I really need some detailed help upgrading domain controllers so we can look at moving to Azure

Question

So we have 3 Domain controllers in our AD structure. 2 are running on servers that have Server 2008 32 bit installed. One of these is our Global catalog. I also have a server running 2012 64 bit. Now I inherited the responsibility of these machines. All are virtual so creating new servers to be pulled in is no problem. I am no AD expert and nobody at my work is. I want to get this count down to 2 servers running 2019 64 bit and as we add more to the cloud we are considering moving our AD functionality to the cloud eventually as well. I could really use some detailed steps on what my process should be. I appreciate anything anyone can do to help me.

Answer 1

The two prerequisites to introducing the first 2019 domain controller are that domain functional level needs to be 2008 or higher and older sysvol FRS replication needs to have been migrated to DFSR
https://techcommunity.microsoft.com/t5/Storage-at-Microsoft/Streamlined-Migration-of-FRS-to-DFSR-SYSVOL/ba-p/425405

I'd use dcdiag / repadmin tools to verify health correcting all errors found before starting any operations. Then stand up the new 2019, patch it fully, license it, join existing domain, add active directory domain services, promote it also making it a GC (recommended), transfer FSMO roles over (optional), transfer pdc emulator role (optional), use dcdiag / repadmin tools to again verify health, when all is good you can decommission / demote old one.

--please don't forget to Accept as answer if the reply is helpful--

Answer 2

So I wanted to verify the domain function level. I get message that one of the servers is not running the appropriate version of windows. I did save the file it offers and it lists the two 2008 servers and they are running Windows Server 2008 Standard 6.0 (6003). It does not even list the 2012 server so I question whether it is in the domain truly. Do I have any issues to address with this or do I start on the information to migrate to DSFR?

Answer 3

You'll want to fix it before doing anything. Please run;

Dcdiag /v /c /d /e /s:%computername% >c:\dcdiag.log
repadmin /showrepl >C:\repl.txt
ipconfig /all > C:\dc1.txt
ipconfig /all > C:\dc2.txt
ipconfig /all > C:\dc3.txt

then put unzipped text files up on OneDrive and share a link.

Answer 4

Sorry folks. Fireman Joe here just had a chance to do this yesterday and posting now!

https://pinehurst0-my.sharepoint.com/:f:/g/personal/jcimadamore_pinehurst_com/EjujwywHlhNAtfnyLVl4vB8B05akjUi4qpce8cYJJ1CFdQ?e=lNAwMB

Answer 5

• I'd check the event logs on DCBACKUP for more details. It seems there are FRS errors present when DCGLOBAL runs DFSR. The domain replication method can only be one or the other. Demoting, reboot, promo the problematic one again may solve this issue.
• On DCPRIMARY w32time should be set to Automatic, may also have some disk failures pending
• Some metadata cleanup may be necessary (MEMFITCTR-VDI)
  https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/ad-ds-metadata-cleanup
  https://techcommunity.microsoft.com/t5/itops-talk-blog/step-by-step-manually-removing-a-domain-controller-server/ba-p/280564
  • For the Broken delegation this one might help.
    https://serverfault.com/questions/796529/broken-dns-delegation

--please don't forget to Accept as answer if the reply is helpful--