Running an Active Directory domain controller on a VPS
The AD DS role installs like any other server role, because you get full administrator access to the machine.
Starting at €13/mo
Introduction
Active Directory is not an application you drop next to the others: it is a server role that carries authentication, the directory and the policies of an entire estate. On our Windows VPS range it can be installed because you receive full administrator access to the machine, with no locked image and no role stripped out. The range starts at €8/month incl. VAT on NVMe storage, with a dedicated IPv4, Anti-DDoS, snapshots and delivery in 10 minutes.
A domain controller on its own is a light workload: it answers LDAP and DNS queries, it is not a compute engine. As soon as AD DS shares the machine with other roles — file server, business application, database — we recommend Windows - Plus: 8 vCores, 16 GB of RAM, 200 GB SSD and 500 Mbps, at €13/month incl. VAT. Our official rule already puts 8 GB as the floor once business software enters the picture.
The operating system is picked at order time, at no extra cost: Windows Server 2025, Windows Server 2022 or Windows 11. For this role, take a Windows Server. Windows 11 is a client system, not designed to host a multi-user service: a Windows 11 machine joins a domain, it does not host one. The Microsoft licence remains your responsibility: By-Hoster installs the system but neither supplies nor resells a licence.
What full administrator access actually lets you do
The AD DS role installs normally
Nothing special to ask support for. The <strong>Active Directory Domain Services</strong> role is added from Server Manager or in PowerShell with <code>Install-WindowsFeature AD-Domain-Services</code>, then the machine is promoted to domain controller with <code>Install-ADDSForest</code>. That works because the server's administrator account is yours, on a standard system, with no capped role.
DNS is half the job
An Active Directory domain does not work without DNS: <strong>SRV records</strong> are what let workstations find the controller. The promotion wizard installs and configures the DNS Server role in the same pass. The VPS <strong>dedicated IPv4</strong> then acts as the DNS server address for member machines, provided they can reach it.
GPOs, organisational units and accounts
Once the domain is up, the Active Directory Users and Computers console and the Group Policy Management Editor behave exactly as on a physical server: organisational units, security groups, password policies, logon scripts, settings deployment. The same Microsoft tooling, on a machine only you administer.
A snapshot before a schema change
Extending the forest schema — some third-party products do it during setup — is irreversible on the directory side. Take a <strong>snapshot</strong> from the client area just before: if the installation fails halfway, you go back to the previous state. Restoring a controller that is already in production, however, calls for a few precautions detailed below.
Situations that bring Active Directory onto a VPS
Centralising accounts
One login per person, one password to change, permissions that follow the user from one workstation to the next. That is the first benefit of a directory, and it does not wait for a hundred machines to be worth it.
A domain behind an RDP server
When several people work over Remote Desktop on the same Windows machine, the directory gives named accounts instead of one shared account, and file permissions readable per group instead of case by case.
Standardising workstations with GPOs
Mapped drives, browser settings, password policy, installation restrictions: a group policy is written once and applies to a whole organisational unit, instead of being copied machine by machine.
File server with per-group rights
Shares whose NTFS permissions rely on domain security groups rather than local accounts recreated everywhere. The day someone leaves, you disable one account instead of fixing ten.
An extra controller, off the premises
Plenty of setups run a single domain controller, in a single room. Promoting an additional controller on a VPS puts a replica of the directory somewhere else, provided you establish a reliable network link between the two sites.
Lab, migration and training
Building a test forest, trying a functional level upgrade, preparing a migration, training a team. The server is delivered in 10 minutes, reinstalls from the client area, and commits you to nothing: no contract, 48-hour money-back.
