How to Migrate a Windows Server Domain From One Server to Another
Preface
This guide assumes you're migrating a domain controller to a new server then demoting the old DC.
Check the DC Health
On the old server, run a few reports and make sure the health of the domain controller is good. Fix any errors that arise prior to migrating anything.
dcdiag.exe /v
dcdiag.exe /test:dns
repadmin.exe /replsummary
Join New Server to Domain
Make sure your DNS is pointing to the old DC before doing this.
Add-Computer -DomainName DOMAINNAME.local -Restart
Install AD Services Role
This will install Active Directory and all that good stuff
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools
Restart-Computer
Promote the Server to a Domain Controller
Figured promoting the DC using a powershell command would be more fun : )
$HashArguments = @{
Credential = (Get-Credential "DOMAINNAME\Administrator")
DomainName = "DOMAINNAME.local"
InstallDns = $true
}
Install-ADDSDomainController @HashArguments
Transfer FSMO Roles
Run these commands on the old server. This will transfer all the fancy pants FSMO rules to the new domain controller. Later we're going to decommission the old server so we want to make sure these roles are transferred.
ntdsutil
C:\Windows\system32\ntdsutil.exe: roles
fsmo maintenance: connections
server connections: connect to server NEW_DC_NAME
Binding to server...
Connected to server using credentials of locally logged on user.
server connections: q
fsmo maintenance: transfer infrastructure master
fsmo maintenance: transfer naming master
fsmo maintenance: transfer pdc
fsmo maintenance: transfer rid master
fsmo maintenance: transfer schema master
fsmo maintenance: q
C:\Windows\system32\ntdsutil.exe: q
On the new server verify that the FSMO roles were transferred using this command
netdom query fsmo
Force Replication
This should replicate the data from the old DC to the new DC automatically.
repadmin /syncall /AdeP
Checking that everything works
On the new domain controller, pull some reports and make sure there's no errors. Make sure that replication is working perfectly using repadmin.exe
Your new server should also have the SYSVOL and NETLOGIN shares automatically created on it. Make sure those exist.
If you're having problems with the replication succeeding but the SYSVOL and NETLOGIN shares not being created, it could be caused by the old domain controller still trying to replicate to an even older DC thats no longer in place. I had a problem where a server was migrated once before and the new DC was still thinking it was a replication target. Since the OG server was already decomissioned, the current DC thought it had stale data and refused to replicate to the new DC. I followed this tutorial to fix it.
Read the DFRS Event Log for in "Applications and Services Logs\DFS Replication"
dcdiag.exe /v
dcdiag.exe /test:dns
repadmin.exe /replsummary
Demote the Domain
When everything is looking good, you can demote the old domain controller. You should be good to go
DCPROMO.EXE
Remove Static Addresses From Workstations
This powershell script will set all the network cards DNS to DHCP. Make sure you already configured your router with the IP of the new DNS server.
Get-NetAdapter | Where-Object {$_.Status -eq 'Up'} | foreach {
$InterfaceAlias = $_.InterfaceAlias
Set-DnsClientServerAddress -InterfaceAlias $InterfaceAlias -ResetServerAddresses
}