Mantieni tutto organizzato con le raccolte
Salva e classifica i contenuti in base alle tue preferenze.
Crea un dominio
Questa pagina mostra come creare un dominio con Managed Service for Microsoft Active Directory.
Prima di iniziare
Sign in to your Google Cloud account. If you're new to
Google Cloud,
create an account to evaluate how our products perform in
real-world scenarios. New customers also get $300 in free credits to
run, test, and deploy workloads.
In the Google Cloud console, on the project selector page,
select or create a Google Cloud project.
Crea una nuova rete Virtual Private Cloud (VPC) in cui eseguire il deployment del dominio o utilizzane una esistente. Managed Microsoft AD non supporta le reti legacy. Prendi nota
del nome completo della risorsa della tua rete VPC, che devi specificare durante la procedura di creazione del dominio. Ha il seguente
formato:
projects/PROJECT_ID/global/networks/VPC_NETWORK_NAME
Un intervallo di indirizzi IP privati non in uso da nessuna delle
subnet VPC, ad esempio 172.16.0.0/24,
192.168.0.0/24 o 10.1.0.0/24. Idealmente, dovresti selezionare un intervallo che non sia in uso da nessuna delle subnet VPC in cui puoi utilizzare il dominio. Per saperne di più, vedi Selezionare intervalli di indirizzi IP.
Inserisci il nome di dominio completo (FQDN) per il tuo dominio.
Nella sezione Dettagli rete, seleziona il nome della tua rete VPC dall'elenco. Seleziona OK.
Nella sezione Intervallo CIDR, inserisci l'intervallo di indirizzi IP per il tuo
dominio.
Nella sezione Regioni, seleziona dall'elenco una regione in cui
vuoi eseguire il deployment del controller di dominio.
Nel campo Nome amministratore della sezione Amministratore delegato, utilizza
il nome utente predefinito (setupadmin) o inserisci un nome utente per il tuo
account amministratore delegato.
Questa è l'unica opportunità per modificare il nome utente dell'account amministratore delegato. Dopo la creazione del dominio, non puoi modificare il nome utente
per l'account amministratore delegato.
Seleziona Crea dominio.
La creazione di un dominio può richiedere fino a 60 minuti. Al termine della creazione del dominio, riceverai una notifica nella console Google Cloud .
Puoi visualizzare lo stato di questa operazione in qualsiasi momento nella sezione
Notifiche della console Google Cloud . Se la creazione del dominio
non va a buon fine, fai clic su Visualizza tutte le attività in Notifiche per visualizzare il
messaggio di errore.
Riceverai la seguente risposta che indica che la creazione del dominio è
iniziata:
Create request issued for: FULLY_QUALIFIED_DOMAIN_NAME
Waiting for operation-1554140234884-5857b78a1a49e-02bc63a3-77e5c7ee to complete...
La creazione di un dominio può richiedere fino a 60 minuti. Lo stato dell'operazione dell'interfaccia alla gcloud CLI
viene aggiornato al termine della creazione del dominio.
Se la creazione del dominio non riesce, gcloud CLI visualizza un messaggio di errore sulla riga di comando.
Puoi ripetere questa procedura per creare più domini indipendenti nello stesso progetto.
Per rendere il dominio disponibile su una rete in un altro progetto, puoi
configurare il peering tra domini.
Non puoi creare siti
Active Directory
in Microsoft Active Directory gestito perché non supporta
la funzionalità Siti e servizi Active Directory.
Non puoi creare un dominio
secondario
in Microsoft AD gestito. Inoltre, Microsoft Active Directory gestito non può far parte di
nessun altro dominio Active Directory di cui è stato eseguito il deployment su Google Cloud o
on-premise. Tuttavia, dopo aver creato un dominio Microsoft AD gestito, puoi creare una relazione di trust tra il dominio Microsoft AD gestito e qualsiasi altro dominio Microsoft AD non gestito.