Frequently asked questions
The Windows range starts at €8/month incl. VAT with Windows - Core (4 vCores, 8 GB of RAM, 50 GB SSD, 500 Mbps), which is enough for a lone domain controller in a small organisation. As soon as AD DS shares the machine with other roles, we recommend Windows - Plus at €13/month (8 vCores, 16 GB, 200 GB), the most popular plan. Above that: Windows - Max at €26/month (16 vCores, 32 GB, 500 GB) and Windows - Titan at €49.99/month (24 vCores, 64 GB, 800 GB, 1000 Mbps). Annual billing gives -10%. The Windows licence is not included.
Yes. You get full administrator access to the machine: the Active Directory Domain Services role is added from Server Manager or in PowerShell, then the server is promoted to domain controller. The DNS Server role installs in the same move. A backup VNC console stays available if something you do cuts RDP access — and promoting a controller, which involves a reboot and a change of authentication, is exactly the kind of operation where it earns its keep.
No. Windows 11 is a client system, not designed to host a multi-user service, and it does not carry the AD DS role: a Windows 11 machine joins a domain, it does not host one. Its support also depends on the installed release, roughly 24 months per version, with no fixed date. For this role pick Windows Server 2025 or Windows Server 2022, both offered at order time at no extra cost. If you already ordered Windows 11, reinstalling from the client area lets you switch system.
Our official rule: 4 GB minimum for light use, RDP and office work on your own, and 8 GB as soon as you add business software, SQL Server Express or several simultaneous users. Every Windows plan already starts at 8 GB, which covers a lone domain controller. Once AD DS sits alongside other roles — files, business application, database — move to 16 GB with Windows - Plus: the directory database is held in memory, and everything else has to fit beside it without stepping on it.
Yes, and it is your responsibility. By-Hoster installs the operating system but neither supplies nor resells Microsoft licences: you must hold a valid one for your usage. Two points deserve attention. Windows Server allows 2 concurrent administrative RDP sessions; beyond that, for multi-user application RDP access, RDS CAL licences are required. And if you add SQL Server it needs its own licence: Express is free, Standard and Enterprise are paid Microsoft editions.
It is a single point of failure, and it is better to know that beforehand than to discover it: if that server is unavailable, so is domain authentication, along with the DNS that goes with it. Microsoft has always recommended at least two controllers for a production domain. Nothing stops you ordering a second Windows VPS and promoting an additional controller on it: replication then does the work. For a lab, a mock-up or a very small organisation, a single controller stays a deliberate choice — not a best practice.
Snapshots are available from the client area and genuinely help, but a domain controller calls for one precaution. Controllers track a replication counter, the USNs: rolling back to an earlier state on a domain with several controllers can desynchronise them, a phenomenon known as USN rollback. In practice, a snapshot taken just before a schema change or a role installation, restored straight away if the attempt fails, stays safe. To go back several days on a multi-controller domain, use the restore procedures Microsoft provides.
Yes, and it is usually automatic. An Active Directory domain relies on DNS: SRV records are what let member machines locate the controller, open a session and apply policies. The promotion wizard offers to install the DNS Server role and create the domain zone. Member machines then have to point at the controller's address as their DNS server: every VPS comes with a dedicated IPv4, which gives you a stable address for that.
Windows Server 2025 is the latest LTSC release: mainstream support until 13 November 2029, security updates until 14 November 2034, with hotpatching and SMB over QUIC. Windows Server 2022 is still relevant if a software vendor has not certified 2025 yet: mainstream support until 13 October 2026, security until 14 October 2031, Secured-core and TLS 1.3. Both are offered at order time at no extra cost, and the system can be changed later by reinstalling from the client area.
In our single datacenter DC-FR_NA(01), in Nouvelle-Aquitaine, France, operated directly by the association's technical team. Virtualisation runs on KVM via Proxmox. Your directory data — accounts, groups, policies — stays under French jurisdiction, within the GDPR framework, with no transfer outside the European Union. By-Hoster is a French non-profit association under the 1901 law (RNA W162005815, SIRET 92395660100010) founded in 2023. VPS come with no commitment and a 48-hour money-back guarantee.