Domain Controller Upgrades

Posted on 2012-08-20
Last Modified: 2012-08-21

I have 4 DC's to upgrade.

DC1 - Server 2003 -- FSMO: Domain Naming Role -- DHCP & DNS Secondary
DC2 - Server 2008 R2 -- DHCP & Primary DNS
DC3 - Server 2003 -- FSMO: Schema master, PDC, Infrastructure, RID
DCX - Server 2008 R2

I would like to get all of the DC's up to Windows Server 2012. I know I have to get the Server 2003's up to 2008 R2 first as well.

My issue is I am unsure of how to do the upgrade and preserve the other roles on the servers. In-place upgrades are always an option, but seem to work sometimes and other times don't.

So would I need to pass off the DNS roles to other servers somehow along with the DHCP?
Everything is actively being used, so I'd like to find a plan with as little downtime as possible.

I'm open to any and all suggestions.

Thanks for any help!
Question by:lanits
    LVL 17

    Accepted Solution

    Trust me or not on this one, it's your choice, but I did something very similar about a month ago.

    Transfer all 5 FSMOs to a single DC.  Demote and leave as member servers the rest of the DCs.  Once they are member servers they can retain their DNS and DHCP roles without having to transfer those to other servers.  After that, do in place upgrades.  I don't know what you mean by sometimes they work, sometimes they don't, but they always work unless some error is encountered at which point that can be worked out.  Once the updates are done, re-promote the other servers to DCs then spread the FSMOs back out.  It really is an easy process that could be done over a single night, or weekend.  

    The only thing to make sure of is that Active Directory Sites and Services reflects the fact that you will be demoting and re-promoting servers in several steps.  If all DCs are replicating properly changes should reflect very quickly and replication shoulnd't be an issue.  However if after you are done with all that I've mentioned above and you have several DCs again, check replication with the DCDIAG command line tool to make sure that all DCs are talking, and all workstations/network devices are talking with the DCs.

    I can clarify further anything above that isn't clear, just let me know.
    LVL 24

    Expert Comment

    Do 2 servers at a time. transfer fsmo roles and upgrade the servers.

    after upgrade check your event viewer for any replication errors. if you have exchange point exchange to the new fsmo holder.

    if replication is ok and transferred back fsmo roles shutdown the other servers for a day to check for errors.

    if there is no problem do the same for the remaining servers
    LVL 17

    Assisted Solution

    by:Brad Bouchard
    after upgrade check your event viewer for any replication errors. if you have exchange point exchange to the new fsmo holder.

    Use DCDIAG instead of this method... this would be way too tedious and time consuming, plus that's what DCDIAG was built for.

    dcdiag /test:replications


    if replication is ok and transferred back fsmo roles shutdown the other servers for a day to check for errors.

    Not a good way to test for errors... if everything is fine you will know and your logs should be clean and replication will be good, if not, you will have alerts/events that will let you know and the test replication DCDIAG will show that.

    Not trying to be pretentious here but these are some pretty archaic/band-aid recommendations for dealing with DCs, the single most important server types in any organization.  I would think a little further ahead before answering with these recommendations in the future.

    Author Comment

    So I should be safe to assume that when I demote a DC with dcpromo that the AD integrated DNS will not be removed with it?
    LVL 17

    Expert Comment

    by:Brad Bouchard
    Correct, you have to manually remove the DNS role from the server after demotion.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Promote certifications in your email signature

    Has your company recently won an award or achieved a certification? They'll no doubt want to show it off. Email signature images used to promote certifications & awards can instantly establish credibility with a recipient and provide you with numerous benefits.

    I was supporting a handful of Windows 2008 (non-R2) 2 node clusters with shared quorum disks. Some had SQL 2008 installed and some were just a vendor application that we supported. For the purposes of this article it doesn’t really matter which so w…
    The recent Microsoft changes on update philosophy for Windows pre-10 and their impact on existing WSUS implementations.
    This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
    This tutorial will show how to inventory, catalog, and restore media from legacy versions of Backup Exec into both 2012 and 2014 versions of the software. Select Storage from the tabs along the ribbon bar as the top: Ensure the proper storage devi…

    758 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    10 Experts available now in Live!

    Get 1:1 Help Now