2

I currently have 2 domain controllers (pdc and sdc) on Windows Server 2008. Domain and Forest levels are both 2008. Both are global catalog servers and are DNS servers. The server pdc is also my DHCP server and has all my FSMO roles.

Last night I promoted a new domain controller (also Server 2008). It is also a global catalog server. I want this new domain controller (called DC-Primary) to be my primary domain controller, have the DNS and DHCP role, with the current DNS/DHCP settings and database moved to this new server. Once it has the DNS role and DNS is moved from pdc I want to change the IP address of DC-Primary to match that of pdc. This is so my clients that have their DNS pointing to pdc won't need the DNS ip address updated.

It's been about 10 years since I've had to do this, so I just want to make sure I do this properly. I know I need to transfer roles but I want to make sure I do everything in the proper order. End goal is to remove pdc as a domain controller all together and shut it down. This of course after moving FSMO, DNS and DHCP to the DC-Primary server.

I've been reading a lot and it seems lots of people have different ideas as to how to do this. Thank you!

|improve this question
2

You can transfer FSMO roles in any order. You don't have to migrate DNS if it's Active Directory integrated, that happens automatically. All three DCs will be DNS servers with authority over the zone.

You can configure DHCP on the new DC any time but leave the zone(s) disabled. When you're ready, deactivate the zone on the outgoing DC and activate it on the new one. Make sure if you have any DHCP relay agents on the network that they are updated with the IP address of the new DC.

Once you're done with the old DC (i.e., DHCP and all FSMO roles migrated), uninstall AD services and DNS from it, remove it from the domain, and decommission it. Then you might merely add its IP address to your new DC's interface rather than change the new DC's IP. A Windows server can have more than one IP configured on a single interface.

|improve this answer
  • Excellent point in the right direction. Thank you! Would it be ok to transfer the fsmo role during the day during production? I seem to remember it being pretty seamless. – drpcken Nov 20 '17 at 14:46
  • @drpcken Yes. FSMO roles are usually only used when they are needed, which is infrequently. For example, the RID Master pretty much only does something when a new RID has to be generated. The PDC Advertiser is probably the most "busy" role. Remember, you can seize FSMO roles if the holder of any roles crashes and can't be recovered. The one thing that could get you totally caught out is that when a DC boots, it may need to contact a PDC advertiser sometimes to start AD services. If you lose your PDC advertiser for too long and reboot all DCs, you could lose the domain. Never seen that happen. – Todd Wilcox Nov 20 '17 at 14:49
  • 1
    @drpcken You can't transfer a role to or from a DC that is not up and running. And I guess I wasn't clear that yes you can transfer all the roles in the middle of the day and no one will ever know. What you don't want to do is transfer roles at the same time another admin is installing AD services on a new DC. I doubt that's a risk for you. – Todd Wilcox Nov 20 '17 at 14:53
  • 1
    Yes you can decommission the old DC without doing anything more to DNS. Make sure you uninstall the AD services and DNS and remove it from the domain. I strongly suggest you do not change the IP of the new DC. Instead, add the IP address of the old DC to the new DC, so the new DC will have two IP addresses. – Todd Wilcox Nov 20 '17 at 18:10
  • 1
    @drpcken %logonserver% is not a setting. It's a read-only environment variable set when the user logs on. You don't have to pay attention to it at all. – Todd Wilcox Nov 20 '17 at 19:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.