[[["Facile da capire","easyToUnderstand","thumb-up"],["Il problema è stato risolto","solvedMyProblem","thumb-up"],["Altra","otherUp","thumb-up"]],[["Difficile da capire","hardToUnderstand","thumb-down"],["Informazioni o codice di esempio errati","incorrectInformationOrSampleCode","thumb-down"],["Mancano le informazioni o gli esempi di cui ho bisogno","missingTheInformationSamplesINeed","thumb-down"],["Problema di traduzione","translationIssue","thumb-down"],["Altra","otherDown","thumb-down"]],["Ultimo aggiornamento 2025-09-04 UTC."],[],[],null,["# Quickstart: Create a domain\n\nCreate a domain\n===============\n\nThis page shows you how to create a domain with Managed Service for Microsoft Active Directory.\n\nBefore you begin\n----------------\n\n- Sign in to your Google Cloud account. If you're new to Google Cloud, [create an account](https://console.cloud.google.com/freetrial) to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the\n Managed Microsoft AD, Cloud DNS, and Compute Engine\n APIs.\n\n\n [Enable the APIs](https://console.cloud.google.com/flows/enableapi?apiid=\n managedidentities.googleapis.com,dns.googleapis.com,compute.googleapis.com\n )\n\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the\n Managed Microsoft AD, Cloud DNS, and Compute Engine\n APIs.\n\n\n [Enable the APIs](https://console.cloud.google.com/flows/enableapi?apiid=\n managedidentities.googleapis.com,dns.googleapis.com,compute.googleapis.com\n )\n\n1. [Create a new Virtual Private Cloud (VPC)\n network](/vpc/docs/create-modify-vpc-networks) to deploy your domain to, or use an existing one. Managed Microsoft AD doesn't support [legacy networks](/vpc/docs/legacy). Note down your VPC network's [full resource name](/iam/docs/full-resource-names), which you have to specify during the domain creation process. It is in the following format: `projects/`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`/global/networks/`\u003cvar translate=\"no\"\u003eVPC_NETWORK_NAME\u003c/var\u003e\n - Before you create a VPC network, make sure that you read [Select VPC networks](/managed-microsoft-ad/docs/update-networks).\n - Make sure that you enable the APIs and create the VPC in the same project where you have enabled billing.\n\nGather information\n------------------\n\nYou need the following information to create your domain:\n\n- A [fully qualified domain name\n (FQDN)](https://wikipedia.org/wiki/Fully_qualified_domain_name)\n such as `ad.example.com`. For more information, see [Microsoft's naming\n conventions in Active\n Directory](https://support.microsoft.com/en-us/help/909264/naming-conventions-in-active-directory-for-computers-domains-sites-and).\n\n- A private IP address range that is not in use by any of the\n VPC subnetworks---for example, `172.16.0.0/24`,\n `192.168.0.0/24`, or `10.1.0.0/24`. Ideally, you should select a range that\n is not in use by *any* of the VPC subnetworks where you can\n use the domain. For more information, see [Select IP address\n ranges](/managed-microsoft-ad/docs/selecting-ip-address-ranges).\n\n- A [region](/about/locations) to deploy the domain controller to---for\n example, `us-central1`. When you create a domain, you can deploy the domain\n controller in only one region. After you create the domain, you can [add\n domain controllers to additional\n regions](/managed-microsoft-ad/docs/add-remove-regions#add-region) to\n increase availability and be [resilient to regional outages](/architecture/deployment-archetypes/multiregional).\n\n For information about the supported regions, see\n [Regions](/managed-microsoft-ad/docs/add-remove-regions#regions-list).\n- A [delegated administrator account\n username](/managed-microsoft-ad/docs/how-to-use-delegated-admin). You can\n either use the default username (`setupadmin`) or modify it. However, you\n can't change this username after you complete the domain creation.\n\n- The [full resource name](/iam/docs/full-resource-names) of the authorized\n VPC network, which is in the following format:\n `\n projects/`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`/global/networks/`\u003cvar translate=\"no\"\u003eVPC_NETWORK_NAME\u003c/var\u003e`\n `\n\nCreate the domain\n-----------------\n\nTo create a domain, complete the following steps: \n\n### Console\n\n1. Go to the **Managed Microsoft AD** page.