Migrate on prem domain controllers to Azure using Azure Migrate.

Question

Can I migrate my Domain controllers to Azure using Azure Migrate. I have tried it and doing the replication and test migration the server gets migrated without the sysvol share. I tried shutting down the source server before the test migration and the sysvol share was not migrated. I have a total of 11 servers to migrate. Each of these servers depend on those domain controllers for authentication and security.

Answer 1

Hello @Andrew Berardi Thank you for contacting us on Microsoft Q&A platform. Happy to assist!

Migrating on-premises domain controllers to Azure using Azure Migrate involves the following steps:

1. Assess your on-premises environment using Azure Migrate: Server Assessment. This will help you identify the servers that need to be migrated and ensure that they meet the requirements for migration.
2. Create a virtual network in Azure that will be used to host the domain controllers. Ensure that the virtual network is connected to your on-premises network using a VPN or ExpressRoute.
3. Deploy domain controllers in Azure virtual machines. You can use Azure Marketplace images or create your own custom images.
4. Join the domain controllers to your on-premises Active Directory domain.
5. Configure Active Directory replication between the on-premises domain controllers and the Azure domain controllers.
6. Update DNS settings to ensure that clients can resolve domain names to the Azure domain controllers.
7. Migrate other servers and applications to Azure as needed.
8. Decommission the on-premises domain controllers once you have verified that the Azure domain controllers are functioning correctly.

It is important to note that migrating domain controllers to Azure requires careful planning and execution to ensure that there is no disruption to your Active Directory environment. It is recommended that you follow best practices and consult with Microsoft documentation and support as needed.

Answer 2

Hi

I'd be more inclined to create a dedicated secure VNET in Azure with newly deployed AD DS Servers which are protected by NSG's with specific rules. An example of this is in the diagram shown in the link below:

https://learn.microsoft.com/en-us/azure/architecture/example-scenario/identity/adds-extend-domain

Allow replication to happen and confirm that all is healthy, then add the new servers as authentication and DNS reference points for your existing servers prior to migration. This of course depends on having connectivity in place via either S2S VPN or ExpressRoute (which I assume you do).

You would then have separate VNETs in Azure for your App VMs which would also be protected by NSG's.

Hope this helps,

Thanks

Michael Durkan

• If the reply was helpful please upvote and/or accept as answer as this helps others in the community with similar questions. Thanks!