Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Criar um domínio
Esta página mostra como criar um domínio com o Serviço Gerenciado para Microsoft Active Directory.
Antes de começar
Sign in to your Google Cloud account. If you're new to
Google Cloud,
create an account to evaluate how our products perform in
real-world scenarios. New customers also get $300 in free credits to
run, test, and deploy workloads.
In the Google Cloud console, on the project selector page,
select or create a Google Cloud project.
Crie uma nova rede de nuvem privada virtual (VPC) para implantar seu domínio ou use uma existente. O Microsoft AD gerenciado não é compatível com redes legadas. Anote o nome completo do recurso da sua rede VPC, que você precisa especificar durante o processo de criação do domínio. Ele está no seguinte
formato:
projects/PROJECT_ID/global/networks/VPC_NETWORK_NAME
Um intervalo de endereços IP particulares que não está em uso por nenhuma das sub-redes da VPC. Por exemplo, 172.16.0.0/24, 192.168.0.0/24 ou 10.1.0.0/24. O ideal é selecionar um intervalo que não esteja em uso por nenhuma das sub-redes da VPC em que você pode usar o domínio. Para mais informações, consulte Selecionar intervalos de endereços IP.
Para informações sobre as regiões com suporte, consulte
Regiões.
Um nome de usuário da conta de administrador delegado. Você pode usar o nome de usuário padrão (setupadmin) ou modificá-lo. No entanto, não é possível mudar esse nome de usuário depois de concluir a criação do domínio.
O nome completo do recurso da rede VPC autorizada, que está no seguinte formato:
projects/PROJECT_ID/global/networks/VPC_NETWORK_NAME
Digite o Nome de domínio totalmente qualificado (FQDN) para o seu domínio.
Na seção Detalhes da rede, selecione o nome da sua rede VPC na lista. Selecione OK.
Na seção Intervalo CIDR, insira o intervalo de endereços IP do seu domínio.
Na seção Regiões, selecione uma região da lista em que
você quer implantar o controlador de domínio.
No campo Nome do administrador da seção Administrador delegado, use o nome de usuário padrão (setupadmin) ou insira um nome de usuário para sua conta de administrador delegado.
Essa é sua única oportunidade de mudar o nome de usuário da conta de administrador
delegada. Depois da criação do domínio, não é possível mudar o nome de usuário
da conta de administrador delegado.
Selecione Criar domínio.
Pode levar até 60 minutos para criar um domínio. Quando a criação do domínio for
concluída, você vai receber uma notificação no console Google Cloud .
É possível conferir o status dessa operação a qualquer momento em
Notificações no console do Google Cloud . Se a criação do domínio falhar, clique em Ver todas as atividades em Notificações para conferir a mensagem de erro.
Para disponibilizar o domínio em uma rede em um projeto diferente, configure o peering de domínio.
Não é possível criar sites do Active Directory no Microsoft AD gerenciado porque ele não é compatível com o recurso Sites e serviços do Active Directory.
Não é possível criar um subdomínio no Managed Microsoft AD. Além disso, o Managed Microsoft AD não pode fazer parte de
nenhum outro domínio do Active Directory implantado no Google Cloud ou
no local. No entanto, depois de criar um domínio do Managed Microsoft AD, você
pode criar uma relação de confiança
entre o domínio do Managed Microsoft AD e qualquer outro domínio que não seja do Managed Microsoft AD.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-11 UTC."],[],[],null,["# Quickstart: Create a domain\n\nCreate a domain\n===============\n\nThis page shows you how to create a domain with Managed Service for Microsoft Active Directory.\n\nBefore you begin\n----------------\n\n- Sign in to your Google Cloud account. If you're new to Google Cloud, [create an account](https://console.cloud.google.com/freetrial) to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the\n Managed Microsoft AD, Cloud DNS, and Compute Engine\n APIs.\n\n\n [Enable the APIs](https://console.cloud.google.com/flows/enableapi?apiid=\n managedidentities.googleapis.com,dns.googleapis.com,compute.googleapis.com\n )\n\n- In the Google Cloud console, on the project selector page,\n select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n-\n [Verify that billing is enabled for your Google Cloud project](/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project).\n\n-\n\n\n Enable the\n Managed Microsoft AD, Cloud DNS, and Compute Engine\n APIs.\n\n\n [Enable the APIs](https://console.cloud.google.com/flows/enableapi?apiid=\n managedidentities.googleapis.com,dns.googleapis.com,compute.googleapis.com\n )\n\n1. [Create a new Virtual Private Cloud (VPC)\n network](/vpc/docs/create-modify-vpc-networks) to deploy your domain to, or use an existing one. Managed Microsoft AD doesn't support [legacy networks](/vpc/docs/legacy). Note down your VPC network's [full resource name](/iam/docs/full-resource-names), which you have to specify during the domain creation process. It is in the following format: `projects/`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`/global/networks/`\u003cvar translate=\"no\"\u003eVPC_NETWORK_NAME\u003c/var\u003e\n - Before you create a VPC network, make sure that you read [Select VPC networks](/managed-microsoft-ad/docs/update-networks).\n - Make sure that you enable the APIs and create the VPC in the same project where you have enabled billing.\n\nGather information\n------------------\n\nYou need the following information to create your domain:\n\n- A [fully qualified domain name\n (FQDN)](https://wikipedia.org/wiki/Fully_qualified_domain_name)\n such as `ad.example.com`. For more information, see [Microsoft's naming\n conventions in Active\n Directory](https://support.microsoft.com/en-us/help/909264/naming-conventions-in-active-directory-for-computers-domains-sites-and).