How to add a Secondary Domain Controller to an Existing Domain

How to Add a Secondary Domain Controller to an Existing Domain Adding a secondary domain controller to an existing Active Directory domain gives you redundancy — if your primary DC goes down, authentication and directory lookups keep working — and it lets you put a DC physically closer to users at a second site. The […]

How To Add A Secondary Domain Controller To An Existing Domain

How to Add a Secondary Domain Controller to an Existing Domain

Adding a secondary domain controller to an existing Active Directory domain gives you redundancy — if your primary DC goes down, authentication and directory lookups keep working — and it lets you put a DC physically closer to users at a second site. The short version:
  1. On the new server, join it to the existing domain first, then install the Active Directory Domain Services role.
  2. Run the Active Directory Domain Services Configuration Wizard (or Install-ADDSDomainController in PowerShell) and choose “Add a domain controller to an existing domain,” rather than creating a new forest or domain.
  3. Select the existing domain, confirm DNS and Global Catalog options (both are usually left enabled unless you have a specific reason not to), and set a Directory Services Restore Mode (DSRM) password.
  4. Let the wizard complete replication — the new DC will sync AD data, SYSVOL, and DNS zones from an existing DC before it’s ready for use.
Once replication finishes, verify the new DC is healthy with repadmin /replsummary before relying on it for authentication, since a DC that hasn’t fully replicated yet can serve stale or incomplete directory data.

Still Current on Windows Server 2025 (Updated for 2026)

This process is unchanged on Windows Server 2025, the current LTSC release — the same Configuration Wizard/Install-ADDSDomainController path and repadmin /replsummary health check apply. One addition worth knowing for larger domains or slow WAN links between sites: Install From Media (IFM) lets you promote the new DC from a backup/snapshot of an existing DC’s AD database instead of replicating the entire directory over the network first, which can turn a multi-hour initial sync into a few minutes for large domains. Generate the media with ntdsutil (or a system-state backup) on an existing DC, then point the promotion wizard at it with the -InstallationMediaPath parameter.

Resources

🛠️

Gear We Recommend

Running this in a home lab? Here’s the gear that keeps our test environment reliable.

Browse our Home Lab Essentials picks on Amazon

As an Amazon Associate, TechyGeeksHome earns from qualifying purchases.


Discover more from TechyGeeksHome

Subscribe to get the latest posts sent to your email.

Andrew Armstrong

Andrew Armstrong is a UK-based IT professional with 26+ years of hands-on experience in Windows, Windows Server, SCCM/ConfigMgr, Active Directory, PowerShell, and enterprise infrastructure.

He founded TechyGeeksHome in 2010 and has published over 1,500 practical guides covering real-world IT problems and solutions. When not solving IT problems,

Andrew develops free Windows utilities including Ultimate Settings Panel, which has been downloaded over 850,000 times.