Learn how to a build a cloud-first strategyRegister Now


Domain Controller Upgrades

Posted on 2012-08-20
Medium Priority
Last Modified: 2012-08-21

I have 4 DC's to upgrade.

DC1 - Server 2003 -- FSMO: Domain Naming Role -- DHCP & DNS Secondary
DC2 - Server 2008 R2 -- DHCP & Primary DNS
DC3 - Server 2003 -- FSMO: Schema master, PDC, Infrastructure, RID
DCX - Server 2008 R2

I would like to get all of the DC's up to Windows Server 2012. I know I have to get the Server 2003's up to 2008 R2 first as well.

My issue is I am unsure of how to do the upgrade and preserve the other roles on the servers. In-place upgrades are always an option, but seem to work sometimes and other times don't.

So would I need to pass off the DNS roles to other servers somehow along with the DHCP?
Everything is actively being used, so I'd like to find a plan with as little downtime as possible.

I'm open to any and all suggestions.

Thanks for any help!
Question by:lanits
  • 3
LVL 17

Accepted Solution

Brad Bouchard earned 2000 total points
ID: 38313601
Trust me or not on this one, it's your choice, but I did something very similar about a month ago.

Transfer all 5 FSMOs to a single DC.  Demote and leave as member servers the rest of the DCs.  Once they are member servers they can retain their DNS and DHCP roles without having to transfer those to other servers.  After that, do in place upgrades.  I don't know what you mean by sometimes they work, sometimes they don't, but they always work unless some error is encountered at which point that can be worked out.  Once the updates are done, re-promote the other servers to DCs then spread the FSMOs back out.  It really is an easy process that could be done over a single night, or weekend.  

The only thing to make sure of is that Active Directory Sites and Services reflects the fact that you will be demoting and re-promoting servers in several steps.  If all DCs are replicating properly changes should reflect very quickly and replication shoulnd't be an issue.  However if after you are done with all that I've mentioned above and you have several DCs again, check replication with the DCDIAG command line tool to make sure that all DCs are talking, and all workstations/network devices are talking with the DCs.

I can clarify further anything above that isn't clear, just let me know.
LVL 28

Expert Comment

ID: 38313849
Do 2 servers at a time. transfer fsmo roles and upgrade the servers.

after upgrade check your event viewer for any replication errors. if you have exchange point exchange to the new fsmo holder.

if replication is ok and transferred back fsmo roles shutdown the other servers for a day to check for errors.

if there is no problem do the same for the remaining servers
LVL 17

Assisted Solution

by:Brad Bouchard
Brad Bouchard earned 2000 total points
ID: 38313964
after upgrade check your event viewer for any replication errors. if you have exchange point exchange to the new fsmo holder.

Use DCDIAG instead of this method... this would be way too tedious and time consuming, plus that's what DCDIAG was built for.

dcdiag /test:replications


if replication is ok and transferred back fsmo roles shutdown the other servers for a day to check for errors.

Not a good way to test for errors... if everything is fine you will know and your logs should be clean and replication will be good, if not, you will have alerts/events that will let you know and the test replication DCDIAG will show that.

Not trying to be pretentious here but these are some pretty archaic/band-aid recommendations for dealing with DCs, the single most important server types in any organization.  I would think a little further ahead before answering with these recommendations in the future.

Author Comment

ID: 38315999
So I should be safe to assume that when I demote a DC with dcpromo that the AD integrated DNS will not be removed with it?
LVL 17

Expert Comment

by:Brad Bouchard
ID: 38316311
Correct, you have to manually remove the DNS role from the server after demotion.

Featured Post

Get free NFR key for Veeam Availability Suite 9.5

Veeam is happy to provide a free NFR license (1 year, 2 sockets) to all certified IT Pros. The license allows for the non-production use of Veeam Availability Suite v9.5 in your home lab, without any feature limitations. It works for both VMware and Hyper-V environments

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Group policies can be applied selectively to specific devices with the help of groups. Utilising this, it is possible to phase-in group policies, over a period of time, by randomly adding non-members user or computers at a set interval, to a group f…
Let's recap what we learned from yesterday's Skyport Systems webinar.
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…
Suggested Courses

810 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question