Home
%3CLINGO-SUB%20id%3D%22lingo-sub-329861%22%20slang%3D%22en-US%22%3EHow%20to%20Migrate%20Active%20Directory%20from%20Windows%20Server%202012%20R2%20to%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-329861%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%3EWindows%20Server%202019%20was%20available%20for%20public%20(GA)%20from%20early%20October%202018.%20In%20past%20I%20have%20written%20many%20articles%20about%20domain%20migrations%20by%20covering%20different%20Active%20Directory%20versions.%20So%2C%20it%20is%20time%20me%20to%20write%20about%20AD%202019%20migrations.%20In%20this%20demo%20I%20am%20going%20to%20demonstrate%20how%20to%20migrate%20from%20Active%20Directory%202012%20R2%20to%20Active%20Directory%202019.%20The%20same%20procedure%20is%20going%20to%20apply%20for%20any%20AD%20version%20from%20Windows%20Server%202008.%26nbsp%3B%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EMigration%20itself%20is%20very%20straight%20forward%20task.%20But%20there%20are%20other%20things%20you%20need%20to%20consider%20before%20you%20do%20an%20AD%20migration.%20In%20below%20I%20listed%20a%20checklist%20you%20can%20use%20in%20many%20occasions.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSPAN%3EEvaluate%20business%20requirement%20for%20active%20directory%20migration%20%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%3EPerform%20Audit%20on%20Existing%20Active%20Directory%20Infrastructure%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%3EProvide%20Plan%20for%20implementation%20Process%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%3EPrepare%20Physical%20%2F%20Virtual%20resources%20for%20Domain%20Controller%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%3EInstall%20Windows%20server%202019%20Standard%20%2F%20Datacenter%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%3EPatch%20Servers%20with%20latest%20Windows%20Updates%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%3EAssign%20Dedicate%20IP%20address%20to%20Domain%20Controller%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%3EInstall%20AD%20DS%20Role%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%3EMigrate%20Application%20and%20Server%20Roles%20from%20the%20Existing%20Domain%20Controllers.%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%3EMigrate%20FSMO%20roles%20to%20new%20Domain%20Controllers%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%3EAdd%20New%20Domain%20controllers%20to%20the%20Existing%20Monitoring%20system%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%3EAdd%20New%20Domain%20controllers%20to%20the%20Existing%20DR%20Solution%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%3EDecommission%20old%20domain%20controllers%20%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%3ERaise%20the%20Domain%20and%20Forest%20Functional%20level%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%3EOn%20Going%20Maintenance%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20688px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F71787iDD3F6B3280ABBC77%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22AD.png%22%20title%3D%22AD.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EAs%20per%20the%20above%20figure%20therebeladmin.com%20domain%20has%20two%20domain%20controllers.%26nbsp%3B%20In%20here%2C%20the%20FSMO%20role%20holder%20is%20running%20windows%20server%202012%20R2.%20Domain%20and%20forest%20functional%20level%20currently%20operating%20at%20Windows%20server%202012%20R2.%20A%20new%20domain%20controller%20with%20Windows%20server%202019%20will%20be%20introduce%20and%20it%20will%20be%20the%20new%20FSMO%20role%20holder%20for%20the%20domain.%20once%20FSMO%20role%20migration%20completed%2C%20Domain%20controller%20running%20windows%20server%202012%20R2%20will%20be%20decommissioned.%20After%20that%20forest%20and%20domain%20function%20level%20will%20raised%20to%20the%20windows%20server%202019.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EIn%20the%20demonstration%2C%20REBEL-DC2012%20is%20the%20domain%20controller%20with%20windows%20server%202012%20R2%20and%20REBEL-DC2016%20is%20the%20domain%20controller%20with%20windows%20server%202019.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%3CSTRONG%3ENote%3C%2FSTRONG%3E%E2%80%93%20When%20you%20introduce%20new%20domain%20controllers%20to%20the%20existing%20infrastructure%20it%20is%20recommended%20to%20introduce%20to%20the%20forest%20root%20level%20first%20and%20then%20go%20to%20the%20domain%20tree%20levels.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20874px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F71788iF8AD72F475D84677%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%222019d1.png%22%20title%3D%222019d1.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSPAN%3ELog%20in%20to%20the%20Server%202019%20as%20a%20member%20of%20local%20administrators%20group.