Building a PC to be used as a Active Directory domain controller?


Recommended Posts

Hey

Just to train (and play around), I'm looking to build a PC to use as a Active Directoy domain controller (among other things) This will be its only use and frankly only 2 PCs in my home can connect to a domain. So key here is budget. The only thing I see really is 2 ethernet ports. That's it.

Thanks!

You shouldn't need two Ethernet ports for a DC. Also, it might be good to use VirtualBox to play around with

In a proper DC setup you do..

ETH1 ETH2

Modem -------- > DC ---------> Switch/Router

This way my DC acts also as a firewall.

Virutalbox (VMWare) isnt the same thing.

Hey

Just to train (and play around), I'm looking to build a PC to use as a Active Directoy domain controller (among other things) This will be its only use and frankly only 2 PCs in my home can connect to a domain. So key here is budget. The only thing I see really is 2 ethernet ports. That's it.

Thanks!

For a lab-type DC, here's the spec skinny (my take):

CPU - Intel Core i5 (LGA1155) - Quad-core makes way too much sense for any sort of domain controller (even one for a micro-domain); however, you don't need HT for a lab-based DC (and you wouldn't overclock a server, let alone a DC, therefore no K-series). Safe bets - i5-2300 or i5-2310 (either is $179.99 @ Newegg)

Motherboard - BIOSTAR TZ77A - A Z chipset for a server sounds nuts; however, hear me out. Intel Rapid Storage Technology is certainly usable by a server (especially a low-end server) when you have an SSD (used as cache) and a RAID boot array. Also, you can completely forgo a discrete graphics card altogether. It's also a mere $109.99 at Newegg. Alternative - BIOSTAR TZ77B (6-phase PWM, vs. 8-phase PWM in the TZ77A, and $20 less at Newegg).

RAM - TEAM 16 GB (4GB x4) DDR3-1333 - Sandy Bridge can't normally use faster-speed memory than DDR3-1333 - in fact, it will actually underclock it in normal operation; why pay more for a faster speed you will never use? Hence my going bargain here - $69.98 at Newegg (use promo code EMCNFHF44 by April 30th to save an additional fifteen percent)

Secondary Ethernet - Intel EXPI9301 PCIe X1 gigabit adapter - Surprisingly, Intel gigabit is cheaper standalone than at the PHY level, and this is as solid (and as inexpensive) as Intel gigabit gets. $29.99 at Newegg.

Storage (internal SSD) - SAMSUNG 830 Series 64GB 2.5" SSD - When it comes to SSDs, there's Samsung, Intel - and everyone else. If Intel is too pricey, then Samsung is your only real choice. $104.99 at Newegg (MZ-7PC064B/WW)

Storage (RAID) - Western Digital Caviar Green WD15EARS x2 - These are the non-IntelliPower members of the Caviar Green family in this size (1.5 TB each) - $219.98 for the pair at Newegg.

OS - Windows Server 8 beta - The beta version of Microsoft's next Windows Server (Windows Server 2012); thus perfect for a lab. Cost - none (download from Microsoft TechNet or MSDN).

In a proper DC setup you do..

ETH1 ETH2

Modem -------- > DC ---------> Switch/Router

This way my DC acts also as a firewall.

Virutalbox (VMWare) isnt the same thing.

no you don't. the dc belongs behind the switch/router. The only time that you would have something that assinine is if you had a proxy server (isa server or forefront server). For a proper dc setup 1 network card is more than enough. I have been setting up proper Domain Controllers for years and I have never ever done or seen anything like this.

You can pick up a cheap supermicro server and do what you need to. dual nics is more for redundancy than anything else, if one nic fails the other is there to continue on. This is known as nic teaming. Nic teaming is the proper way to setup a DC, plugging the nics into two different switches so that even if a switch fails completely the other switch still has access to the dc. It is about redundancy not whatever you did there. The DC does not act as a firewall, it is not meant to and this creates a security risk by putting your user db on the outside of the firewall...might as well give the hacking community the keys to your house too.

no you don't. the dc belongs behind the switch/router. The only time that you would have something that assinine is if you had a proxy server (isa server or forefront server). For a proper dc setup 1 network card is more than enough. I have been setting up proper Domain Controllers for years and I have never ever done or seen anything like this.

