Organiza tus páginas con colecciones
Guarda y categoriza el contenido según tus preferencias.
Crea un dominio
En esta página, se muestra cómo crear un dominio con el Servicio administrado para Microsoft Active Directory.
Antes de comenzar
Sign in to your Google Cloud account. If you're new to
Google Cloud,
create an account to evaluate how our products perform in
real-world scenarios. New customers also get $300 in free credits to
run, test, and deploy workloads.
In the Google Cloud console, on the project selector page,
select or create a Google Cloud project.
Un rango de direcciones IP privadas que no esté en uso por ninguna de las subredes de VPC (por ejemplo, 172.16.0.0/24, 192.168.0.0/24 o 10.1.0.0/24). Lo ideal sería que selecciones un rango que no esté en uso por ninguna de las subredes de VPC en las que puedes usar el dominio. Para obtener más información, consulta Selecciona rangos de direcciones IP.
Para obtener información sobre las regiones admitidas, consulta Regiones.
Un nombre de usuario de cuenta de administrador delegada Puedes usar el nombre de usuario predeterminado (setupadmin) o modificarlo. Sin embargo, no podrás cambiar este nombre de usuario después de completar la creación del dominio.
El nombre de recurso completo de la red de VPC autorizada, que tiene el siguiente formato:
projects/PROJECT_ID/global/networks/VPC_NETWORK_NAME
Crea el dominio
Para crear un dominio, completa los siguientes pasos:
Ingresa el nombre de dominio completamente calificado (FQDN) de tu dominio.
En la sección Detalles de la red, selecciona el nombre de tu red de VPC en la lista. Selecciona Aceptar.
En la sección Rango de CIDR, ingresa el rango de direcciones IP de tu dominio.
En la sección Regiones, selecciona una región de la lista en la que deseas implementar el controlador de dominio.
En el campo Nombre de administrador de la sección Administrador delegado, usa el nombre de usuario predeterminado (setupadmin) o ingresa un nombre de usuario para tu cuenta de administrador delegado.
Esta es tu única oportunidad para cambiar el nombre de usuario de la cuenta de administrador delegada. Después de crear el dominio, no podrás cambiar el nombre de usuario de la cuenta de administrador delegado.
Selecciona Crear dominio.
La creación de un dominio puede tardar hasta 60 minutos. Cuando se complete la creación del dominio, recibirás una notificación en la consola de Google Cloud .
Puedes ver el estado de esta operación en cualquier momento en Notificaciones en la consola de Google Cloud . Si falla la creación del dominio, haz clic en Ver todas las actividades en Notificaciones para ver el mensaje de error.
Recibirás la siguiente respuesta que indica que se inició la creación del dominio:
Create request issued for: FULLY_QUALIFIED_DOMAIN_NAME
Waiting for operation-1554140234884-5857b78a1a49e-02bc63a3-77e5c7ee to complete...
La creación de un dominio puede tardar hasta 60 minutos. El estado de la operación de gcloud CLI se actualiza cuando se completa la creación del dominio.
Si falla la creación del dominio, gcloud CLI mostrará un mensaje de error en la línea de comandos.
Puedes repetir este proceso para crear varios dominios independientes en el mismo proyecto.
No puedes crear sitios de Active Directory en Microsoft AD administrado porque este servicio no admite la función de sitios y servicios de Active Directory.
No puedes crear un subdominio en Microsoft AD administrado. Además, Microsoft AD administrado no puede formar parte de ningún otro dominio de Active Directory implementado en Google Cloud o en las instalaciones. Sin embargo, después de crear un dominio de Microsoft AD administrado, puedes crear una relación de confianza entre el dominio de Microsoft AD administrado y cualquier otro dominio de Microsoft AD no administrado.
