# Create a domain This page shows you how to create a domain with Managed Service for Microsoft Active Directory. ## Before you begin 1. [Create a new Virtual Private Cloud (VPC) network](https://docs.cloud.google.com/vpc/docs/create-modify-vpc-networks) to deploy your domain to, or use an existing one. Managed Microsoft AD doesn't support [legacy networks](https://docs.cloud.google.com/vpc/docs/legacy.md.txt). Note down your VPC network's [full resource name](https://docs.cloud.google.com/iam/docs/full-resource-names.md.txt), which you have to specify during the domain creation process. It is in the following format: `projects/PROJECT_ID/global/networks/VPC_NETWORK_NAME` - Before you create a VPC network, make sure that you read [Select VPC networks](https://docs.cloud.google.com/managed-microsoft-ad/docs/update-networks.md.txt). - Make sure that you enable the APIs and create the VPC in the same project where you have enabled billing. ### Required roles To get the permissions that you need to complete this quickstart, ask your administrator to grant you the following IAM roles on your project: - [Google Cloud Managed Identities Admin](https://docs.cloud.google.com/iam/docs/roles-permissions/managedidentities.md.txt#managedidentities.admin) (`roles/managedidentities.admin`) - [Compute Network User](https://docs.cloud.google.com/iam/docs/roles-permissions/compute.md.txt#compute.networkUser) (`roles/compute.networkUser`) For more information about granting roles, see [Manage access to projects, folders, and organizations](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access.md.txt). These predefined roles contain the permissions required to complete this quickstart. To see the exact permissions that are required, expand the **Required permissions** section: #### Required permissions The following permissions are required to complete this quickstart: - `managedidentities.domains.create` - `compute.networks.list` You might also be able to get these permissions with [custom roles](https://docs.cloud.google.com/iam/docs/creating-custom-roles.md.txt) or other [predefined roles](https://docs.cloud.google.com/iam/docs/roles-overview.md.txt#predefined). ## Gather information You need the following information to create your domain: - A [fully qualified domain name (FQDN)](https://wikipedia.org/wiki/Fully_qualified_domain_name) such as `ad.example.com`. For more information, see [Microsoft's naming conventions in Active Directory](https://support.microsoft.com/en-us/help/909264/naming-conventions-in-active-directory-for-computers-domains-sites-and). - A private IP address range that is not in use by any of the VPC subnetworks---for example, `172.16.0.0/24`, `192.168.0.0/24`, or `10.1.0.0/24`. Ideally, you should select a range that is not in use by *any* of the VPC subnetworks where you can use the domain. For more information, see [Select IP address ranges](https://docs.cloud.google.com/managed-microsoft-ad/docs/selecting-ip-address-ranges). - A [region](https://cloud.google.com/about/locations/) to deploy the domain controller to---for example, `us-central1`. When you create a domain, you can deploy the domain controller in only one region. After you create the domain, you can [add domain controllers to additional regions](https://docs.cloud.google.com/managed-microsoft-ad/docs/add-remove-regions#add-region) to increase availability and be [resilient to regional outages](https://docs.cloud.google.com/architecture/deployment-archetypes/multiregional.md.txt). For information about the supported regions, see [Regions](https://docs.cloud.google.com/managed-microsoft-ad/docs/add-remove-regions.md.txt#regions-list). - A [delegated administrator account username](https://docs.cloud.google.com/managed-microsoft-ad/docs/how-to-use-delegated-admin). You can either use the default username (`setupadmin`) or modify it. However, you can't change this username after you complete the domain creation. - The [full resource name](https://docs.cloud.google.com/iam/docs/full-resource-names.md.txt) of the authorized VPC network, which is in the following format: ` projects/PROJECT_ID/global/networks/VPC_NETWORK_NAME ` ## Create the domain To create a domain, complete the following steps: ### Console 1. Go to the **Managed Microsoft AD** page. [Go to Managed Microsoft AD](https://console.cloud.google.com/security/cloud-ad) 2. Select **Create New AD Domain**. 