You can pick up a cheap supermicro server and do what you need to. dual nics is more for redundancy than anything else, if one nic fails the other is there to continue on. This is known as nic teaming. Nic teaming is the proper way to setup a DC, plugging the nics into two different switches so that even if a switch fails completely the other switch still has access to the dc. It is about redundancy not whatever you did there. The DC does not act as a firewall, it is not meant to and this creates a security risk by putting your user db on the outside of the firewall...might as well give the hacking community the keys to your house too.

Im not sure what you understood so Ill put it downwards.

(Internet)

|

|

|

[MODEM]

|

|

|

|

V

[DC]

|

|

|

|

V

[sWITCH/ROUTER]

|

|

|

|

V

[PC]

I need dual NICs to control (or analyze if you might want to call it like that) what comes into the network (from external sources) to what comes out ONTO the network (the switch/router). Since there are only 2 possible PCs here that can connect to a domain, Ill trust everything inside the network.

Let me put it to you like this. Your dc has a trusted and untrusted interface. Your dc with your AD database that includes your user information in the SAM, passwords as well as usernames, group info, share rights, etc...and you are OK with this? This is about as secure as leaving your car running, keys in the ignition, door wide open, in the bad area in town with your pants around your ankles and a sign asking for a guy named bubba to come and ram a stick in your rear then take your car.

If you want it to be secure, dc behind the firewall, and a forefront threat management gateway server to handle your traffic monitoring with 2 nics for an unsecure and secure side. That is the proper way to do it, Microsoft wise. The forefront server becomes the firewall, not the DC.

For a lab-type DC, here's the spec skinny (my take):

CPU - Intel Core i5 (LGA1155) - Quad-core makes way too much sense for any sort of domain controller (even one for a micro-domain); however, you don't need HT for a lab-based DC (and you wouldn't overclock a server, let alone a DC, therefore no K-series). Safe bets - i5-2300 or i5-2310 (either is $179.99 @ Newegg)

Motherboard - BIOSTAR TZ77A - A Z chipset for a server sounds nuts; however, hear me out. Intel Rapid Storage Technology is certainly usable by a server (especially a low-end server) when you have an SSD (used as cache) and a RAID boot array. Also, you can completely forgo a discrete graphics card altogether. It's also a mere $109.99 at Newegg. Alternative - BIOSTAR TZ77B (6-phase PWM, vs. 8-phase PWM in the TZ77A, and $20 less at Newegg).

RAM - TEAM 16 GB (4GB x4) DDR3-1333 - Sandy Bridge can't normally use faster-speed memory than DDR3-1333 - in fact, it will actually underclock it in normal operation; why pay more for a faster speed you will never use? Hence my going bargain here - $69.98 at Newegg (use promo code EMCNFHF44 by April 30th to save an additional fifteen percent)

Secondary Ethernet - Intel EXPI9301 PCIe X1 gigabit adapter - Surprisingly, Intel gigabit is cheaper standalone than at the PHY level, and this is as solid (and as inexpensive) as Intel gigabit gets. $29.99 at Newegg.

Storage (internal SSD) - SAMSUNG 830 Series 64GB 2.5" SSD - When it comes to SSDs, there's Samsung, Intel - and everyone else. If Intel is too pricey, then Samsung is your only real choice. $104.99 at Newegg (MZ-7PC064B/WW)

Storage (RAID) - Western Digital Caviar Green WD15EARS x2 - These are the non-IntelliPower members of the Caviar Green family in this size (1.5 TB each) - $219.98 for the pair at Newegg.

OS - Windows Server 8 beta - The beta version of Microsoft's next Windows Server (Windows Server 2012); thus perfect for a lab. Cost - none (download from Microsoft TechNet or MSDN).

For a lab-type DC, here's the spec skinny (my take):

CPU - Intel Core i5 (LGA1155) - Quad-core makes way too much sense for any sort of domain controller (even one for a micro-domain); however, you don't need HT for a lab-based DC (and you wouldn't overclock a server, let alone a DC, therefore no K-series). Safe bets - i5-2300 or i5-2310 (either is $179.99 @ Newegg)

Motherboard - BIOSTAR TZ77A - A Z chipset for a server sounds nuts; however, hear me out. Intel Rapid Storage Technology is certainly usable by a server (especially a low-end server) when you have an SSD (used as cache) and a RAID boot array. Also, you can completely forgo a discrete graphics card altogether. It's also a mere $109.99 at Newegg. Alternative - BIOSTAR TZ77B (6-phase PWM, vs. 8-phase PWM in the TZ77A, and $20 less at Newegg).