\n\n- A private IP address range that is not in use by any of the\n VPC subnetworks---for example, `172.16.0.0/24`,\n `192.168.0.0/24`, or `10.1.0.0/24`. Ideally, you should select a range that\n is not in use by *any* of the VPC subnetworks where you can\n use the domain. For more information, see [Select IP address\n ranges](/managed-microsoft-ad/docs/selecting-ip-address-ranges).\n\n- A [region](/about/locations) to deploy the domain controller to---for\n example, `us-central1`. When you create a domain, you can deploy the domain\n controller in only one region. After you create the domain, you can [add\n domain controllers to additional\n regions](/managed-microsoft-ad/docs/add-remove-regions#add-region) to\n increase availability and be [resilient to regional outages](/architecture/deployment-archetypes/multiregional).\n\n For information about the supported regions, see\n [Regions](/managed-microsoft-ad/docs/add-remove-regions#regions-list).\n- A [delegated administrator account\n username](/managed-microsoft-ad/docs/how-to-use-delegated-admin). You can\n either use the default username (`setupadmin`) or modify it. However, you\n can't change this username after you complete the domain creation.\n\n- The [full resource name](/iam/docs/full-resource-names) of the authorized\n VPC network, which is in the following format:\n `\n projects/`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`/global/networks/`\u003cvar translate=\"no\"\u003eVPC_NETWORK_NAME\u003c/var\u003e`\n `\n\nCreate the domain\n-----------------\n\nTo create a domain, complete the following steps: \n\n### Console\n\n1. Go to the **Managed Microsoft AD** page.\n\n\n [Go to Managed Microsoft AD](https://console.cloud.google.com/security/cloud-ad)\n\n2. Select **Create New AD Domain**.\n\n3. On the **Create new domain** page, enter the [gathered\n information](#gather-information).\n\n - Enter the **Fully qualified domain name (FQDN)** for your domain.\n - In the **Network details** section, select your VPC network name from the list. Select **OK**.\n - In the **CIDR Range** section, enter the IP address range for your domain.\n - In the **Regions** section, select a region from the list in which you want to deploy the domain controller.\n - In the **Admin name** field of the **Delegated admin** section, use\n the default username (`setupadmin`) or enter a username for your\n delegated administrator account.\n\n This is your only opportunity to change the username for the delegated\n administrator account. After domain creation, you can't change the username\n for the delegated administrator account.\n4. Select **Create domain**.\n\nIt can take up to 60 minutes to create a domain. When the domain creation is\ncomplete, you receive a notification in the Google Cloud console.\n\nYou can view the status of this operation at any time under\n**Notifications** in the Google Cloud console. If the domain creation\nfails, click **See all activities** under **Notifications** to view the\nerror message.\n\n### gcloud\n\nRun the following gcloud CLI command: \n\n```\ngcloud active-directory domains create FULLY_QUALIFIED_DOMAIN_NAME \\\n --reserved-ip-range=CIDR_RANGE --region=REGION \\\n --authorized-networks=projects/PROJECT_ID/global/networks/VPC_NETWORK_NAME\n```\n\nReplace the placeholder variables with the [gathered\ninformation](#gather-information).\n\nYou receive the following response that indicates domain creation has\nstarted: \n\n```\nCreate request issued for: FULLY_QUALIFIED_DOMAIN_NAME\nWaiting for operation-1554140234884-5857b78a1a49e-02bc63a3-77e5c7ee to complete...\n```\n\nIt can take up to 60 minutes to create a domain. The gcloud CLI\noperation status updates when the domain creation is complete.\n\nIf the domain creation fails, the gcloud CLI displays an error\nmessage on the command line.\n\nYou can repeat this process to create multiple independent domains in the same\nproject.\n| **Note:** By default, you can create two independent domains in the same project. For more information, see [Limits](/managed-microsoft-ad/quotas#limits).\n\nIf you want to increase the number of independent domains that you can create in\nthe same project, you can [contact Google Cloud\nsupport](/managed-microsoft-ad/docs/get-support).\n\nTo make the domain available on a network in a different project, you can\nconfigure [domain peering](/managed-microsoft-ad/docs/domain-peering).\n\nYou can't create [Active Directory\nsites](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/understanding-active-directory-site-topology)\nin Managed Microsoft AD because Managed Microsoft AD doesn't support\nthe Active Directory Sites and Services feature.\n\nYou can't create a [child\ndomain](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/install-a-new-windows-server-2012-active-directory-child-or-tree-domain--level-200-)\nin Managed Microsoft AD. Also, Managed Microsoft AD can't be part of\nany other Active Directory domain deployed either on Google Cloud or\non-premises. However, after you create a Managed Microsoft AD domain, you\ncan [create a trust relationship](/managed-microsoft-ad/docs/create-trust)\nbetween the Managed Microsoft AD domain and any other non-Managed Microsoft AD domain.\n\nFor information about the errors that you might encounter while creating a\ndomain, see [Unable to create a Managed Microsoft AD\ndomain](/managed-microsoft-ad/docs/troubleshooting#create-domain).\n\nWhat's next\n-----------\n\n- [Join a Windows VM to a domain](/managed-microsoft-ad/docs/quickstart-domain-join-windows)\n- [Join a Linux VM to a domain](/managed-microsoft-ad/docs/quickstart-domain-join-linux)\n- [Connect to a Managed Microsoft AD domain](/managed-microsoft-ad/docs/connect-to-active-directory-domain)\n- [Configure domain peering](/managed-microsoft-ad/docs/quickstart-domain-peering)\n- [Deploy domain controllers in additional regions](/managed-microsoft-ad/docs/add-remove-regions)\n- [Deploy Managed Microsoft AD with cross-project access using domain peering](/managed-microsoft-ad/docs/shared-vpc-managedad-cloudsql)"]]
