I'm in the middle of P2V'ing one of my servers which contains Safeguard (along with a couple of easily transferred bits and bobs) and a DC as the hardware is exceptionally close to failing.

Server old, donated and out of warranty etc.

I would prefer if possible to demote the server from being a DC and move the applications to a fresh VM - current server on 2008 R1 so I'd like to upgrade.

Now regarding SafeGuard from what I've read I can:

1) move the db to a new server
2) Create a new client config package
3) Run the client config MSI on an already encrypted laptop and it will start talking home to the new server - assuming it has the old db.

I'm not entirely sure if this will work, and I'm also not sure what would happen with moving the Safeguard db if the server's FQDN changes.

Hence why at short notice I'm virtualising a physical DC!