RAM - TEAM 16 GB (4GB x4) DDR3-1333 - Sandy Bridge can't normally use faster-speed memory than DDR3-1333 - in fact, it will actually underclock it in normal operation; why pay more for a faster speed you will never use? Hence my going bargain here - $69.98 at Newegg (use promo code EMCNFHF44 by April 30th to save an additional fifteen percent)

Secondary Ethernet - Intel EXPI9301 PCIe X1 gigabit adapter - Surprisingly, Intel gigabit is cheaper standalone than at the PHY level, and this is as solid (and as inexpensive) as Intel gigabit gets. $29.99 at Newegg.

Storage (internal SSD) - SAMSUNG 830 Series 64GB 2.5" SSD - When it comes to SSDs, there's Samsung, Intel - and everyone else. If Intel is too pricey, then Samsung is your only real choice. $104.99 at Newegg (MZ-7PC064B/WW)

Storage (RAID) - Western Digital Caviar Green WD15EARS x2 - These are the non-IntelliPower members of the Caviar Green family in this size (1.5 TB each) - $219.98 for the pair at Newegg.

OS - Windows Server 8 beta - The beta version of Microsoft's next Windows Server (Windows Server 2012); thus perfect for a lab. Cost - none (download from Microsoft TechNet or MSDN).

Overkill for a pet project with only 2 clients.

Why did you even ask for help if all you are doing is arguing?

:/ Im not arguing. PGHammer's specs were WAY over the line/budget for a simple physical test. Ive player around with a Virutalbox but it is not the same. sc302 misunderstood me in the first post he made and now I read his second (did not notice it)

Thanks to all for the help.

I suppose one of the questions is what version of Windows are you using for the AD? If it's windows 2003 you could get by on a P4 and 512MB RAM, if it's Windows 2008R2 you'll need a 64bit processor and 1GB RAM, that is if all your doing is AD, you've only got a couple of potential machines connecting to it so your not going to tax it. So really any processor you buy will be fine, as it's a pet project just buy the cheapest machine you can.

Also in a production environment i wouldn't have the domain controller connected directly to anything apart from the switch with one nic, two if you want fall over.

You can use any old PC hardware for just an AD. I run my home network on an Intel Atom and this runs a Linux VM, AD/DNS/DHCP, file serving and a PS3 media server. The only thing it doesn't do that well at is the PS3 media server when it has to re-encode a big file on the fly.

I agree with sc302 with the double NIC thing. You don't want to be exposing your AD to the external web. Suppose instead you could do a ESXi setup but I would guess the network routing configuration would be complicated to say the least.

Let me put it to you like this. Your dc has a trusted and untrusted interface.

By interface, I understand (once again) 2 NICs....

Your dc with your AD database that includes your user information in the SAM, passwords as well as usernames, group info, share rights, etc...and you are OK with this?

This implementation will not be a production area. It will be at my home with 2 PCs that contain nothing "important" to the public eye.

This is about as secure as leaving your car running, keys in the ignition, door wide open, in the bad area in town with your pants around your ankles and a sign asking for a guy named bubba to come and ram a stick in your rear then take your car.

Vast exaggeration. The car is not running because you need a password to run it. The door may be unlocked but the town only has about 10 citizens, none what so ever tech orientated (all the wifi signals in my neighboorhood are WEP :laugh: ) so there is no bubba, no sign, and no stick.

Would I even consider implementing a system like this in a production system? No way. I would consider my options (obviously you have given great advice so thank you) and then implement it another way.

If you want it to be secure, dc behind the firewall, and a forefront threat management gateway server to handle your traffic monitoring with 2 nics for an unsecure and secure side. That is the proper way to do it, Microsoft wise. The forefront server becomes the firewall, not the DC.