%20%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%3EAdd%20server%20to%20the%20existing%20domain%20as%20member%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20782px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F71789i2625FF9C10D2278C%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%222019d2.png%22%20title%3D%222019d2.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSPAN%3EAfter%20restart%2C%20log%20in%20to%20the%20server%20as%20%3CSTRONG%3EEnterprise%20Administrator%3C%2FSTRONG%3E%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%3EAssign%20static%20IP%20address%20to%20the%20server%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%3ELaunch%20the%20PowerShell%20Console%20as%20an%20Administrator%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%3E%3CSPAN%3EBefore%20the%20configuration%20process%2C%20we%20need%20to%20install%20the%20AD%20DS%20Role%20in%20the%20given%20server.%20In%20order%20to%20do%20that%20we%20can%20use%20Following%20command.%20%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CSTRONG%3EInstall-WindowsFeature%20%E2%80%93Name%20AD-Domain-Services%20-IncludeManagementTools%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20849px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F71790i226027BB4D8A01DF%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%222019d3.png%22%20title%3D%222019d3.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSPAN%3EConfigure%20the%20new%20server%20as%20additional%20domain%20controller.%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CSTRONG%3E%26nbsp%3BInstall-ADDSDomainController%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E-CreateDnsDelegation%3A%24false%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E-NoGlobalCatalog%3A%24true%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E-InstallDns%3A%24true%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E-DomainName%20%22therebeladmin.com%22%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E-SiteName%20%22Default-First-Site-Name%22%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E-ReplicationSourceDC%20%22REBEL-DC2012.therebeladmin.com%22%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E-DatabasePath%20%22C%3A%5CWindows%5CNTDS%22%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E-LogPath%20%22C%3A%5CWindows%5CNTDS%22%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E-NoRebootOnCompletion%3A%24true%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E-SysvolPath%20%22C%3A%5CWindows%5CSYSVOL%22%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E-Force%3A%24true%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F71791i2DAB7900B41E56CD%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%222019d4.png%22%20title%3D%222019d4.png%22%20%2F%3E%3C%2FSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EThere%20are%20no%20line%20breaks%20for%20the%20command%20and%20I%20have%20listed%20it%20as%20above%20to%20allow%20readers%20to%20identify%20on%20the%20parameters%20clearly.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CTABLE%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%3E%3CP%3E%3CSTRONG%3EArgument%20%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3E%3CSTRONG%3EDescription%20%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CP%3E%3CSTRONG%3EInstall-ADDSDomainController%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3EThis%20cmdlet%20will%20install%20the%20domain%20controller%20in%20active%20directory%20infrastructure.%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CP%3E%3CSTRONG%3E-NoGlobalCatalog%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3EIf%20you%20do%20not%20need%20to%20create%20the%20domain%20controller%20as%20global%20catalog%20server%2C%20this%20parameter%20can%20use.%20By%20default%2C%20system%20will%20enable%20global%20catalog%20feature.%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CP%3E%3CSTRONG%3E-SiteName%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3EThis%20Parameter%20can%20use%20to%20define%20the%20active%20directory%20site%20name.%26nbsp%3B%20the%20default%20value%20is%20%3CEM%3EDefault-First-Site-Name%3C%2FEM%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CP%3E%3CSTRONG%3E-DomainName%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3EThis%20parameter%20defines%20the%20FQDN%20for%20the%20active%20directory%20domain.%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%3E%3CP%3E%3CSTRONG%3E-ReplicationSourceDC%3C%2FSTRONG%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3CTD%3E%3CP%3EUsing%20this%20parameter%20can%20define%20the%20active%20directory%20replication%20source.%20By%20default%2C%20it%20will%20use%20any%20available%20domain%20controller.%20But%20if%20need%20we%20can%20be%20specific.%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EOnce%20execute%20the%20command%20it%20will%20ask%20for%20%3CSTRONG%3E%3CEM%3ESafeModeAdministrator%20%3C%2FEM%3E%3C%2FSTRONG%3EPassword.%20Please%20use%20complex%20password%20to%20proceed.%20This%20will%20be%20used%20for%20DSRM.