migrate active directory server
in ,

How to Migrate Active Directory Server 2012 R2 to Server 2019

I have written this blog, to help you migrate your existing Active Directory Domain Controller which is running on Windows Server 2012 R2 name (DC2k12) to Windows Server 2019 name (DC2K19). So, let’s get started.

This is straight forward process, but first make sure you have test it 1st in your Test Environment.

I am using two Servers & my previous domain Server (xpertstec.local).

First we need to install Additional domain controller

How to install Additional domain controller click here

Migrate Active Directory Server

Login to your additional domain controller (DC2K19)

windows server  2019 login

Change the alternative DNS server.

internet protocol properties

netdom query fsmo

Open the command prompt and type netdom query fsmo to check the Master Operation role.

netdom query fsmo

Migrating FSMO (Flexible Single Master Operation) roles to Windows Server 2019 (DC2K19).

1- Open active directory users and computers console. Right-click your local domain (xpertstec.local) and then click Operations Masters.

active directory users and computers

2- Select RID tab and then click Change.

operations master rid

3- When you are asked for confirmation, click yes.

transfer active directory fsmo roles

4- Click OK.

master roles was successfully

5- Select PDC tab and then click Change.

operations master pdc

6- When you are asked for confirmation, click Yes.

transfer active directory fsmo roles

7- Click OK.

master roles was successfully

8- Select Infrastructure tab and then click Change.

operations masters infrastructure

9- When you are asked for confirmation, click Yes.

transfer active directory fsmo roles

10- Click OK.

master roles was successfully

11- Select close.

operations masters infrastructure

Change Active Directory Domain Controller.

1- Still on our DC2K12.xpertstec.local server, open Active Directory Domain and Trusts console, right-click Active Directory Domain and Trusts, and then click Change Active Directory Domain Controller.

active directory domain and trust

2- On the Change Directory Server interface, click This Domain Controller or AD LDS instance and then choose your new Windows Server 2019 which is DC2K19.xpertstec.local, and then click OK.

change directory server

3- In the Active Directory Domains and Trusts interface, right-click Active Directory Domains and Trusts found in the folder tree and then select Operations Manager.

active directory domain and trust

4- In the Operations Master interface, select Change to transfer the domain naming master role to the Windows Server 2019 (DC2K19).

operations master change

5- Click Yes.

transfer active directory fsmo roles

6- Click OK

master roles was successfully

7- In the Operation Master interface, verify that Domain naming operations master is now transferred to the DC2K19.xpertstec.local server.

operations master change

In the DC2K19.xpertstec.local server, open Command Prompt and then type regsvr32 schmmgmt.dll to change the Schema Master.

regsvr32 schmmgmt.dll

Click OK.

regsvr32 schmmgmt.dll succeeded

How to Change Schema Master Role

Migrate Active Directory Server

1- Now we need to change Schema Master, on the DC2K19.xpertstec.local server. Type MMC and hit enter.

command prompt mmc

2- Select File and then click Add/Remove Snap-in.

console1 console root

3- Add or Remove Snap-ins interface, choose Active Directory Schema, select Add and then click OK.

add or remove snap-ins

4- In the Console, right-click Active Directory Schema and then click Change Active Directory Domain Controller.

console active directory schema

5- In the Change Directory Server interface, click This Domain Controller or AD LDS instance, click DC2K19.xpertstec.local server and then click OK.

change directory server

6- In the Active Directory Schema box just click OK to proceed.

schema modification can only be

7- In the Console, right click Active Directory Schema and select Operations Master.

console active directory schema

8- Change the Schema Master interface, choose the Change button to transfer the schema master role to the Windows Server 2019 (DC2K19.xpertstec.local).

change schema master change

9- Click Yes.

ad change the operations master

10- Click OK to proceed.

operations master successfully transferred

11- Affirm the current schema master is now DC2K19.xpertstec.local, and then click Close.

change schema master change

Transfer FSMO roles

Open PowerShell, and then type netdom query fsmo command. Check if all the five FSMO roles have been transferred to Active Directory Domain Controller Windows Server 2019.

netdom query fsmo

POWERSHELL (TRANSFER FSMO ROLES)

There are a lot of steps involved to accomplish fsmo transfer to a different Domain Controller. Note: that there is not only 1 way to accomplish this. Open Powershell as admin and type in netdom query fsmo or if you like PowerShell way Get-ADForest | choose schemamaster,domainnamingmaster –> For FOREST WIDE ROLES and Get-ADDomain | select ridmaster,pdcemulator,infrastructuremaster –> for Domain wide roles.

get-adforest

Change Global Catalog

Open Active Directory Sites and Services, expand Sites, expand Default-first-site-name, expand DC2K12.
1- Right-click on NTDS Settings and then select properties.

active directory sites and services

2- Untick Global Catalog checkbox and then click ok.

ntds settings properties

How to uninstall Active Directory Domain Services from Windows Server 2012 R2.

