Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to move my old hosting setup (multiple servers in a domain) to a new more robust environment.

what is the best way to move my existing domain controller (Windows Server 2008 Standard SP1) to the new server (Windows Server 2008 R2)?

The 2 environments can't talk to each other.

share|improve this question
up vote 0 down vote accepted

You can move the user accounts using a numnber of import and export tools ( see Step-by-Step Guide to Bulk Import and Export to Active Directory, Import or export directory objects using csvde, and Using LDIFDE to export users from Active Directory )

That being said I would probably combine full import with creating new by creating a new AD forest and import the users only after adding the computers to the new domain. You will have to re-permission. Depending on the number of accounts and servers ignoring the old domain and rebuilding might be simpler.

Another approach I've used is to use a temporary server. In a nutshell:

  1. add the new server to the existing old domain as a DC and replicate
  2. verify successful replication and shut down the server
  3. create a new forest
  4. spin up the "old" DC, sieze the roles and verify IP connectivity to the new DCs
  5. create a cross forest trust and follows the steps required to migrate the interforest accounts using the ADMT. See ADMT Guide: Migrating and Restructuring Active Directory Domains
share|improve this answer
the problem here is that the new setup can't talk to the old setup, so I can join the new server to the domain :-( – Maniac13 Jul 29 '10 at 5:10
I'll look into your advice to Bulk Import/Export the users - thanks – Maniac13 Jul 29 '10 at 5:11

Can you just pick up the old servers and move them to the new facility? Then build a new 2008 R2 server, made it a DC, move the FIZMO roles to it, and remove the old machine.

If the sites have no way to talk to each other it'll be very tough to do. You'll be better off just building up a new domain and creating new accounts.

share|improve this answer

Can the systems not communicate at all, or is it just that between hosting providers the normal Windows/AD ports are not open? If the latter, depending on exactly what is allowed it may be possible to set up a IPSec policy between them using a pre-shared key to allow secure full communication and promoting the new machine and then demoting the old after all services are moved. This would have the advantage of being a real-time sync throughout the migration.

Alternatively, moving a domain controller between sites could work (although will probably mean ntdsutil cleanup). Virtual machines can be useful for copying/splitting off a copy of a domain, although there are good reasons why Microsoft says to not use snapshots and it's best not to ignore that advice unless you completely understand the implications.

share|improve this answer
I will get in contact with the hosting provider, but I am pretty sure IPSec won't be possible. The original server is a physical box and the new server is a virtual box. is there a manual way of exporting/importing an AD? – Maniac13 Jul 29 '10 at 5:09
See Jim B's answer for export/import options. Unfortunately for this purpose an export/import won't retain password data. His mentions of the "temporary server" could also be a virtual one if you have that option. If you really have no connectivity and want an exact copy on the new side, using a system state backup from the old system and then treating the new one like a disaster recovery restore from that backup may be a good option. – Jeremy M Jul 29 '10 at 5:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.