I don't have any proper training in Active Directory (rather I just fumble around and manage this network part time relying on experts in places such as this site), so I apologize in advance if these are really fundamentally silly questions. In other words, treat me like I'm 5. :)


I want to migrate away from a DC (DC1) because its old hardware and likely to fail on me to DC2.

In my domain I have:

-DC1: Win 2008R2, Active Directory domain Services role, DNS Role. Global Catalog and all 5 FSMO roles. Not a VM, its a hard box. DC1 has been the first DC in our domain for many years.

-DC2: Win 2008R2, Active Directory domain Services role, DNS Role. Global Catalog. This is a VM on newer hardware. I promoted this VM to DC a few months ago when another DC2 had a full hardware failure.

Proposed actions:

What I think I need to do is:

"Transfer" the FSMO roles from DC1 to DC2: https://support.microsoft.com/en-us/help/255504/using-ntdsutil-exe-to-transfer-or-seize-fsmo-roles-to-a-domain-control or https://www.petri.com/transferring_fsmo_roles

Upon success, spin up a new DC #3 (a VM on different HW than DC2), promote it as a another DC alongside the current DCs. Assign Global Catalog and DNS to this new DC3.

Upon success demote DC1 and decommission the hardware, wipe the drive, etc..

Are there any steps I am missing or anything else I should consider? I think the transfer is straightforward (I have also seized roles in the past when another DC failed outright) but I feel like I am missing some steps here. I'm also not onsite but doing this remotely so I don't want to make any mistakes and make for a long day talking marketing guys through commands.



2 Answers 2


Spin up the new domain controller first, install the necessary services on on it - DNS, etc., point other servers in your environment (non DC's) to the new DC for DNS info, transfer FSMO roles to new server, ensure the new DC is the PDC, then uninstall/remove domain services from the other servers - do one at a time. Check the event viewer log files for any errors. That's a simple summary of what I would do.


Right after I posted, I saw this over on the Related panel:

things to check prior to moving all FSMO roles to a new domain controller before decommission original old domain controller

I think my question is basically a duplicate of that.

Having walked through the checklist with no errors, I then used the Ntdsutil as noted in https://support.microsoft.com/en-us/help/255504/using-ntdsutil-exe-to-transfer-or-seize-fsmo-roles-to-a-domain-control and transferred all 5 FSMO roles to DC2 without errors.

ntdsutil: roles
fsmo maintenance: connections
connect to server DC2
server connections: q
fsmo maintenance: Transfer naming master
fsmo maintenance: Transfer infrastructure master
fsmo maintenance: Transfer PDC
fsmo maintenance: Transfer RID master
fsmo maintenance: Transfer schema master

type q several times to quit.

Not the answer you're looking for? Browse other questions tagged .