3. On the **Create new domain** page, enter the [gathered information](https://docs.cloud.google.com/managed-microsoft-ad/docs/create-domain#gather-information). - Enter the **Fully qualified domain name (FQDN)** for your domain. - In the **Network details** section, select your VPC network name from the list. Select **OK**. - In the **CIDR Range** section, enter the IP address range for your domain. - In the **Regions** section, select a region from the list in which you want to deploy the domain controller. - In the **Admin name** field of the **Delegated admin** section, use the default username (`setupadmin`) or enter a username for your delegated administrator account. This is your only opportunity to change the username for the delegated administrator account. After domain creation, you can't change the username for the delegated administrator account. 4. Select **Create domain**. It can take up to 60 minutes to create a domain. When the domain creation is complete, you receive a notification in the Google Cloud console. You can view the status of this operation at any time under **Notifications** in the Google Cloud console. If the domain creation fails, click **See all activities** under **Notifications** to view the error message. ### gcloud Run the following gcloud CLI command: ``` gcloud active-directory domains create FULLY_QUALIFIED_DOMAIN_NAME \ --reserved-ip-range=CIDR_RANGE --region=REGION \ --authorized-networks=projects/PROJECT_ID/global/networks/VPC_NETWORK_NAME ``` Replace the placeholder variables with the [gathered information](https://docs.cloud.google.com/managed-microsoft-ad/docs/create-domain#gather-information). You receive the following response that indicates domain creation has started: ``` Create request issued for: FULLY_QUALIFIED_DOMAIN_NAME Waiting for operation-1554140234884-5857b78a1a49e-02bc63a3-77e5c7ee to complete... ``` It can take up to 60 minutes to create a domain. The gcloud CLI operation status updates when the domain creation is complete. If the domain creation fails, the gcloud CLI displays an error message on the command line. You can repeat this process to create multiple independent domains in the same project. > [!NOTE] > **Note:** By default, you can create two independent domains in the same project. For more information, see [Limits](https://docs.cloud.google.com/managed-microsoft-ad/quotas.md.txt#limits). If you want to increase the number of independent domains that you can create in the same project, you can [contact Google Cloud support](https://docs.cloud.google.com/managed-microsoft-ad/docs/get-support). To make the domain available on a network in a different project, you can configure [domain peering](https://docs.cloud.google.com/managed-microsoft-ad/docs/domain-peering.md.txt). You can't create [Active Directory sites](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/understanding-active-directory-site-topology) in Managed Microsoft AD because Managed Microsoft AD doesn't support the Active Directory Sites and Services feature. You can't create a [child domain](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/install-a-new-windows-server-2012-active-directory-child-or-tree-domain--level-200-) in Managed Microsoft AD. Also, Managed Microsoft AD can't be part of any other Active Directory domain deployed either on Google Cloud or on-premises. However, after you create a Managed Microsoft AD domain, you can [create a trust relationship](https://docs.cloud.google.com/managed-microsoft-ad/docs/create-trust.md.txt) between the Managed Microsoft AD domain and any other non-Managed Microsoft AD domain. For information about the errors that you might encounter while creating a domain, see [Unable to create a Managed Microsoft AD domain](https://docs.cloud.google.com/managed-microsoft-ad/docs/troubleshooting#create-domain). ## What's next - [Join a Windows VM to a domain](https://docs.cloud.google.com/managed-microsoft-ad/docs/quickstart-domain-join-windows.md.txt) - [Join a Linux VM to a domain](https://docs.cloud.google.com/managed-microsoft-ad/docs/quickstart-domain-join-linux.md.txt) - [Connect to a Managed Microsoft AD domain](https://docs.cloud.google.com/managed-microsoft-ad/docs/connect-to-active-directory-domain.md.txt) - [Configure domain peering](https://docs.cloud.google.com/managed-microsoft-ad/docs/quickstart-domain-peering.md.txt) - [Deploy domain controllers in additional regions](https://docs.cloud.google.com/managed-microsoft-ad/docs/add-remove-regions.md.txt) - [Deploy Managed Microsoft AD with cross-project access using domain peering](https://docs.cloud.google.com/managed-microsoft-ad/docs/shared-vpc-managedad-cloudsql.md.txt)