[[["Fácil de comprender","easyToUnderstand","thumb-up"],["Resolvió mi problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Información o código de muestra incorrectos","incorrectInformationOrSampleCode","thumb-down"],["Faltan la información o los ejemplos que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-09-04 (UTC)"],[],[],null,["# Quickstart: Create a domain\n\nCreate a domain\n===============\n\nThis page shows you how to create a domain with Managed Service for Microsoft Active Directory.\n\nBefore you begin\n----------------\n\n- Sign in to your Google Cloud account. If you're new to Google Cloud, [create an account](https://console.cloud.google.com/freetrial) to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the\n Managed Microsoft AD, Cloud DNS, and Compute Engine\n APIs.\n\n\n [Enable the APIs](https://console.cloud.google.com/flows/enableapi?apiid=\n managedidentities.googleapis.com,dns.googleapis.com,compute.googleapis.com\n )\n\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the\n Managed Microsoft AD, Cloud DNS, and Compute Engine\n APIs.\n\n\n [Enable the APIs](https://console.cloud.google.com/flows/enableapi?apiid=\n managedidentities.googleapis.com,dns.googleapis.com,compute.googleapis.com\n )\n\n1. [Create a new Virtual Private Cloud (VPC)\n network](/vpc/docs/create-modify-vpc-networks) to deploy your domain to, or use an existing one. Managed Microsoft AD doesn't support [legacy networks](/vpc/docs/legacy). Note down your VPC network's [full resource name](/iam/docs/full-resource-names), which you have to specify during the domain creation process. It is in the following format: `projects/`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`/global/networks/`\u003cvar translate=\"no\"\u003eVPC_NETWORK_NAME\u003c/var\u003e\n - Before you create a VPC network, make sure that you read [Select VPC networks](/managed-microsoft-ad/docs/update-networks).\n - Make sure that you enable the APIs and create the VPC in the same project where you have enabled billing.\n\nGather information\n------------------\n\nYou need the following information to create your domain:\n\n- A [fully qualified domain name\n (FQDN)](https://wikipedia.org/wiki/Fully_qualified_domain_name)\n such as `ad.example.com`. For more information, see [Microsoft's naming\n conventions in Active\n Directory](https://support.microsoft.com/en-us/help/909264/naming-conventions-in-active-directory-for-computers-domains-sites-and).\n\n- A private IP address range that is not in use by any of the\n VPC subnetworks---for example, `172.16.0.0/24`,\n `192.168.0.0/24`, or `10.1.0.0/24`. Ideally, you should select a range that\n is not in use by *any* of the VPC subnetworks where you can\n use the domain. For more information, see [Select IP address\n ranges](/managed-microsoft-ad/docs/selecting-ip-address-ranges).\n\n- A [region](/about/locations) to deploy the domain controller to---for\n example, `us-central1`. When you create a domain, you can deploy the domain\n controller in only one region. After you create the domain, you can [add\n domain controllers to additional\n regions](/managed-microsoft-ad/docs/add-remove-regions#add-region) to\n increase availability and be [resilient to regional outages](/architecture/deployment-archetypes/multiregional).\n\n For information about the supported regions, see\n [Regions](/managed-microsoft-ad/docs/add-remove-regions#regions-list).\n- A [delegated administrator account\n username](/managed-microsoft-ad/docs/how-to-use-delegated-admin). You can\n either use the default username (`setupadmin`) or modify it. However, you\n can't change this username after you complete the domain creation.\n\n- The [full resource name](/iam/docs/full-resource-names) of the authorized\n VPC network, which is in the following format:\n `\n projects/`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`/global/networks/`\u003cvar translate=\"no\"\u003eVPC_NETWORK_NAME\u003c/var\u003e`\n `\n\nCreate the domain\n-----------------\n\nTo create a domain, complete the following steps: \n\n### Console\n\n1. Go to the **Managed Microsoft AD** page.\n\n\n [Go to Managed Microsoft AD](https://console.cloud.google.com/security/cloud-ad)\n\n2. Select **Create New AD Domain**.