So your setup would be something like { Things in () are software/non existing/virtual/etc components and things in [] are hardware components } :

(Internet)

|

|

|

[MODEM]

|

|

|

|

V

(Firewall)

|

|

|

|

V

[DC]

|

|

|

|

V

[sWITCH/ROUTER]

|

|

|

|

V

[PC]

There is something a bit bugging me which maybe is my fault of lack of knowledge. On the DC, I can simply put a firewall for incoming connections and on the switch/router (which runs DD-WRT) I can put another firewall, making the DC be in a DMZ zone. I THINK what you are trying to get it is using another piece of equipment before the DC to use as a more secure firewall, which obviously is not the topic at hand :)

After all this conversation (and of course learning a thing or two), lets stick to the topic: Building a PC to be used as a Active Directory domain controller. Lets forget about security, setup, etc. for now. I just want to build a PC to be used as a Active Directory domain controller (hence why in the hardware section of Neowin)

The most I want out of this PC is probably getting the clients on the domain and Group Policy. After that, I really don't want much else out of it. Thats why it has to be budget :)

no you don't. the dc belongs behind the switch/router. The only time that you would have something that assinine is if you had a proxy server (isa server or forefront server). For a proper dc setup 1 network card is more than enough. I have been setting up proper Domain Controllers for years and I have never ever done or seen anything like this.

You can pick up a cheap supermicro server and do what you need to. dual nics is more for redundancy than anything else, if one nic fails the other is there to continue on. This is known as nic teaming. Nic teaming is the proper way to setup a DC, plugging the nics into two different switches so that even if a switch fails completely the other switch still has access to the dc. It is about redundancy not whatever you did there. The DC does not act as a firewall, it is not meant to and this creates a security risk by putting your user db on the outside of the firewall...might as well give the hacking community the keys to your house too.

All of this is correct, you don't need 2 NICs for a DC unless like he says you are worried about redundancy... I am not sure why you would put a DC between your Modem and Router. The only box that should be there in a normal network if you are using one would be a Proxy/Firewall system...

I suppose one of the questions is what version of Windows are you using for the AD? If it's windows 2003 you could get by on a P4 and 512MB RAM, if it's Windows 2008R2 you'll need a 64bit processor and 1GB RAM, that is if all your doing is AD, you've only got a couple of potential machines connecting to it so your not going to tax it. So really any processor you buy will be fine, as it's a pet project just buy the cheapest machine you can.

Also in a production environment i wouldn't have the domain controller connected directly to anything apart from the switch with one nic, two if you want fall over.

Well Im going to start with Windows Server 2008 R2 but once released, Ill go with Windows Server 2012. This means that (at beta time) the min requirements will be a 64 bit processor running at least 1.4 GHz, 512 MB of RAM, and at least 32GB of free space. Obviously, a bit more is needed as min requirements are not always the best and I may mess around with our things as well (Exchange servers, DNS/DHCP, etc) in the future.

You can use any old PC hardware for just an AD. I run my home network on an Intel Atom and this runs a Linux VM, AD/DNS/DHCP, file serving and a PS3 media server. The only thing it doesn't do that well at is the PS3 media server when it has to re-encode a big file on the fly.

I agree with sc302 with the double NIC thing. You don't want to be exposing your AD to the external web. Suppose instead you could do a ESXi setup but I would guess the network routing configuration would be complicated to say the least.

Pretty much same as above :)

Honestly for just a domain controller, I would keep the hardware specs to the minimum requirements for Windows Server or slightly above. If the machine will act solely as a DC (and maybe some small file storage), then it will only be handling authentications, which takes up almost no system resources.

I have servers at work using 2.4Ghz Athlon 64's with 512MB ram running Server 2003R2 that function as domain controllers for 50+ users easily.

I got this cheap list (cheapest products unless it was a nobrand vs a brand and the cost was min):

Gigabyte GA-H61M-DS2 41 euros

Intel Dual Core G620 2.6Ghz Box Socket 1155 53 euros

WD Caviar Blue 250GB SATA3 62 euros

Kingston ValueRAM 4GB DDR3 1333 PC3-10600 CL9 23 euros

Sony AD-5280S-0B DVD-RW 24X Black OEM 16.50 euros

Cooler Master Elite 342 MicroATX 27 euros

B-Move PSU 450W 17.95 euros

Total: 240.45 euros

I can cutdown to 2GB on the RAM and on the case....