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSPAN%3EAfter%20configuration%20completed%2C%20restart%20the%20system%20and%20log%20back%20in%20as%20administrator%20to%20check%20the%20AD%20DS%20status.%20%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CSTRONG%3EGet-Service%20adws%2Ckdc%2Cnetlogon%2Cdns%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20848px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F71792iA51BE2ADA9C3C2DC%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%222019d5.png%22%20title%3D%222019d5.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EWill%20confirm%20the%20status%20of%20the%20AD%20DS%20service.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EGet-ADDomainController%20-Filter%20*%20%7C%26nbsp%3B%20Format-Table%20Name%2C%20IPv4Address%2C%20Site%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20834px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F71793i3685E85F226154BA%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%222019d6.png%22%20title%3D%222019d6.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EWill%20list%20down%20the%20domain%20controllers%20along%20with%20the%20IP%20address%20and%20Sites%20it%20belongs%20to.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSPAN%3EMigrate%20all%20five%20FSMO%20roles%20to%20the%20New%20domain%20controller%20using%20following%20command%2C%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CSTRONG%3EMove-ADDirectoryServerOperationMasterRole%20-Identity%20REBEL-DC2019%20-OperationMasterRole%20SchemaMaster%2C%20DomainNamingMaster%2C%20PDCEmulator%2C%20RIDMaster%2C%20InfrastructureMaster%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EIn%20above%20the%20%3CSTRONG%3EREBEL-DC2019%3C%2FSTRONG%3Eis%20domain%20controller%20running%20with%20Windows%20Server%202019.%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20841px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F71794i13B77B10C0D58D0A%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%222019d7.png%22%20title%3D%222019d7.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EOnce%20its%20completed%2C%20we%20can%20verify%20the%20new%20FSMO%20role%20holder%20using%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3ENetdom%20query%20fsmo%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20748px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F71795iCB84AEB93E45BFEE%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%222019d8.png%22%20title%3D%222019d8.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSPAN%3EThe%20new%20step%20of%20the%20process%20is%20to%20decommission%20the%20old%20windows%20domain%20controller%20which%20running%20with%20Windows%20Server%202012%20R2.%20To%20do%20that%20execute%20the%20following%20command%20as%20enterprise%20administrator%20from%20the%20relevant%20DC.%20%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EUninstall-ADDSDomainController%20-DemoteOperationMasterRole%20-RemoveApplicationPartition%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EAfter%20execute%20the%20command%20it%20will%20ask%20to%20define%20password%20for%20the%20local%20administrator%20account.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20862px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F71796i16AA9022ED2F6EA0%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%222019d9.png%22%20title%3D%222019d9.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EOnce%20its%20completed%20it%20will%20be%20a%20member%20server%20of%20the%20%3CSTRONG%3Erebeladmin.com%3C%2FSTRONG%3Edomain.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSPAN%3ENext%20step%20is%20to%20raise%20the%20domain%20and%20forest%20functional%20level%20to%20windows%20server%202019.%20To%20do%20that%20can%20use%20the%20following%20commands.%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3ETo%20upgrade%20domain%20functional%20levels%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3ESet-ADDomainMode%20%E2%80%93identity%20therebeladmin.com%20-DomainMode%20Windows2016Domain%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20To%20upgrade%20forest%20function%20levels%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3ESet-ADForestMode%20-Identity%20therebeladmin.com%20-ForestMode%20Windows2016Forest%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20834px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F71797iAB237B62A013550E%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%222019d10.png%22%20title%3D%222019d10.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%3CSTRONG%3ENote%3C%2FSTRONG%3E%E2%80%93%20With%20Windows%20Server%202019%2C%20there%20is%20no%20domain%20or%20forest%20functional%20level%20called%20windows2019.%20It%20is%20still%202016.%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3ENow%20we%20have%20completed%20the%20migration%20from%20AD%20DS%202012R2%20to%20AD%20DS%202019.%20Same%20steps%20apply%20when%20migrate%20from%20windows%20server%202008%2C%20Windows%20server%202008%20R2%2C%20Windows%20server%202012%20%26amp%3B%20Windows%20server%202016.