The First Domain Controller Should Be Physical

There is no pure technical reason for the first domain controller (DC) to be a physical machine instead of having a virtual one. However, there is at least one practical reason for you to do so.

When a computer (physical or virtual) is promoted as the first DC of a domain, the machine SID becomes the domain SID. This is not a problem as long as the machine SID is unique. However, chances are high that the SID of a virtual machine is already duplicated in the environment. This is most likely due to the repeated use of the same virtual machine image which has not gone through the sysprep process. Unfortunately, I have faced this issue in a large enterprise environment while creating a new Active Directory domain. The solution I found and my recommendation is to use a physical machine as the first DC to have a unique SID for the domain. Later when virtual machines are joined to the domain as member servers they get new SID, so it’s not a problem even if the machine SID was not unique initially. Your member servers and additional domain controllers would work just fine in those virtual machines.