The only thing you want is for the OS hdd to be raided in a mirror so that if one hdd dies you still have the other as a backup.

If your using 2008 or 2008 r2 i also advise an external hdd to be used as a backup drive for windows server backup.

Thats what I would recommend for a domain controller.

Why can't you understand that you don't need two NICs. One will be sufficient.

OK, then I guess, since we continue to make the software side a issue, we will have this setup:

(Internet)

|

|

|

[MODEM]

|

|

|

|

V

[sWITCH/ROUTER (Firewall)]

| |

| |

| |

| |

V V

[PC] [DC]

The only thing you want is for the OS hdd to be raided in a mirror so that if one hdd dies you still have the other as a backup.

If your using 2008 or 2008 r2 i also advise an external hdd to be used as a backup drive for windows server backup.

Thats what I would recommend for a domain controller.

Once again, this is not a production system. If the HDD dies, Ill just simply send it back, get a replacement, and reinstall.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Again, this is an irrelevant attempt to attack the messenger. The truth does not require any justification.
    • Removed the blue and underline as you did not post a link. This would also  be considered spamming.
    • Why it's almost impossible to produce a smartphone in the United States by Hamid Ganji If you look at the back of some Apple products, you can see the famous phrase “Designed by Apple in California, Assembled in China.” This phrase appears on products from one of the largest smartphone brands in the United States. These products are designed in the U.S., but their manufacturing takes place in China, India, Vietnam, or even Brazil. But why can’t Apple, as one of the largest American tech companies, produce its iPhones on U.S. soil? The idea for this topic came to me after the Trump Foundation launched a smartphone called the T1 and claimed that it was designed and built with American values in mind. However, this claim did not last long, as it was revealed that Trump’s phone was actually a rebranded HTC U24 Pro, with only a gold case and minor internal component changes. You see? Even a phone that is supposed to represent American values is manufactured in China. With a gross domestic product (GDP) exceeding $32 trillion, the United States is currently the world’s largest economy, while China ranks second with around $20 trillion. On the other hand, the United States is by a wide margin the global leader in various technological fields, and American companies spend hundreds of billions of dollars annually on research and development. From Apple and Google to Microsoft, Lockheed Martin, Boeing, and others, American tech and industrial giants lead their foreign competitors in many sectors. The United States also has no shortage of smartphone brands. Apple, Google, and Motorola are among the major brands in the smartphone market, collectively holding a significant share. However, the vast majority of their products are manufactured outside the United States. So why is it that the world’s largest economy, home to the most advanced technology companies and industrial powers, cannot produce a smartphone on its own soil? Let’s explore this question together. Even threats to impose tariffs won’t work After Trump entered the White House as the 47th President of the United States, his administration adopted strict tariff policies. One of these policies was the imposition of a 25% tariff on smartphones manufactured outside the United States. Trump said he “had a little problem” with Apple CEO Tim Cook over producing smartphones outside the U.S. So he thought that threatening a 25% tax on imported phones might force Apple to bring manufacturing back to the United States. “I have long ago informed Tim Cook of Apple that I expect their iPhones that will be sold in the United States of America will be manufactured and built in the United States, not India, or anyplace else,” Trump wrote on Truth Social. Image via The White House Although Apple currently manufactures some of the iPhone’s chips in the United States with TSMC's help, it still shows no willingness to shift full iPhone production to the country. At the time, renowned Apple supply chain analyst Ming-Chi Kuo wrote on X, “In terms of profitability, it’s way better for Apple to take the hit of a 25% tariff on iPhones sold in the US market than to move iPhone assembly lines back to the US.” However, manufacturing a smartphone in the United States is not as easy as it might seem, and many technical and economic barriers are involved. The lack of necessary manufacturing hubs There is a clear reason why many companies prefer to manufacture their products in China. China has established itself as the main global manufacturing hub for international companies, and over the past few decades, large contract manufacturers have emerged there, allowing companies like Apple to outsource production. One such example is Foxconn, which also manufactures some Apple products in India. Building the infrastructure required to produce smartphones in the United States would require tens of billions of dollars in new investment. Factories would need to be built, essential manufacturing equipment would have to be installed, and, most importantly, a skilled workforce capable of operating these systems would need to be recruited