Migrating Domain Controllers From Server 2008 R2 to Server 2012 R2

In this article, I have documented the steps I took to update our two domain controllers to Server 2012 R2 from Server 2008 R2. While this can be considered a tutorial, it is more a reflection of what I did during my migration process. This guide assumes you have already made backups of your environment, all Windows Active Directory Domain Controllers in the forest are running Server 2003 or later, and we will be recycling (reusing) the same two servers you deployed. Last, Microsoft strongly recommends we do a clean install and not directly upgrade each server, so we will decommission a DC, reinstall windows, and then redeploy the DC until the entire environment has been upgraded.

1. Prepare the AD Schema for Server 2012 R2
2. Mount the Server 2012 R2 installation disk on one of your Domain Controllers
3. Open up a command prompt with Administrative Privileges and navigate to the /support/adprep folder on the installation media.
4. Click Start, type cmd, right click select Run as administrator
5. Execute the command: d:
6. Execute the command: cd d:\support\adprep
7. Execute the following command (don’t close out of this until after we verify the schema version in an upcoming step):
8. adprep /forestprep
9. Type the letter C and press the enter key to begin the process
10. Execute the following command:
11. adprep /domainprep

12. Verify the schema version has been updated
13. Open up regedit and navigate to Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NTDS\Parameters
14. Verify the Schema Version value matches the last entry shown in your upgrade results. In my case, the Schema Version should be 69.
15. Demote and decommission secondary domain controller
16. Click Start, Run… Type dcpromo and click OK
17. Click Next > on the Welcome page
18. If the domain controller has the global catalog service, make sure your primary DC also has the service enabled and click OK. This can be done by opening up Active Directory Sites and Services and viewing the services for each domain controller.
19. Make sure the Delete this domain because this server is the last domain controller in the domain is UNCHECKED, and click Next > Type in a new password to be used for the Local Administrator account the machine will contain after it is demoted.
20. Click Next > on the Summary page
21. Check the Reboot on completion box to restart the server after the service has been removed
22. Log back into the DC upon reboot and open up Server Manager

23. In Roles Summary, click Remove Roles

24. Click Next > on the Before You Begin page

25. Uncheck Active Directory Domain Services and DNS Server (if the role is installed) and click Next >

26. Click Remove

27. Click Close Select Yes on the Do you want to restart now? dialog box
28. Log back into the DC upon reboot and you should greeted by a Removal Results window. Let the process finish and select Close upon removal success.
29. Disjoin the machine from the domain
30. Click Start, right click Computer, select Properties Click Change settings

31. Click Change… on the System Properties page Check Workgroup, type in a workgroup name, and click OK

32. Click OK on the warning dialog
33. Click OK on the Welcome to the workgroup dialog Click OK on the restart dialog
34. Click Close on the System Properties window (oops, forgot to make a screenshot!)
35. Click Restart Later on the Microsoft Windows dialog box
36. Shutdown the machine
37. Format the decommissioned machine, reinstall a clean copy of Server 2012 R2, and join the machine to the domain.
38. Add first Server 2012 R2 Domain Controller
39. At this point, you should have one Server 2008 R2 Domain Controller and a blank Server 2012 R2 machine joined to the domain ready for the Active Directory services. If you are at this point, continue on, if not, you might want to read back a couple steps and see where things ventured off course.
40. Start Server Manager on your new Server 2012 R2 machine.
41. Select Manage in the top right and select Add Roles and Features

42. Click Next > on the Before you begin screen
43. Click Next > on the Select installation type screen Ensure your new server is selected and click Next >

44. Check the box next to Active Directory Domain Services

45. On the Add features that are required for Active Directory Domain Services? dialog, click the Add Features button Click Next >

46. Click Next >

47. Check the box that says Restart the destination server automatically if required (Click Yes on the restart dialog if it pops up)
48. Click the Install button
49. Once the install is done, click the Close button
50. Next, head back to the Server Manager screen and select the warning icon with the flag; then select Promote this server to a domain controller.

51. On the Deployment Configuration page, make sure Add a domain controller to an existing domain is checked and hit Next >

52. Check Domain Name System (DNS) server, Check Global Catalog (GC), and uncheck Read only domain controller (RODC). Enter a strong password to be used to access Directory Services Restore Mode and click Next >

53. Click Next > on the DNS Options page
54. Click Next > on the Additional Options page, or if you would like, you can manually select a domain controller to replicate data from and then hit Next >.
55. Click Next > on the Paths page
56. Click Next > on the Review Options page
57. Click Install on the Prerequisites Check page
58. Once the domain controller reboots after installation, open up Server Manager and select Tools, Active Directory Users and Computers

59. Expand your Domain and select Domain Controllers; ensure your new machine shows up here.
60. Next, verify DNS works properly
61. Go back to Server Manager, select Tools, DNS

62. Expand your server, Forward Lookup Zones, and right click on your domain name and select Properties

63. Select the Name Servers tab and ensure all DCs are listed
64. Next, we need to verify the FSMO (Flexible Single Master Operations) roles are stored on our other server 2008 DC
65. On the new Server 2012 R2 DC we joined, open up a command prompt with administrative privileges.
66. Execute the following command to verify FSMO roles are on our 2008 DC: netdom query fsmo

67. Next, we need to transfer the FSMO roles from our primary DC to our new one
68. Execute the following command using the same command prompt in the previous steps: ntdsutil Type roles when prompted and hit enter
69. Type connections when prompted and hit enter
70. Type connect to server server2012DC.mydomain.com, where server2012DC is the new DC we just deployed, when prompted and hit enter
71. Type quit and hit enter
72. Type transfer schema master and hit enter
73. Click Yes on the Role Transfer Dialog for the Schema Master role
74. Type transfer naming master and hit enter
75. Click Yes on the Role Transfer Confirmation Dialog for the Naming Master role
76. Type transfer PDC and hit enter
77. Click Yes on the Role Transfer Configuration Dialog for the Primary Domain Controller role
78. Type transfer RID master and hit enter
79. Click Yes on the Role Transfer Configuration Dialog for the RID master role
80. Type transfer infrastructure master and hit enter Click Yes on the Role Transfer Configuration Dialog for the Infrastructure Master role
81. Type quit and hit enter
82. Type quit and hit enter Execute the following command to ensure the FSMO services are on the new Server 2012 R2 machine: netdom query fsmo

83. ould have a Server 2012 R2 DC with the FSMO roles and a secondary 2008 R2 Domain Controller. If not, please go back and complete the steps to get to this point.
84. Optional Step: After upgrading the first DC, you may want to reconfigure the machine to keep its time in sync with an external source. To do this, please follow my guide here:
85. Next, decommission the last Server 2008 R2 domain controller that used to function as the primary DC.
86. Follow the same instructions in Step 2 above called Demote and decommission secondary domain controller
87. Next, add the machine back to the domain
88. Follow the same instructions in Step 3 above called Add first Server 2012 R2 Domain Controller
89. At this point, your environment should be up and running with Windows Server 2012 R2! You can optionally transfer the FSMO roles back to your “primary” DC that you had before, or continue on with the roles left on the current DC.Official information on removing a domain controller from the domain can be found on Microsoft’s website here: http://technet.microsoft.com/en-us/library/cc771844(v=ws.10).aspx
91. Notes