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSPAN%3EAfter%20the%20migration%20completes%2C%20we%20still%20need%20to%20verify%20if%20its%20completes%20successfully.%20%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CSTRONG%3E%26nbsp%3BGet-ADDomain%20%7C%20fl%20Name%2CDomainMode%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EThis%20command%20will%20show%20the%20current%20Domain%20functional%20level%20of%20the%20domain%20after%20the%20migration.%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EGet-ADForest%20%7C%20fl%20Name%2CForestMode%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EAbove%20command%20will%20show%20the%20current%20forest%20functional%20level%20of%20the%20domain.%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20760px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F71798i5A52464730577D4F%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%222019d11.png%22%20title%3D%222019d11.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-329861%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%3EWindows%20Server%202019%20was%20available%20for%20public%20(GA)%20from%20early%20October%202018.%20In%20past%20i%20have%20written%20many%20articles%20about%20domain%20migrations%20by%20covering%20different%20Active%20Directory%20versions.%20So%2C%20it%20is%20time%20me%20to%20write%20about%20AD%202019%20migrations.%20In%20this%20demo%20I%20am%20going%20to%20demonstrate%20how%20to%20migrate%20from%20Active%20Directory%202012%20R2%20to%20Active%20Directory%202019.%20The%20same%20procedure%20is%20going%20to%20apply%20for%20any%20AD%20version%20from%20Windows%20Server%202008.%26nbsp%3B%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20688px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F71787iDD3F6B3280ABBC77%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22AD.png%22%20title%3D%22AD.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-329861%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EDishan%20Francis%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EWindows%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EWindows%20Server%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-779893%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20Migrate%20Active%20Directory%20from%20Windows%20Server%202012%20R2%20to%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-779893%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%3EInteresting%20exercise%20too.%20Here%20at%20the%20company%20we%20are%20adopting%20the%20poweshell%20cmdlets%20to%20perform%20daily%20activities%20and%20it%20is%20very%20nice%20to%20see%20them%20doing%20advanced%20activities%20like%20this%20%3A)%3C%2Fimg%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-780598%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20Migrate%20Active%20Directory%20from%20Windows%20Server%202012%20R2%20to%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-780598%22%20slang%3D%22en-US%22%3E%3CP%3ENeed%20to%20ensure%20you%20have%20migrated%20your%20FRS%20replication%20to%20DFS-R%20replication%20as%20well%20otherwise%20you%20will%20get%20an%20error%20when%20promoting%20the%202019%20Server%20to%20a%20DC....%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-787340%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20Migrate%20Active%20Directory%20from%20Windows%20Server%202012%20R2%20to%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-787340%22%20slang%3D%22en-US%22%3E%3CP%3EInteresting%20how%20you%20did%20all%20of%20this%20in%20PowerShell%20but%20didn't%20use%20PowerShell%20cmdlets%20for%20finding%20the%26nbsp%3BOperations%20Master%20roles.%20It%20obviously%20works%2C%20but%20for%20consistency%2Fmodern%20scripting%20purposes%2C%20you%20may%20want%20to%20use%20the%20following%202%20cmdlets%20to%20replace%20%22netdom%20query%20fsmo%22%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%3EGet-ADForest%20%7C%20select%20SchemaMaster%2CDomainNamingMaster%20%7C%20fl%3B%20Get-ADDomain%20%7C%20select%20PDCEmulator%2CRIDMaster%2CInfrastructureMaster%20%7C%20fl%3C%2FPRE%3E%3CP%3EGreat%20post%2C%20%3CSPAN%3EDishan%3C%2FSPAN%3E.%20Thanks%20for%20sharing!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1063395%22%20slang%3D%22en-US%22%3ERe%3A%20How%20to%20Migrate%20Active%20Directory%20from%20Windows%20Server%202012%20R2%20to%202019%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1063395%22%20slang%3D%22en-US%22%3E%3CP%3ECNG-DRP%20that%20is%20the%20problem%20that%20I%20ran%20into.%26nbsp%3B%20I%20currently%20have%20my%20Domain%20controllers%20in%202012%20r2.%20I%20have%20demoted%20one%20of%20the%20servers%20but%20I'm%20afraid%20by%20migrating%20the%20FRS%20to%20DFS-R%20will%20cause%20a%20problem%20between%20my%20old%20domain%20controllers%20replicating.%26nbsp%3B%20Do%20you%20know%20if%20DFS-R%20replication%20works%20on%20server%202012%20r2%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E
Senior Member