and trained. The United States currently lacks the core infrastructure needed to manufacture smartphones, and for this reason, many companies prefer to outsource production to Chinese contractors rather than spend tens of billions of dollars to build that infrastructure, which is significantly more economically efficient. Additionally, building such infrastructure in the United States could take up to a decade, ultimately leading to a significant increase in the product's final price for consumers. Shortage of trained labor in the U.S. compared to China Decades of serving as a global manufacturing hub have allowed China to build a massive talent pool in the production sector that is almost unmatched worldwide. Today, if a company chooses to manufacture its products in China, it can be confident that the workers involved in production have years of experience in their respective roles and are capable of producing high-quality goods with minimal errors. Even if we assume that tens of billions of dollars were invested in building smartphone manufacturing infrastructure in the United States, finding skilled workers would remain highly challenging. Apple CEO Tim Cook visiting the iPhone 6 assembly line in China in 2014. Image: Tim Cook on X In a 2015 interview on CBS’s 60 Minutes, Tim Cook said the main reason Apple isn’t producing in the US is a lack of skills. "China put an enormous focus on manufacturing, in what you and I would call vocational kind of skills. The US over time began to stop having as many vocational kinds of skills. I mean you could take every tool and die maker in the United States and probably put them in the room that we're currently sitting in. In China you would have to have multiple football fields,” Cook said. Also, in 2017, at the Fortune Global Forum in Guangzhou, Cook once again emphasized the importance of highly skilled Chinese workers. “China has moved into very advanced manufacturing, so you find in China the intersection of craftsman kind of skill, and sophisticated robotics and the computer science world. That intersection, which is very rare to find anywhere, that kind of skill, is very important to our business because of the precision and quality level that we like. The thing that most people focus on if they’re a foreigner coming to China is the size of the market, and obviously, it’s the biggest market in the world in so many areas. But for us, the number one attraction is the quality of the people,” Apple CEO said. Higher labor costs in the United States Producing almost any product in the United States is more expensive than in many other countries, and one of the main reasons is the higher cost of labor in the U.S. According to the Bureau of Labor Statistics, median weekly earnings of full-time workers in the United States were $1,235 in the first quarter of 2026. Meanwhile, the average annual salary in China's private sector in 2025 was RMB 71,590 (US$9,961). In many parts of the world, the weekly wage of an American worker is equivalent to several months of income. Another important factor to consider is that in the United States, the workforce capable of working on a smartphone assembly line is highly specialized and therefore commands higher-than-average wages. According to an estimate by Bank of America, producing an iPhone in the U.S. is technically possible, but “iPhone cost can increase 25% purely on higher labor cost in the U.S.” However, this 25% increase applies only if final assembly is performed in the United States while components are still sourced from China or elsewhere. In this case, the price of a base iPhone would rise from $799 to around $1,000. But in another scenario, if Apple were to produce the required components for the iPhone within the United States, production costs could increase by more than 90%. Trump’s dream for a “Made in the USA” iPhone might never come true In a free-market capitalist economy, one of the primary responsibilities of any CEO is to maximize profit. Using Apple as an example, Tim Cook’s role is to maximize the company’s profits so that it can fund research and development for new products and invest in areas such as artificial intelligence, while also keeping shareholders satisfied. Therefore, it is entirely understandable that Apple would choose not to bring its manufacturing back to the United States and instead keep production in countries where labor is cheaper, and products can be manufactured at a lower cost, thereby maximizing its profit margins. What is your opinion about manufacturing smartphones in the United States? If you are an American citizen, would you be willing to pay hundreds of dollars more for a smartphone made domestically in the USA? Let us know in the comments.
  • Recent Achievements

    • Conversation Starter
      jessse3334 earned a badge
      Conversation Starter
    • Reacting Well
      JuvenileDelinquent earned a badge
      Reacting Well
    • One Month Later
      Excellence2025 earned a badge
      One Month Later
    • Week One Done
      Excellence2025 earned a badge
      Week One Done
    • Week One Done
      flexorcist earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      506
    2. 2
      +Edouard
      196
    3. 3
      PsYcHoKiLLa
      153
    4. 4
      Steven P.
      72
    5. 5
      FloatingFatMan
      65
  • Tell a friend

    Love Neowin? Tell a friend!