• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 244
  • Last Modified:

Migrating Windows Primary Domain Controller

Hi there Experts,

I am planning creating a Windows 2012 R2 vSphere Infrastructure.
As per Microsoft’s recommendation the Primary Domain Controller
should be on a physical machine.

My Primary Domain Controller is currently a Physical Windows 2008 R2 Server.
This server will be the Primary domain controller for the virtual
infrastructure but I would like to upgrade it to Windows 2012 R2.

I should also create a VM as an Additional Windows 2012 R2 Domain Controller.

Could you please advise the migration sequence in detail?


Thanks in Advance,
Mamelas
0
mamelas
Asked:
mamelas
  • 7
  • 5
  • 2
  • +1
5 Solutions
 
Sajid Shaik MSr. System AdminCommented:
that's a best practice create additional domain controller on vm and

follow the link for AD migration..

http://jackstromberg.com/2013/10/migrating-domain-controllers-from-server-2008-r2-to-server-2012-r2/

steps:
1)update windows up to date
2) Check Events for any errors
3) update schema
4) check schema upgrade
5)create additional domain controller
 6) create separate DNS on additional domain
7) publish that DNS to all clients
8) shut down primary domain and check any issues. events.
9) rise domain functional levels
10) remove Ad from the old domain..
11) format old domain
12) install windows 2012 R2
13) install AD create it as Additional domain..
14) create dns..
15) check all events..
16) rise domain functional levels

all the best
always take the backup prior is best practice...

all the best
0
 
albatros99Commented:
The best practice of keeping the PDC physical is somewhat obsolete. As long as you observe best practices for running DC's on virtual environments and as long as the hypervisor is a compatible version (so as to deal with issues such as snapshots etc) you can run the PDC as a VM just like any other DC.
0
 
mamelasAuthor Commented:
Dear Shaik,

Thank you for your prompt reply.

Please clarify the below:

- Steps 1-4 will be done on the current Win2008 DC?
 
- The additional domain controller which will be a VM, will have Win 2012 R2 and functional level of Windows 2008? Steps 5,6 are referring to this? Now the VM will be the Primary DC?

- Step 9 ,I will rise the domain level of VM from Windows 2008 to Windows 2012?
 
- Steps 10-15 are related to the Physical Windows 2008 Server?

- During the installation and since from step 9 the Functional Level is Windows 2012 why on step 16 should I rise the functional level instead of applying it directly on step 13?

After completing all the steps how should I know if the Physical Server is also the Primary DC?

Would be better to upgrade the Physical Windows 2008 Server to Windows 2012 instead of formatting or not?
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

 
Seth SimmonsSr. Systems AdministratorCommented:
Steps 1-4 will be done on the current Win2008 DC?

1 & 2 yes
3 can be done when installing ADDS role on the 2012 server as the wizard will automatically upgrade the schema
it can be done manually but the wizard does it automatically

The additional domain controller which will be a VM, will have Win 2012 R2 and functional level of Windows 2008?

functional level is based on domain and forest, not an individual server
if the functional level is currently 2008 R2, then it will stay that way until you manually raise it
2012 domain controllers work just fine in 2003 & 2008 functional levels

Steps 5,6 are referring to this?

step 5 involves installing the ADDS role on the 2012 server and running the wizard at the end to promote to a domain controller.  skip step 6; DNS will be installed automatically and nothing to do there

Step 9 ,I will rise the domain level of VM from Windows 2008 to Windows 2012?

this is optional; you are not required to do this
recommend waiting for another time to raise the functional level
you can't raise the functional level to 2012 until the 2008 server is demoted
technically steps 9 and 10 in that list are backwards

Steps 10-15 are related to the Physical Windows 2008 Server?

yes but i would insert another step first
verify replication is working between the 2 domain controllers and transfer FSMO roles
i would allow a few days time to pass before demoting the 2008 server; make sure any clients with static IP addresses point to the new server and not the old one for DNS and change any DHCP scope(s) that point to the old server, using the new one instead

when you get to 13, ADDS will just install; the schema is already extended so no need to repeat that part
also skip 14; again DNS will be installed automatically

why on step 16 should I rise the functional level instead of applying it directly on step 13?