Windows Server 2019 was available for public (GA) from early October 2018. In past I have written many articles about domain migrations by covering different Active Directory versions. So, it is time me to write about AD 2019 migrations. In this demo I am going to demonstrate how to migrate from Active Directory 2012 R2 to Active Directory 2019. The same procedure is going to apply for any AD version from Windows Server 2008.  

 

Migration itself is very straight forward task, however, there are other things you need to consider before you do an AD migration. I have listed a checklist below you can use in many occasions.

 

  • Evaluate business requirement for active directory migration
  • Perform Audit on Existing Active Directory Infrastructure
  • Provide Plan for implementation Process
  • Prepare Physical / Virtual resources for Domain Controller
  • Install Windows server 2019 Standard / Datacenter
  • Patch Servers with latest Windows Updates
  • Assign Dedicate IP address to Domain Controller
  • Install AD DS Role
  • Migrate Application and Server Roles from the Existing Domain Controllers.
  • Migrate FSMO roles to new Domain Controllers
  • Add New Domain controllers to the Existing Monitoring system
  • Add New Domain controllers to the Existing DR Solution
  • Decommission old domain controllers
  • Raise the Domain and Forest Functional level
  • On Going Maintenance

AD.png

As per the above figure therebeladmin.com domain has two domain controllers.  In here, the FSMO role holder is running windows server 2012 R2. Domain and forest functional level currently operating at Windows server 2012 R2. A new domain controller with Windows server 2019 will be introduce and it will be the new FSMO role holder for the domain. once FSMO role migration completed, Domain controller running windows server 2012 R2 will be decommissioned. After that forest and domain function level will raised to the windows server 2019.

 

In the demonstration, REBEL-DC2012 is the domain controller with windows server 2012 R2 and REBEL-DC2016 is the domain controller with windows server 2019.

 

Note – When you introduce new domain controllers to the existing infrastructure it is recommended to introduce to the forest root level first and then go to the domain tree levels.

 

2019d1.png

  • Log in to the Server 2019 as a member of local administrators group.
  • Add server to the existing domain as member

2019d2.png

 

  • After restart, log in to the server as Enterprise Administrator
  • Assign static IP address to the server
  • Launch the PowerShell Console as an Administrator
  • Before the configuration process, we need to install the AD DS Role in the given server. In order to do that we can use Following command.

Install-WindowsFeature –Name AD-Domain-Services -IncludeManagementTools

 

2019d3.png

  • Configure the new server as additional domain controller.

 Install-ADDSDomainController

-CreateDnsDelegation:$false

-NoGlobalCatalog:$true

-InstallDns:$true

-DomainName "therebeladmin.com"

-SiteName "Default-First-Site-Name"

-ReplicationSourceDC "REBEL-DC2012.therebeladmin.com"

-DatabasePath "C:\Windows\NTDS"

-LogPath "C:\Windows\NTDS"

-NoRebootOnCompletion:$true

-SysvolPath "C:\Windows\SYSVOL"

-Force:$true

 

2019d4.png 

There are no line breaks for the command and I have listed it as above to allow readers to identify on the parameters clearly.

