verify that your Group Policy is applied by running this command:

gpresult /r

Scroll through the output and look for the section titled Applied Group Policy Objects. You should see Default Domain Policy listed there.

Now confirm the specific password policy values by running:

Get-ADDefaultDomainPasswordPolicy

Check the output for MinPasswordLength showing 12 and LockoutThreshold showing 5. These confirm your password and lockout policies are active.

Why verify with PowerShell instead of the GUI?

The Group Policy Management GUI shows what you configured. PowerShell shows what the domain is actually enforcing. A policy can exist in the editor but fail to apply due to link issues, WMI filters, or replication lag.

Always verify from the enforcement side, not the configuration side.

Default Domain Policy not appearing?

If the Default Domain Policy doesn't show under Applied Group Policy Objects, the policy may not have refreshed yet. Run gpupdate /force and then try gpresult /r again.

Help me troubleshoot why my Default Domain Policy isn't showing as applied

Test account lockout with failed authentication attempts

The best way to prove a security policy works is to trigger it. You'll simulate a brute-force attack by entering wrong credentials for one of your users five times, then confirm the account locks out.

Open a new PowerShell window. Run this command:

$cred = Get-Credential

What happens when you run this?

A credential dialog appears asking for a username and password. This simulates an authentication attempt against your domain.

In the credential dialog, enter asmith as the username.
Enter an intentionally wrong password (any random text).
Repeat the full command ($cred = Get-Credential) with the wrong password a total of 5 times. This triggers the lockout threshold you configured.

Verify the account is now locked out by running:

Get-ADUser asmith -Properties LockedOut

You should see LockedOut showing True. This confirms your lockout policy is working.

Unlock the account by running:

Unlock-ADAccount -Identity asmith

The account is now unlocked and ready for normal use again.

Account not showing as locked?

Make sure you ran the credential prompt a full 5 times (matching your lockout threshold). If LockedOut still shows False, the account lockout counter may have reset. Try the 5 attempts quickly without pausing between them.

Also confirm your lockout policy is applied by re-running Get-ADDefaultDomainPasswordPolicy and checking that LockoutThreshold is 5.

Help me troubleshoot why my account lockout test isn't working

Secret mission

Fine-Grained Password Policy and Recycle Bin

Your domain controller is secure, but real enterprises don't apply the same password rules to everyone. Admin accounts need stricter policies. Can you implement Fine-Grained Password Policies for your privileged accounts and enable the Active Directory Recycle Bin to protect against accidental deletions?

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project uses an Azure VM that costs money from your $200 free credit while running.

Cost warning

Your Windows Server VM costs approximately $1.50/day in compute charges from your Azure free credit. Even with auto-shutdown enabled, the VM restarts when you reconnect. If you are done with this project, delete the resource group to stop all charges immediately.

Resources you used:

Windows Server 2022 VM (DC01) in resource group AD-Lab-RG.
Associated managed disk, network interface, public IP address, virtual network, and network security group.
Azure free account with $200 credit.

Keep everything running

No action needed. Choose this if you plan to continue learning Active Directory in the next few days.

Your VM will automatically shut down at the time you configured during setup. This stops compute charges overnight.
When you want to resume, go to your VM in the Azure Portal and click Start.
Keep an eye on your remaining credit under Cost Management + Billing in the Azure Portal.

Pause - I'll come back to this later

Stop and deallocate your VM to eliminate compute charges. You still pay a small amount for disk storage (approximately $0.10/day), but compute costs stop entirely.

In the Azure Portal, search for Virtual machines in the top search bar.
Click on DC01.
On the VM overview page, click Stop in the top toolbar.
Confirm when prompted. Wait for the status to change to Stopped (deallocated).
To restart later, return to the VM overview page and click Start. Reconnect via RDP using the same public IP address.

Delete - I don't want to use this again

Remove all project resources and stop all charges. This is recommended if you have completed the project and the Secret Mission.

In the Azure Portal, search for Resource groups in the top search bar.
Click on AD-Lab-RG.
Click Delete resource group at the top of the page.
Type AD-Lab-RG in the confirmation field to confirm deletion.
Click Delete. This removes the VM, disk, network interface, public IP, virtual network, and network security group.

This action is permanent

Deleting the resource group is irreversible. All your Active Directory configuration, user accounts, and Group Policy settings will be permanently removed.

That's a Wrap!

Nice work! You just deployed and hardened a Windows Server domain controller in the cloud. That is the identity backbone of nearly every enterprise network in the world, and you built one from scratch.

Here's what you learned:

Deployed a Windows Server 2022 VM in Azure and promoted it to a domain controller with Active Directory Domain Services and DNS.
Built an enterprise-style directory structure with Organizational Units, security groups, and user accounts across multiple departments.
Hardened the domain with Group Policy Objects enforcing password complexity, account lockout, and audit logging.
Implemented Fine-Grained Password Policies for admin accounts and enabled the Active Directory Recycle Bin for disaster recovery.

Ready to quiz yourself?