# A second domain controller on Proxmox with the free Windows Server 2025 evaluation
# https://www.zadran.net/guides/second-domain-controller-proxmox-windows-server-2025
# Generated from the guide, last updated 2026-10-13.
#
# NO WARRANTY. This script is provided as is. You are responsible for
# understanding what it does before running it, and for the consequences.
# Take a backup first. See https://www.zadran.net/disclaimer
#
# Destructive steps are left commented out on purpose -- uncomment them
# only once you have understood what they do.
#
# If Windows will not run this file: a script saved from a browser is
# marked as downloaded, and the RemoteSigned policy (the Windows Server
# default) refuses it until you run  Unblock-File .\second-domain-controller-proxmox-windows-server-2025.ps1
# Where the policy is Restricted (the Windows 10 and 11 default), run it as
#   powershell -ExecutionPolicy Bypass -File .\second-domain-controller-proxmox-windows-server-2025.ps1
#
# These are the guide's PowerShell commands. Its bash commands are in
# https://www.zadran.net/guides/second-domain-controller-proxmox-windows-server-2025/script.sh

$ErrorActionPreference = 'Stop'

# ---- Set these for your environment ----
# Your Active Directory domain
$DOMAIN = 'home.example.com'
# The NetBIOS name, as in HOME\Administrator
$NETBIOS = 'HOME'
# Host name only
$DC1_NAME = 'dc1'
$DC1_IP = '192.168.1.21'
# Host name only, max 15 characters
$DC2_NAME = 'dc2'
# A free fixed IP
$DC2_IP = '192.168.1.22'
# 24 = 255.255.255.0
$PREFIX = '24'
# Usually your router
$GATEWAY = '192.168.1.1'
# e.g. your first AdGuard Home
$DNS_FWD1 = '192.168.1.53'
# e.g. your second AdGuard Home
$DNS_FWD2 = '192.168.1.54'
# Get-TimeZone -ListAvailable shows all
$WIN_TIMEZONE = 'W. Europe Standard Time'

dcdiag /q
repadmin /showrepl

$if = (Get-NetAdapter | Where-Object Status -eq 'Up').Name
Set-NetIPInterface -InterfaceAlias $if -AddressFamily IPv4 -Dhcp Disabled
Get-NetIPAddress -InterfaceAlias $if -AddressFamily IPv4 -ErrorAction SilentlyContinue | Remove-NetIPAddress -Confirm:$false
Remove-NetRoute -InterfaceAlias $if -DestinationPrefix '0.0.0.0/0' -Confirm:$false -ErrorAction SilentlyContinue
New-NetIPAddress -InterfaceAlias $if -IPAddress $DC2_IP -PrefixLength $PREFIX -DefaultGateway $GATEWAY
Set-DnsClientServerAddress -InterfaceAlias $if -ServerAddresses $DC1_IP
Set-TimeZone -Id "${WIN_TIMEZONE}"
Rename-Computer -NewName $DC2_NAME -Restart

Resolve-DnsName _ldap._tcp.dc._msdcs.$DOMAIN -Type SRV | Select-Object NameTarget, Port
Test-NetConnection $DC1_IP -Port 389 | Select-Object RemoteAddress, TcpTestSucceeded

Add-Computer -DomainName $DOMAIN -Credential (Get-Credential -Message "Domain admin" -UserName "${NETBIOS}\Administrator") -Restart

Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
$dsrm = Read-Host -AsSecureString "DSRM password"
Test-ADDSDomainControllerInstallation -DomainName $DOMAIN -InstallDns -SafeModeAdministratorPassword $dsrm | Select-Object Status, Message

Install-ADDSDomainController -DomainName $DOMAIN -InstallDns -ReplicationSourceDC "${DC1_NAME}.${DOMAIN}" -SafeModeAdministratorPassword $dsrm -Force

$if = (Get-NetAdapter | Where-Object Status -eq 'Up').Name
Set-DnsClientServerAddress -InterfaceAlias $if -ServerAddresses $DC1_IP,$DC2_IP,127.0.0.1

$if = (Get-NetAdapter | Where-Object Status -eq 'Up').Name
Set-DnsClientServerAddress -InterfaceAlias $if -ServerAddresses $DC2_IP,$DC1_IP,127.0.0.1

Get-DnsServerForwarder | Select-Object IPAddress

Set-DnsServerForwarder -IPAddress $DNS_FWD1,$DNS_FWD2
Get-DnsServerForwarder | Select-Object IPAddress

repadmin /replsummary
Get-ADDomainController -Filter * | Format-Table Name, IPv4Address, IsGlobalCatalog, OperationMasterRoles -AutoSize

foreach ($dc in "${DC1_NAME}","${DC2_NAME}") {
  Get-CimInstance -Namespace root\MicrosoftDFS -ClassName DfsrReplicatedFolderInfo -ComputerName $dc |
    Select-Object @{n='DC';e={$dc}}, ReplicatedFolderName, State
}
net share | Select-String 'SYSVOL|NETLOGON'

dcdiag /q

slmgr /dlv

slmgr /rearm
Restart-Computer