ad migration

Question

i want migration my old server win 2012 r2 to new physical server windows server 2019 which runs active directory how i could do that the best way with no downtime could i added the new server to cluster ?

Answer 1

You cannot cluster domain controllers for fault tolerance.

The two prerequisites to introducing the first 2019 domain controller are that domain functional level needs to be 2008 or higher and older sysvol FRS replication needs to have been migrated to DFSR
https://techcommunity.microsoft.com/t5/Storage-at-Microsoft/Streamlined-Migration-of-FRS-to-DFSR-SYSVOL/ba-p/425405

I'd use dcdiag / repadmin tools to verify health correcting all errors found before starting any operations. Then stand up the new 2019, patch it fully, license it, join existing domain, add active directory domain services, promote it also making it a GC (recommended), transfer FSMO roles over (optional), transfer pdc emulator role (optional), use dcdiag / repadmin tools to again verify health, when all is good you can decommission / demote old one.

--please don't forget to Accept as answer if the reply is helpful--

Answer 2

Hello @mahmoud azletni ,

Thank you for posting here.

**Q1:**how i could do that the best way with no downtime?
**A1:**Based on my understanding, I understand you want to migrate 2012 R2 DC in your domain to 2019 DC, if anything I misunderstood, please correct me.

As DSPatrick mentioned, if we want to add 2019 DC in our existing domain, we need to check forest functional level and SYSVOL replication type.

Forest/domain functional level should be 2008 or higher and SYSVOL replication should be DFSR.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DFSR\Parameters\SysVols\Migrating Sysvols\LocalState registry subkey. If this registry subkey exists and its value is set to 3 (ELIMINATED), DFSR is being used. If the subkey does not exist, or if it has a different value, FRS is being used.

Meanwhile, before we do any change in existing AD domain environment, we had better do:
1.Check if AD environment is healthy. Check all DCs in this domain is working fine by running Dcdiag /v.
Check if AD replication works properly by running the commands below.
repadmin /showrepl >c:\repsum1.csv
repadmin /replsum >c:\repsum2.csv
repadmin /showrepl * /csv >c:\repsum3.csv

If there is no any error in the command result, it seems AD environemtn is healthy.

2.Had better back up all domain controllers.
3.Check both SYSVOL folder and Netlogon folder are shared by running net share on each DC.
4.SYSVOL replication works fine.
5.Check we can update gpupdate /force on each DC successfully.

After we ensure forest function level is 2008 and SYSVOL replication is DFSR replication type.
And all DCs and the entire AD environement are healthy.
For DC migration in the same domain, we suggest we promote a new DC in the existing domain.

The steps below for your reference.
1.Add the new Window server 2019 to this existing domain.
2.Add AD DS and DNS roles.
3.Promote this Windows server 2019 as a DC (also as a GC).
4.If the DC is promoted successfully, check if AD environment is healthy again.
5.If step 1-step 4 is OK without any error. We can transfer FSMO roles to new 2019 DC if needed.
6.Raise forest/domain functional level if needed.
7.Demote Windows server 2012 R2 after migrating AD DS and DNS role and FSMO roles if needed.

Before we demote 2012 R2 DC, we should check if needed:
If the 2012 R2 DC was also a DNS server, update the DNS client configuration on all member workstations, member servers, and other DCs that might have used this DNS server for name resolution. If it is required, modify the DHCP scope to reflect the removal of the DNS server.
If the 2012 R2 DC was also a DNS server, update the Forwarder settings and the Delegation settings on any other DNS servers that might have pointed to the removed DC for name resolution.

Other considerations:
1.Had better perform DC migration during downtime.
2.Migrate other roles and features on this 2012 R2 DC if needed before demoting it/removing it from the domain.
3.Ensure that all domain functional levels are equal to or higher than the forest functional level;
4.Ensure that the operating system level of all domain controllers is equal to or higher than the domain functional level;

**Q2:**could i added the new server to cluster ?
**A2:**From the following link, we can not add a DC (server with AD DS role) into cluster.

You cannot add a domain controller as a node in a failover cluster environment
https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/cannot-add-domain-controller-node-failover-cluster

Multiple DCs (more than one DC) in the same domain will achieve fault tolerance. We do not need add DCs in the cluster.

Hope the information above is helpful.

If anything is unclear or if anything I misunderstood, please let us know.

References
Forest and Domain Functional Levels
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-functional-levels

Upgrade Domain Controllers to Windows Server 2016
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/upgrade-domain-controllers

Best Regards,
Daisy Zhou

Answer 3

The simplest method is to add the new 2019 domain controller to existing active directory domain.

and as mentioned the two prerequisites to introducing the first 2019 domain controller are that domain functional level needs to be 2008 or higher and older sysvol FRS replication needs to have been migrated to DFSR
https://techcommunity.microsoft.com/t5/Storage-at-Microsoft/Streamlined-Migration-of-FRS-to-DFSR-SYSVOL/ba-p/425405

I'd use dcdiag / repadmin tools to verify health correcting all errors found before starting any operations. Then stand up the new 2019, patch it fully, license it, join existing domain, add active directory domain services, promote it also making it a GC (recommended), transfer FSMO roles over (optional), transfer pdc emulator role (optional), use dcdiag / repadmin tools to again verify health, when all is good you can decommission / demote old one.

--please don't forget to *Accept as answer if the reply is helpful--