\n\n3. On the **Create new domain** page, enter the [gathered\n information](#gather-information).\n\n - Enter the **Fully qualified domain name (FQDN)** for your domain.\n - In the **Network details** section, select your VPC network name from the list. Select **OK**.\n - In the **CIDR Range** section, enter the IP address range for your domain.\n - In the **Regions** section, select a region from the list in which you want to deploy the domain controller.\n - In the **Admin name** field of the **Delegated admin** section, use\n the default username (`setupadmin`) or enter a username for your\n delegated administrator account.\n\n This is your only opportunity to change the username for the delegated\n administrator account. After domain creation, you can't change the username\n for the delegated administrator account.\n4. Select **Create domain**.\n\nIt can take up to 60 minutes to create a domain. When the domain creation is\ncomplete, you receive a notification in the Google Cloud console.\n\nYou can view the status of this operation at any time under\n**Notifications** in the Google Cloud console. If the domain creation\nfails, click **See all activities** under **Notifications** to view the\nerror message.\n\n### gcloud\n\nRun the following gcloud CLI command: \n\n```\ngcloud active-directory domains create FULLY_QUALIFIED_DOMAIN_NAME \\\n --reserved-ip-range=CIDR_RANGE --region=REGION \\\n --authorized-networks=projects/PROJECT_ID/global/networks/VPC_NETWORK_NAME\n```\n\nReplace the placeholder variables with the [gathered\ninformation](#gather-information).\n\nYou receive the following response that indicates domain creation has\nstarted: \n\n```\nCreate request issued for: FULLY_QUALIFIED_DOMAIN_NAME\nWaiting for operation-1554140234884-5857b78a1a49e-02bc63a3-77e5c7ee to complete...\n```\n\nIt can take up to 60 minutes to create a domain. The gcloud CLI\noperation status updates when the domain creation is complete.\n\nIf the domain creation fails, the gcloud CLI displays an error\nmessage on the command line.\n\nYou can repeat this process to create multiple independent domains in the same\nproject.\n| **Note:** By default, you can create two independent domains in the same project. For more information, see [Limits](/managed-microsoft-ad/quotas#limits).\n\nIf you want to increase the number of independent domains that you can create in\nthe same project, you can [contact Google Cloud\nsupport](/managed-microsoft-ad/docs/get-support).\n\nTo make the domain available on a network in a different project, you can\nconfigure [domain peering](/managed-microsoft-ad/docs/domain-peering).\n\nYou can't create [Active Directory\nsites](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/understanding-active-directory-site-topology)\nin Managed Microsoft AD because Managed Microsoft AD doesn't support\nthe Active Directory Sites and Services feature.\n\nYou can't create a [child\ndomain](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/install-a-new-windows-server-2012-active-directory-child-or-tree-domain--level-200-)\nin Managed Microsoft AD. Also, Managed Microsoft AD can't be part of\nany other Active Directory domain deployed either on Google Cloud or\non-premises. However, after you create a Managed Microsoft AD domain, you\ncan [create a trust relationship](/managed-microsoft-ad/docs/create-trust)\nbetween the Managed Microsoft AD domain and any other non-Managed Microsoft AD domain.\n\nFor information about the errors that you might encounter while creating a\ndomain, see [Unable to create a Managed Microsoft AD\ndomain](/managed-microsoft-ad/docs/troubleshooting#create-domain).\n\nWhat's next\n-----------\n\n- [Join a Windows VM to a domain](/managed-microsoft-ad/docs/quickstart-domain-join-windows)\n- [Join a Linux VM to a domain](/managed-microsoft-ad/docs/quickstart-domain-join-linux)\n- [Connect to a Managed Microsoft AD domain](/managed-microsoft-ad/docs/connect-to-active-directory-domain)\n- [Configure domain peering](/managed-microsoft-ad/docs/quickstart-domain-peering)\n- [Deploy domain controllers in additional regions](/managed-microsoft-ad/docs/add-remove-regions)\n- [Deploy Managed Microsoft AD with cross-project access using domain peering](/managed-microsoft-ad/docs/shared-vpc-managedad-cloudsql)"]]
