I am working on a project where we need to upgrade the OS on all our servers from 2008r2 to either 2012r2 or 2016. We have an older Domain Controller that is also running certificate services on 2008r2 which needs an OS upgrade.
My question is can we remove the Domain Controller role from the machine and do an in place upgrade to 2012r2 without adversely affecting our actively used CA?
Eventually we are looking to consolidate and re-work our PKI but for the short term I would like to just get that DC off 2008r2. Having this server be just a plain, domain joined, CA is where we want to end up.
NOTE: we already have 2012r2 DCs that have taken over FSMO roles, DNS, DHCP, etc.