 

Argument

Description

Install-ADDSDomainController

This cmdlet will install the domain controller in active directory infrastructure.

-NoGlobalCatalog

If you do not need to create the domain controller as global catalog server, this parameter can use. By default, system will enable global catalog feature.

-SiteName

This Parameter can use to define the active directory site name.  the default value is Default-First-Site-Name

-DomainName

This parameter defines the FQDN for the active directory domain.

-ReplicationSourceDC

Using this parameter can define the active directory replication source. By default, it will use any available domain controller. But if need we can be specific.

 

Once execute the command it will ask for SafeModeAdministrator Password. Please use complex password to proceed. This will be used for DSRM.

 

  • After configuration completed, restart the system and log back in as administrator to check the AD DS status.

Get-Service adws,kdc,netlogon,dns

 

2019d5.png

 

Will confirm the status of the AD DS service.

 

Get-ADDomainController -Filter * |  Format-Table Name, IPv4Address, Site

 

2019d6.png

 

Will list down the domain controllers along with the IP address and Sites it belongs to.

 

  • Migrate all five FSMO roles to the New domain controller using following command,

Move-ADDirectoryServerOperationMasterRole -Identity REBEL-DC2019 -OperationMasterRole SchemaMaster, DomainNamingMaster, PDCEmulator, RIDMaster, InfrastructureMaster

 

In above the REBEL-DC2019 is domain controller running with Windows Server 2019.

 

2019d7.png

 

Once its completed, we can verify the new FSMO role holder using

 

Netdom query fsmo

 

2019d8.png

 

  • The new step of the process is to decommission the old windows domain controller which running with Windows Server 2012 R2. To do that execute the following command as enterprise administrator from the relevant DC.

 

Uninstall-ADDSDomainController -DemoteOperationMasterRole -RemoveApplicationPartition

 

After execute the command it will ask to define password for the local administrator account.

 

2019d9.png

Once its completed it will be a member server of the rebeladmin.com domain.

 

  • Next step is to raise the domain and forest functional level to windows server 2019. To do that can use the following commands.

 

To upgrade domain functional levels

 

Set-ADDomainMode –identity therebeladmin.com -DomainMode Windows2016Domain

 

                To upgrade forest function levels

 

Set-ADForestMode -Identity therebeladmin.com -ForestMode Windows2016Forest

 

2019d10.png

Note – With Windows Server 2019, there is no domain or forest functional level called windows2019. It is still 2016.

Now we have completed the migration from AD DS 2012R2 to AD DS 2019. Same steps apply when migrate from windows server 2008, Windows server 2008 R2, Windows server 2012 & Windows server 2016.

  • After the migration completes, we still need to verify if its completes successfully.

 Get-ADDomain | fl Name,DomainMode

 

This command will show the current Domain functional level of the domain after the migration.

 

Get-ADForest | fl Name,ForestMode

 

Above command will show the current forest functional level of the domain.

 

2019d11.png

4 Comments
Senior Member

Interesting exercise too. Here at the company we are adopting the poweshell cmdlets to perform daily activities and it is very nice to see them doing advanced activities like this :)

Occasional Visitor

Need to ensure you have migrated your FRS replication to DFS-R replication as well otherwise you will get an error when promoting the 2019 Server to a DC....

Senior Member

Interesting how you did all of this in PowerShell but didn't use PowerShell cmdlets for finding the Operations Master roles. It obviously works, but for consistency/modern scripting purposes, you may want to use the following 2 cmdlets to replace "netdom query fsmo":

 

Get-ADForest | select SchemaMaster,DomainNamingMaster | fl; Get-ADDomain | select PDCEmulator,RIDMaster,InfrastructureMaster | fl

Great post, Dishan. Thanks for sharing!

Occasional Visitor

CNG-DRP that is the problem that I ran into.  I currently have my Domain controllers in 2012 r2. I have demoted one of the servers but I'm afraid by migrating the FRS to DFS-R will cause a problem between my old domain controllers replicating.  Do you know if DFS-R replication works on server 2012 r2?