again, this is optional and should wait until after you get your domain controllers in place
it should not have been listed a second time since you only raise the functional level once to 2012 R2

After completing all the steps how should I know if the Physical Server is also the Primary DC?

once the newly rebuilt server is in place and the two 2012 servers are working correctly, you can transfer the FSMO roles

Using Ntdsutil.exe to transfer or seize FSMO roles to a domain controller
https://support.microsoft.com/en-us/kb/255504

After completing all the steps how should I know if the Physical Server is also the Primary DC?

from an elevated command prompt, do netdom query fsmo
this will show the owner of each role

Would be better to upgrade the Physical Windows 2008 Server to Windows 2012 instead of formatting or not?

even though you technically can do an in-place upgrade from 2008 R2 to 2012 R2, it is always better to start with a clean installation

also, once the FSMO roles are transferred back to the physical server, that server should be configured as the time server

How to configure an authoritative time server in Windows Server
http://support.microsoft.com/en-us/kb/816042
0
 
mamelasAuthor Commented:
Dear Seth,

Thank you for your extended and in detail reply.

Let me sum-up your reply and kindly confirm that below are correct.

To avoid confusion Physical Machine is the PM and the Virtual Machine is the VM.

1)PM: Check for Updates if any and check Event Log
2)VM: Install  Windows 2012 Server R2, ADDS role and set Functional Level to 2008
(schema and DNS will be updated/installed automatically)
3)PM: Uninstall DHCP Role
4) VM: Install DHCP Role
5)VM: Transfer FSMO roles from PM to VM
6)Wait few days and verify that PM with 2K8 DC and VM with 2K12 DC are replicating with no errors
7)PM: Demote PM which is Currently a 2k8 DC and shutdown
8)VM: Raise the Functional Lever from 2008 to 2012
9)PM: Format, Install Windows Server 2012
10)PM: Install ADDS Role and DNS and set Functional Level to 2012
11)VM: Transfer the FSMO Roles from VM to PM
     (Now the Primary 2012 Domain Controller is the PM)
12)PM: Configure as a Time Server

Are steps 1-12 correct? Am I missing any other step?
0
 
albatros99Commented:
You may want to consider having the new DHCP server installed a couple of days before so as to allow the clients to receive IP addresses while you are migrating the DC's.
0
 
mamelasAuthor Commented:
All the Clients are using the Static IPs'
(except the ones that are connected through WiFi which are mostly Mobiles and Tablets)
So this it would not be a big problem

Well, are above mentioned steps 1-12 correct? Am I missing any other step?
0
 
Seth SimmonsSr. Systems AdministratorCommented:
actually, i wouldn't bother with the windows updates in step 1 since you will be rebuilding the system

for step 2, make sure it is joined to the domain before adding ADDS role

if dhcp isn't an issue being unavailable for wireless devices, then ok; otherwise i would migrate the role before removing it

for step 10, just adding ADDS role; DNS will be installed automatically and nothing to do with functional level since it was already done in step 8

otherwise looks like a plan
0
 
mamelasAuthor Commented:
In step 8 I am referring to the VM since the functional level was originally set to 2008 from step 2.

Therefore step 10  is required for the PM

Correct ?
0
 
Seth SimmonsSr. Systems AdministratorCommented:
what is your functional level now? 2003?
0
 
mamelasAuthor Commented:
If I remember well 2003 ..
0
 
Seth SimmonsSr. Systems AdministratorCommented:
you don't have to raise it twice
you can raise it once at the end to 2012; no need to go to 2008 first
0
 
mamelasAuthor Commented:
OK I am a little bit confused

Now the FL of PM is 2003
On step 2 I will create the VM DC and following I will enable ADDS role
At this step will request the FL or not?
What FL will take the VM at this step???
0
 
Seth SimmonsSr. Systems AdministratorCommented:
you can raise it from 2003 to 2012 at the end; no need to raise to 2008 in between
you are not required to raise it all; 2012 domain controllers support 2003 functional level and work fine
0
 
mamelasAuthor Commented:
Thank you all!!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

  • 7
  • 5
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now