DC Upgrades during the day?

I'm planning to add two Server 2008 R2 domain controllers into my domain in the next couple of weeks and was wondering how much of the process can be performed during the day while staff is working.  I have two Server 2003 SP2 DCs at the moment on a LAN with all static addressing.  Both DCs are the DNS servers and the new machines will need to assume the old machine's IP addresses so I don't have to change all of the static DNS settings on my devices.  All of the FSMO roles are on DC1 and both machines are global catalogs.  The basic plan is to prep the domain (adprep), demote DC2, have DC3 take DC2's IP address then promote it to a DC.  I'd then make it a global catalog and transfer the FSMO roles over to it.  Lastly I'd repeat the process for DC1.  I'm curious if most of this can be done during the day or if these changes would cause problems for staff trying to log in and resolve DNS requests.  Let me know what you think, thanks!
First LastAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

During the day should be ok.  Only do one DC a day though.
mat_sullivanInfrastructure EngineerCommented:
Well you could have a problem with email, Outlook binds to a DC for authentication and only refreshes the connection every 30 minutes or so, I have had problems with this when I have had to shut down a DC during the day. Basically a random bunch of users Outlook stopped working for anything up to 30 mins, the problem seemed persistant througgh a reboot also, they basically had to wait for it to clear.

This may not happen when gracefully demoting a DC, but still I would watch out for it.
Darius GhassemCommented:
I would have to say that if you are moving IP addresses you should be doing this during a downtime to a lower overhead time this will cause a brief hiccup when changing the IP address around. So, my recommendation is to wait until you have some downtime I would do it over a weekend or night.

Just to add here is a full migration guide


And article on changes in adprep with Windows 2008 server R2 good reading

Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

Svet PaperovIT ManagerCommented:
Yes, your plan is OK and can be performed during the day, one DC at a time.

Just one small note: pay attention to the DNS. DNS server in WS2008 uses longer UDP packets than the one in WS2003 and you could have dns related issues with some firewalls, for example Cisco ASA which dns inspection agent has default value of 512 bytes.
Darius GhassemCommented:
Again changing IP addresses during the day could cause major DNS issues. I would wait to change IP addresses between the two Domain Controllers until you have some lower overhead times.

Everything else for promotion is fine but not change IP addresses around
Svet PaperovIT ManagerCommented:
Completely agree with dariusg about changing IP addresses (sorry, I’ve missed that part of the question).  If you really want to reuse them, have at least one day or more between the demoting the old DC and installing a new one. And, you should clean up the remaining DNS server from the A and PTR records of the old DC.
If you do have to change IPs during the day I'd promote DC3 before giving it DC2's old address.
Clients will fail more gracefully if they can't make a connection to a specific server, generally less so if they can connect to the server but it isn't offering them the services they expect.
First LastAuthor Commented:
Outstanding suggestions all, I'll spread the points around in a moment.  First one thing...CGretski, it is my understanding that once a machine has been made a DC changing the IP isn't really possible or at least difficult.  Have you been able to change this in the past without problems?  If so that would make things much easier.
I've moved domain controllers between subnets in the past ( which requires a new IP ).
I've not had any issue with it; if you only move one DC at a time.

I can't remember if I had to manually update DNS on one of my other DC's to reflect the change, or if the moved DC connected out and replicated the change.

Give it a test during a quiet period - move DC2 to another IP see if the rest of the domain realises; if not move it back.
Darius GhassemCommented:
No that is not true you can change the IP address after the fact which is the best option from opinion you can promote the servers during the day then change IP addresses at night when everyone is gone.

Demote old DC.
Delete all DNS records for old DC.
Go to new DC go through stepd below
Go to command prompt run ipconfig /flushdns, ipconfig /registerdns, and dcdiag /fix

You are done


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.