\n\n\n [Go to Managed Microsoft AD](https://console.cloud.google.com/security/cloud-ad)\n\n2. Select **Create New AD Domain**.\n\n3. On the **Create new domain** page, enter the [gathered\n information](#gather-information).\n\n - Enter the **Fully qualified domain name (FQDN)** for your domain.\n - In the **Network details** section, select your VPC network name from the list. Select **OK**.\n - In the **CIDR Range** section, enter the IP address range for your domain.\n - In the **Regions** section, select a region from the list in which you want to deploy the domain controller.\n - In the **Admin name** field of the **Delegated admin** section, use\n the default username (`setupadmin`) or enter a username for your\n delegated administrator account.\n\n This is your only opportunity to change the username for the delegated\n administrator account. After domain creation, you can't change the username\n for the delegated administrator account.\n4. Select **Create domain**.\n\nIt can take up to 60 minutes to create a domain. When the domain creation is\ncomplete, you receive a notification in the Google Cloud console.\n\nYou can view the status of this operation at any time under\n**Notifications** in the Google Cloud console. If the domain creation\nfails, click **See all activities** under **Notifications** to view the\nerror message.\n\n### gcloud\n\nRun the following gcloud CLI command: \n\n```\ngcloud active-directory domains create FULLY_QUALIFIED_DOMAIN_NAME \\\n --reserved-ip-range=CIDR_RANGE --region=REGION \\\n --authorized-networks=projects/PROJECT_ID/global/networks/VPC_NETWORK_NAME\n```\n\nReplace the placeholder variables with the [gathered\ninformation](#gather-information).\n\nYou receive the following response that indicates domain creation has\nstarted: \n\n```\nCreate request issued for: FULLY_QUALIFIED_DOMAIN_NAME\nWaiting for operation-1554140234884-5857b78a1a49e-02bc63a3-77e5c7ee to complete...\n```\n\nIt can take up to 60 minutes to create a domain. The gcloud CLI\noperation status updates when the domain creation is complete.\n\nIf the domain creation fails, the gcloud CLI displays an error\nmessage on the command line.\n\nYou can repeat this process to create multiple independent domains in the same\nproject.\n| **Note:** By default, you can create two independent domains in the same project. For more information, see [Limits](/managed-microsoft-ad/quotas#limits).\n\nIf you want to increase the number of independent domains that you can create in\nthe same project, you can [contact Google Cloud\nsupport](/managed-microsoft-ad/docs/get-support).\n\nTo make the domain available on a network in a different project, you can\nconfigure [domain peering](/managed-microsoft-ad/docs/domain-peering).\n\nYou can't create [Active Directory\nsites](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/understanding-active-directory-site-topology)\nin Managed Microsoft AD because Managed Microsoft AD doesn't support\nthe Active Directory Sites and Services feature.\n\nYou can't create a [child\ndomain](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/install-a-new-windows-server-2012-active-directory-child-or-tree-domain--level-200-)\nin Managed Microsoft AD. Also, Managed Microsoft AD can't be part of\nany other Active Directory domain deployed either on Google Cloud or\non-premises. However, after you create a Managed Microsoft AD domain, you\ncan [create a trust relationship](/managed-microsoft-ad/docs/create-trust)\nbetween the Managed Microsoft AD domain and any other non-Managed Microsoft AD domain.\n\nFor information about the errors that you might encounter while creating a\ndomain, see [Unable to create a Managed Microsoft AD\ndomain](/managed-microsoft-ad/docs/troubleshooting#create-domain).\n\nWhat's next\n-----------\n\n- [Join a Windows VM to a domain](/managed-microsoft-ad/docs/quickstart-domain-join-windows)\n- [Join a Linux VM to a domain](/managed-microsoft-ad/docs/quickstart-domain-join-linux)\n- [Connect to a Managed Microsoft AD domain](/managed-microsoft-ad/docs/connect-to-active-directory-domain)\n- [Configure domain peering](/managed-microsoft-ad/docs/quickstart-domain-peering)\n- [Deploy domain controllers in additional regions](/managed-microsoft-ad/docs/add-remove-regions)\n- [Deploy Managed Microsoft AD with cross-project access using domain peering](/managed-microsoft-ad/docs/shared-vpc-managedad-cloudsql)"]]
