Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a win2k3 stnd dc/ dns as a vm server (1.0). I recently upgraded to Vsphere4 and want to move the dc to a new vm on our new ESX host. I've read that converting a dc vm is not the best idea and I should just create a new vm, dcpromo and replicate AD on the new server. I posted the plagarized solution below.

My question, besides checking on the solution, is how do I promote the new dc vm to be the primary dc? (after I shut down the old dc vm of course). I will create a secondary dc after I get the primary up. (we have a secondary dc on vm (1.0) now)

I want to make sure that users won't lose connection with their data, (my docs are redirected)


From earlier EE post ~2007:

Assign the new computer an IP address and subnet mask on the existing network Make sure that the preferred DNS server on new machine points to the existing DNS Server on the Domain (normally the existing domain controller)

Join the new machine to the existing domain as a member server

From the command line promote the new machine to a domain controller with the DCPROMO command from the command line Select Additional Domain Controller in an existing Domain

Once Active Directory is installed then to make the new machine a global catalog server, go to Administrative Tools, Active Directory Sites and Services, Expand ,Sites, Default first site and Servers. Right click on the new server and select properties and tick the Global Catalog checkbox. (Global catalog is essential for logon as it needs to be queried to establish Universal Group Membership)

Assuming that you were using Active Directory Integrated DNS on the first Domain Controller, DNS will have replicated to the new domain controller along with Active Directory.

If you are using DHCP you should spread this across the domain controllers, In a simple single domain this is easiest done by Setting up DHCP on the second Domain controller and using a scope on the same network that does not overlap with the existing scope on the other Domain Controller. Dont forget to set the default gateway (router) and DNS Servers. Talking of which all the clients (and the domain controllers themselves) need to have their Preferred DNS server set to one domain controller, and the Alternate DNS to the other, that way if one of the DNS Servers fails, the clients will automatically use the other,

Both Domain Controllers by this point will have Active Directory, Global Catalog, DNS and DHCP. and the domain could function for a while at least should any one of them fail. However for a fully robust system you need to be aware that the first domain controller that existed will by default hold what are called FSMO Roles. There are five of these roles that are held on a single server and are essential for the functioning of the network. If the second Domain Controller fails, then no problem as the FSMO roles are on the first Domain Controller. In an SBS domain the FSMO roles MUST remain on the SBS server.

share|improve this question

1 Answer 1

First: AFAIK there's no problem converting a VMware Server 1.0 VM into an ESX VM. I'd just do that, if you can.

There is no "primary DC" in Active Directory. There are five "flexible single master" roles that are held by domain controllers in a single-domain forest (which it sounds like you have). Typically in small single-domain forests these roles are all held by a single domain controller.

Microsoft has a good article here that explains the five FSMO roles and how to transfer them in Windows Server 2003: http://support.microsoft.com/kb/324801

I won't rephrase the entire article, but the gist is:

  • Transfer all the roles to another server computer
  • Use DCPROMO to demote the old domain controller back to a member server
  • Disjoin the old domain controller from the domain and delete its computer object

It's really pretty easy to do.

You mention "My Documents" redirection. If the "My Documents" folders are redirected to the server being demoted then you'll want to end up with a server having that same name and same share structure so that the user documents remain accessible, at minimum.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.