I have just purchased a new server that will be the new primary domain controller. I was wondering if anyone knew any articles or tutorials on how to do this change over? I would imagine it is just simply setting up the role and importing a backup of the Active Directory from the old domain controller. I just want to make sure I'm not missing any crucial tasks in between.

  • 1
    I am certain this is already covered by existing questions, but I not finding a good one to mark as duplicate. – Zoredache Dec 9 '11 at 19:45
  • 3
    There is no such thing as a "Primary Domain Controller" any more. That went away with NT4. – MDMarra Dec 9 '11 at 19:48
  • 2
    @SpacemanSpiff I agree. That doesn't change the fact that people still say PDC and BDC like they're real things. A DC holding the PDC Emulator role is entirely different than what an NT4 PDC was. – MDMarra Dec 9 '11 at 19:51
  • 2
    @MarkM: That doesn't change the fact that you can't demote a DC with the PDC emulator role. And if it goes down, you'll end up having to seize the role. – surfasb Dec 9 '11 at 20:09
  • 1
    @surfasb newer versions of dcpromo will move the FSMO roles automatically off the server you're demoting. Older versions would just error out complaining of the fact. – Chris S Dec 9 '11 at 20:21
  • Add new computer to domain
  • Promote system to a domain controller (dcpromo)
  • Transfer FSMO roles
  • Verify/Make the new system a Global Catalog.
  • Wait some time for replication to take place. Run dcdiag/repadmin and so on to make sure everything transferred
  • Demote old system (dcpromo)
  • Double check DNS zones & AD to make sure old system was removed.

Migrate any other data or services as needed.

Of course you could leave the old system up so you have another spare DC.

  • What about having multiple global catalogs? – Tim Brigham Dec 9 '11 at 19:53
  • @timbrigham, sorry, I am not sure I understand what you are asking. – Zoredache Dec 9 '11 at 19:56
  • 1
    @TheCompWiz: I believe that's only the case in a multiple domain forest but isn't applicable in a single domain forest. I believe that the MS best practice for a single domain forest is for all DC's to also be GC's. – joeqwerty Dec 9 '11 at 20:12
  • 7
    @TheCompWiz, technet.microsoft.com/en-us/library/cc732877(WS.10).aspx - In a single-domain forest, configure all domain controllers as global catalog servers. Because every domain controller stores the only domain directory partition in the forest, configuring each domain controller as a global catalog server does not require any additional disk space usage, CPU usage, or replication traffic. – Zoredache Dec 9 '11 at 20:13
  • 1
    @all. I stand 100% corrected... severely... and repeatedly. I honestly remember reading a technet article a while ago (5+ years ago maybe?) that cautioned against having multiple GCs in the same subnet/domain... but thanks for the correction. – TheCompWiz Dec 9 '11 at 21:24

In addition to what Zoredache stated in his answer, make sure to update all of the domain clients to use the new DC for DNS.

On a side note, if the original DC you're replacing is the only DC in the domain, then running DCPROMO on the original DC will transfer the FSMO roles to the new DC without the need to manually transfer them. If it's not the only DC in the domain, then DCPROMO will transfer the FSMO roles to another DC, I'm just not sure how it selects the DC to assume the roles.

  • 1
    to be sure... I'd still suggest moving the FSMO + GC roles manually and verify they've been completed rather than relying on dcpromo to transfer the roles. dcpromo silently fails quite often and does a very poor job of documenting those failures. – TheCompWiz Dec 9 '11 at 20:08
  • 2
    @TheCompWiz Could you elaborate on a time when you had dcpromo silently fail? I've never once had it leave AD in any obscure state. I've had plenty of times where it refuses to actually do anything because something I fed it was garbage... – Chris S Dec 9 '11 at 20:19
  • @ChrisS I would... but this is neither the time/place to do such. – TheCompWiz Dec 9 '11 at 21:18

Something that I didn't see anyone else mention is time services. Your PDC is presumably the primary time keeper for the domain...that role/config should be redone on the new PDC.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.