Migrating a Domain Controller

28 August 2025 0 By Rached Chader

Welcome to Chader.fr!

In this step-by-step guide, we will walk through how to safely migrate an Active Directory Domain Controller, including FSMO role transfer, configuration via PowerShell, and the demotion of the old DC.

What to Prepare Beforehand

System state backup of the old DC (and DNS if applicable).
If virtual machine: take a snapshot (to be deleted after migration validation).
Open required network flows between the new DC and the domain.
Ensure DNS is healthy and AD time synchronization is correct.

Health check (run on an existing DC):

dcdiag /v /c /e /fix
repadmin /replsummary
repadmin /showrepl *
Get-ADForest | fl ForestMode,SchemaMaster
Get-ADDomain  | fl DomainMode,PDCEmulator

dcdiag /v /c /e /fix

repadmin /replsummary

repadmin /showrepl *

Get-ADForest | fl ForestMode,SchemaMaster

Get-ADDomain | fl DomainMode,PDCEmulator

Contrôle-santé-DC — Capture 01 — repadmin propre : ‘Fails = 0’ sur toutes les lignes.

Prepare the New Server (NEWDC.chader.fr)

Rename the Server

Open Server Manager → Local Server → Computer Name.
System Properties → Computer Name tab → Change….
Enter new name (e.g., NEWDC) and domain suffix (chader.fr) → restart.

Static IP & Primary DNS (Before Promotion)

Network & Sharing Center → Adapter settings → Properties → IPv4 → Properties.
Example: IP = 10.0.0.50, Mask = 255.255.255.0, Gateway = 10.0.0.1.
Preferred DNS = existing DC (10.0.0.10), Alternate = another DC (10.0.0.11).
Ensure Register this connection’s addresses in DNS is checked.
Do not set public DNS or 127.0.0.1 at this stage. Keep IPv6 enabled.

Join the Domain

Local Server → Workgroup → Change… → enter chader.fr + credentials → restart.

Install AD DS Role

Server Manager → Manage → Add Roles and Features → select Active Directory Domain Services → Install.
Then click the notification “Promote this server to a domain controller”.

DNS After Promotion

IPv4 Preferred DNS = NEWDC’s IP.
Alternate DNS = another DC.
Never configure public DNS on a DC.

Quick Checks

Confirm: Computer name = NEWDC, Domain = chader.fr, Static IPv4, No DNS errors.
Time sync < 5 minutes difference.
If VM: snapshot now.

Promote the New DC (replica + DNS + GC)

Promotion Wizard (GUI)

Server Manager → Promote this server to a domain controller →
- Add to existing domain chader.fr, Site = Default-First-Site-Name
- Check DNS + GC, leave RODC unchecked
- Enter DSRM password → Next → Install → Reboot.

PowerShell (optional)

Install-ADDSDomainController `
  -DomainName "chader.fr" `
  -InstallDns:$true `
  -NoGlobalCatalog:$false `
  -Credential (Get-Credential "CHADER\Administrateur") `
  -SiteName "Default-First-Site-Name" `
  -SafeModeAdministratorPassword (Read-Host -AsSecureString "DSRM")

Install-ADDSDomainController `

-DomainName "chader.fr" `

-InstallDns:$true `

-NoGlobalCatalog:$false `

-Credential (Get-Credential "CHADER\Administrateur") `

-SiteName "Default-First-Site-Name" `

-SafeModeAdministratorPassword (Read-Host -AsSecureString "DSRM")

Post-Reboot Checks

dcdiag 
repadmin /replsummary 
nslookup -type=SRV _ldap._tcp.dc._msdcs.chader.fr

dcdiag

repadmin /replsummary

nslookup -type=SRV _ldap._tcp.dc._msdcs.chader.fr

Ensure replication errors = 0.
dcdiag passes.
SRV records visible in DNS.

Transfer FSMO Roles to NEWDC

GUI Method

ADUC → Domain → Operations Masters → transfer RID, PDC, Infrastructure.
AD Domains and Trusts → change Domain Naming Master.
AD Schema MMC (after regsvr32 schmmgmt.dll) → transfer Schema Master.

PowerShell Quick Method

netdom query fsmo → les 5 rôles on NEWDC
w32tm /query /status → Source = pool.ntp.org, Référent (reliable) = True

SYSVOL Migration: FRS → DFSR

dfsrmig /setglobalstate 1   # Prepared
dfsrmig /getmigrationstate  # attendre 100%

dfsrmig /setglobalstate 2   # Redirected
dfsrmig /getmigrationstate  # attendre 100%

dfsrmig /setglobalstate 3   # Eliminated
dfsrmig /getmigrationstate  # attendre 100%

dfsrmig /setglobalstate 1 # Prepared

dfsrmig /getmigrationstate # attendre 100%

dfsrmig /setglobalstate 2 # Redirected

dfsrmig /getmigrationstate # attendre 100%

dfsrmig /setglobalstate 3 # Eliminated

dfsrmig /getmigrationstate # attendre 100%

Migration FRS to DFSR : article

Attention
Do not chain the states in one go. Wait for “State achieved across all DCs” at each step before moving to the next.

Decommission the Old DC (OLDDC)

GUI (recommended)

Server Manager → Remove Roles and Features → Demote this domain controller → set local admin password → uninstall → reboot.

PowerShell

Uninstall-ADDSDomainController -DemoteOperationMasterRole:$true `
  -RemoveApplicationPartitions `
  -LocalAdministratorPassword (Read-Host -AsSecureString "LocalAdmin")

Uninstall-ADDSDomainController -DemoteOperationMasterRole:$true `

-RemoveApplicationPartitions `

-LocalAdministratorPassword (Read-Host -AsSecureString "LocalAdmin")

Cleanup: remove OLDDC from Sites and Services, purge stale DNS A/SRV records. If the DC is dead, use NTDSUtil to clean metadata.

Final Validation & Common Pitfalls

Required Network Flows

From/To	Service	Ports	Purpose
DC ↔ DC	LDAP	389 TCP/UDP	Replication & binds
	LDAPS	636 TCP	Encrypted LDAP
	GC	3268 / 3269 TCP	Global Catalog
	Kerberos	88 TCP/UDP	Authentication
	DNS	53 TCP/UDP	Name resolution & SRV
	RPC EM	135 TCP	Endpoint Mapper
	RPC Dyn	49152–65535 TCP	AD replication
	SMB	445 TCP	SYSVOL / NETLOGON
	DFSR	5722 TCP	SYSVOL replication (DFSR)
Clients → NEWDC	DNS/KRB/LDAP	53/88/389/3268/445	Auth, queries, GPOs, scripts
NEWDC ↔ Internet	NTP	123 UDP	Time sync (from reliable external source)