[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-11。"],[],[],null,["# Deploy domain controllers in additional regions\n\nThis page provides a list of regions that you can add to your domain in\nManaged Service for Microsoft Active Directory (Managed Microsoft AD). This page also shows you how to\nadd or remove a region from your domain.\n\nManaged Microsoft AD supports multiple regions. Combined with the multi-regional\nnature of Virtual Private Clouds, you can quickly scale your Active Directory\ninfrastructure across Google Cloud. For more information about regions,\nsee [Geography and regions](/docs/geography-and-regions).\n\nBefore you begin\n----------------\n\nBefore you add or remove domain controllers to additional regions, make sure that you have any one of the following IAM user roles:\n\n- Google Cloud Managed Identities Domain Admin (`roles/managedidentities.domainAdmin`)\n- Google Cloud Managed Identities Admin (`roles/managedidentities.admin`)\n\nFor more information, see [Cloud Managed Identities roles](/iam/docs/understanding-roles#cloud-managed-identities-roles).\n\nFor information about granting an IAM role to a principal, see [Grant a single role](/iam/docs/granting-changing-revoking-access#grant-single-role).\n\nRegions\n-------\n\nManaged Microsoft AD supports the following regions:\n\nAdd a region\n------------\n\nManaged Microsoft AD uses a single\n[Active Directory site](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/replication/active-directory-replication-concepts#BKMK_5).\nThe site is not constrained to a specific VPC subnet; it spans\nall regions and subnets of your VPC. For example, consider you have domain\ncontrollers located in `us-west1` and your VPC spans\n`us-west1`, `us-east1`, and `us-central1`. Your domain is available in all\nthese three regions and not limited to `us-west1`.\n\nHowever, to increase availability and be [resilient to regional\noutages](/architecture/deployment-archetypes/multiregional),\nwe recommend that you deploy domain controllers in additional regions. Each\ndomain supports up to 4 regions.\n\nYou can only add domain controllers to the [supported\nregions](/managed-microsoft-ad/docs/add-remove-regions#regions-list). Note that\ndoesn't affect the access to your Managed Microsoft AD domain, which is\navailable in all regions where your VPC has a presence.\n\nTo add domain controllers to an additional region, do the following: \n\n### Console\n\n1. In the Google Cloud console, go to the **Managed Microsoft AD** page. \n\n [Go to Managed Microsoft AD](https://console.cloud.google.com/security/cloud-ad)\n\n2. Select the domain to add a region to, then click\n edit**Edit**.\n\n3. Click **Add Region** and choose the region to add from the menu.\n\n4. Select **Save Changes**.\n\n### gcloud\n\nRun the following command: \n\n gcloud active-directory domains update \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003eDOMAIN_NAME\u003c/span\u003e\u003c/var\u003e \\\n --add-region=\u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003eREGION\u003c/span\u003e\u003c/var\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eDOMAIN_NAME\u003c/var\u003e: The name of your domain. For example, `ad.mycompany.com`.\n- \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e: The region to add. For example, `us-west1`.\n| **Note:** You can only add a single region at a time.\n\nRemove a region\n---------------\n\nAs your business needs evolve, you can easily retire domain controllers from a region.\nAll the data is replicated, so removing a region doesn't result in data loss.\n\nTo remove domain controllers from a region, do the following: \n\n### Console\n\n1. In the Google Cloud console, go to the **Managed Microsoft AD** page. \n\n [Go to Managed Microsoft AD](https://console.cloud.google.com/security/cloud-ad)\n\n2. Select the domain to remove a region from, then click\n edit**Edit**.\n\n3. Under the **Regions** section, click the\n delete **Delete** icon next to the\n region that you want to remove.\n\n4. Select **Save Changes**.\n\n### gcloud\n\nRun the following command: \n\n gcloud active-directory domains update \u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003eDOMAIN_NAME\u003c/span\u003e\u003c/var\u003e \\\n --remove-region=\u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003eREGION\u003c/span\u003e\u003c/var\u003e\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eDOMAIN_NAME\u003c/var\u003e: The name of your domain. For example, `ad.mycompany.com`.\n- \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e: The region to remove. For example, `us-west1`.\n| **Note:** You can only remove a single region at a time, and there must always be at least 1 region associated with a domain.\n\nWhat's next\n-----------\n\n- [Create a domain](/managed-microsoft-ad/docs/create-domain)"]]
