At work, we wanted to migrate our domain controller to an azure VM.

Azure AD and Azure AD DS doesn't fulfill our needs. Like GPO etc..

Well, let's say : I had 3 windows clients : CL1 (win10), CL2(win10), CL3(win7) and my domain controllers are : OnPremDC - ip : || AzureDC - ip :

What I did first was to join CL1,CL2,CL3 to OnPremDC, so I changed the DNS settings manually of each client to ==> No surprise, everything worked.

After that, for the migration : I configured a VPN S2S connection between OnPremDC and the Azure vNET, I joined AzureDC to the local domain, promoted it to domain controller, installed DNS server, File server and what is necessary.

Now what I want to do : is to decommission OnPremDC but before doing that I need to be sure that local clients (CL1 - CL2 - CL3) are pointing towards my DC on AZURE.

The thing is that when I connect to the client, I can't ping the AzureDC :

Ping doesn't work on the clients, but on the OnPremDC I can.

So my question is : how can I connect my on-prem clients to the AzureDC ?

And AFTER IT IS DONE, How can I change the DNS servers for all my clients at once and make it : instead of ?

Thanks in advance for your answers !

  • 1
    Ping isn't an Active Directory testing tool. Can the clients reach the DNS server on the Azure DC? Test it by running nslookup in interactive mode on a client and specify the Azure DC as the server to use (server x.x.x.x). As for how to change the clients to use the Azure DC you need to configure the clients primary DNS server as the Azure DC. – joeqwerty Jun 16 at 15:06
  • 1
    As an aside, you're introducing a dependency that may not be appropriate or desired. If you decommission your on premises DC then you're completely dependent upon the Azure DC being available to your domain clients. That means your internet connection needs to be up and the S2S connection needs to be connected at all times. – joeqwerty Jun 16 at 15:11

ICMP traffic is blocked by default by Azure network security groups, so ping won't work unless you enable it. That said, it's not a good test of AD connectivity anyway.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.