Log in to Windows Server 2012 R2 server with domain administrator credentials.

1- Open PowerShell and type below command then hit enter.

Uninstall-ADDSDomainController -DemoteOperationMasterRole –RemoveApplicationPartition

uninstall-addsdomaincontroller

2- Insert local administrator password, confirm password and then press enter.

uninstall-addsdomaincontroller-

3- Type Y and press enter.

removeapplicationpartition

4- Be patient. It will complete in few minutes.

uninstalling domain controller powershell

5- The server will be rebooted automatically.

you are about to be signed out

DOMAIN / FOREST FUNCTIONAL LEVEL

What you want to know about DFL and FFL is that they epitomize advanced features. That is accessible with the newest software that can be used in the domain. Generally, when you administer a large AD environment we will notice that you have various Windows OS versions on your DCs. If you have DCs that are server 2008 R2, 2012 and you install server 2016 you will not be able to use the latest advanced features. That comes with server 2016 until we upgrade all our DC’s to server 2016 and raise the functional level. AD features are not backward compatible with AD domain controllers on the earliest versions of Windows Server so if you are running Server 2008 R2 and you install server 2016. You will be limited to those features that come with Server 2008 R2. Functional levels can be used to determine which DCs are allowed to run in our environmental. For example, if you raise the functional level to server 2016 we will not be able to install server 2012 R2 DC in our domain. You can’t set the DFL (domain functional level) to a value that is lower than the FFL (forest functional level), but we can set it to a value that is similar to or higher than the forest functional level.

How to check the DFL – FFL you can use GUI or Powershell.

1- GUI, Right-click on your domain and then select properties.

active directory users and computers

2- Now you can see domain and forest functional level.

local domain properties general

RAISE DOMAIN AND FOREST FUNCTIONAL LEVEL

1- In ADUC right-click on the your domain and then select Raise DFL.

raise domain functional level

2- Select Windows Server 2016 so I am not able to raise it more than that but you comes here to raise domain functional level.

raise domain functional level

3- Click OK.

this change affects the entire domain

4- Click OK.

functional level was raised

How to raise forest functional level.

1- Open domains and trusts, Right click on active directory domain and trust and choose raise FFL.

active directory domain and trust

2- Select raise.

raise forest functional level

3- Click OK.

change affects the entire forest level

4- Click OK.

functional level was raised

How to confirm the domain and forest functional levels.

Get-ADDomain | fl Name, DomainMode
Get-ADForest | fl Name, ForestMode

get-addomain

GPO already migrate to new Domain Controller (DC2K19).

group policy management

Now replace your DNS IP address.

internet protocol properties

How to remove the active directory domain service in window server 2012 R2.

1- Open Server Manager and then select Dashboard.
Choose the Manage option and then choose to Remove Roles and features.

server manager

2- Click Next.

add roles and features wizard

3- Select server and then click on next.

select destination server

4- Uncheck Active Directory Domain Services box.

remove server roles

5- Select Remove Features.

remove features that require

6- Now Uncheck DNS Server role.

remove server roles

7- Select Remove Features.

remove features that require dns

8- Click Next.

remove server roles

9- Click Next

remove features features

10- Confirm removal selections and then click Remove.

confirm removal selections

11- Click Close.

a restart is pending on dc

After restarting server 2012 please join it to the workgroup.

For more details please click here

Written by Jamil Parvez

Jamil Pervez works as a Network Administrator, based in Kuwait with a Primary focus on Microsoft technologies. Microsoft Certified MCSE, MCTP, MCITP, CCNP, CCIP, CCVP with 18 years experience in administering Windows Servers, Exchange, VMWare, Veeam B&R, Veritas BackupExec.

Leave a Reply

5G

5G Technology could result in an inaccurate weather forecast

iscsi for esxi in freenas

How to Setup iSCSI for ESXi in FreeNAS