Moving FSMO roles to a new server.

[Fraser-09]

Hello,

 

I'm looking for a bit of advice.

 

I have 14 Domain Controllers over 14 sites (1 DC in each site). I have now purchased a 15^th DC to replace the PDC in the first site so I now need to transfer the FSMO roles over from the old DC to the new DC.

 

The new 15^th server has been promoted to a Domain Controller and it’s in the same site at the current FSMO server. My DCs are a mix of Server 2008 r2, 2012 and 2012 r2. The FSMO roles are currently on 2008 r2 and moving to 2012 r2. I have looked online and read various guides and the whole process looks fairly straight forward. When I come to do it, I think I will follow this one: http://www.techieshelp.com/how-to-transfer-fsmo-roles-graphical-and-command-line/

 

My questions to you are:

• Are there any gotchya’s or things to look out when attempting this?
  
• Is there anything I should do or check before attempting to move the FSMO roles to the new server?
  
• How long does it take for the updated FSMO server to be replicated to the DCs in other sites?
  
• Once all 5 roles have been moved, am I safe to demote the old DC and remove it from the network altogether?
  

 

Sorry for the basic questions but I have never done this procedure before so it worries me that something could go wrong and I would need to seize the roles back which (by the looks of it) is a long dark windy road I've never been down and nor ever want to!

 

Thank you,

Fraser.

Edited June 1, 2016 by Fraser-09

[3s-gtech]

Some things to consider, though it's not a bad job really. Once the new DC is in, give it plenty of time to replicate. Check that DNS is resolving nicely, that the sysvol is replicating (whack a file in there to check) and use the built in tools to check, like dcdiag. It isn't too scary - I've done it a few times only over ten years though (2003 - 2008 - 2008 R2 - 2012 R2). Got easier with newer versions.

[XiJ]

I tend to use this one:

 

https://blogs.technet.microsoft.com/canitpro/2014/04/01/step-by-step-active-directory-migration-from-windows-server-2003-to-windows-server-2012-r2/

 

 

But as above - name sure DNS us fully functioning first.

 

I frequently seem to have an issue with replication after transferring the roles. Normally end up with a non-authoritive restore at least. Make sure you backup netlogon / sysvol if you do that.

[Fraser-09]

Hi,

 

Thanks for the replies. I have ran dcdiag /e on the PDC and all seems good except for the following:

 

Starting test: FrsEvent
There are warning or error events within the last 24 hours after the SYSVOL has been shared.  Failing SYSVOL replication problems may cause Group Policy problems. 
......................... SERVER-1 passed test FrsEvent

and

Starting test: Services
IsmServ Service is stopped on [sERVER-1]
......................... SERVER-1 failed test Services

 

I have started the IsmServ service and reran dcdiag /e and the second error has cleared.

 

 

Regarding the FRS error, I have checked the event viewer and found the following 2 warning:

 

The File Replication Service is having trouble enabling replication from SERVER-2 to SERVER-1 for c:\windows\sysvol\domain using the DNS name SERVER-2.Domain.local. FRS will keep retrying. 
Following are some of the reasons you would see this warning. 

[1] FRS can not correctly resolve the DNS name SERVER-2.Domain.local from this computer. 
[2] FRS is not running on SERVER-2.Domain.local. 
[3] The topology information in the Active Directory Domain Services for this replica has not yet replicated to all the Domain Controllers. 

This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.

 

and

 

The File Replication Service has enabled replication from SERVER-2 to SERVER-1 for c:\windows\sysvol\domain after repeated retries.

 

SERVER-1 is my PDC. The DNS server defined for each Domain Controller is its itself.

 

It seems that these warnings appear once per day. I can confirm that if I put a file in NETLOGON on SERVER-2, it does replicate to SERVER-1 and vise versa.

 

I can also confirm that both SERVER-1 and SERVER-2 can successfully resolve and ping each other.

 

I have 3 DCs which replicate to SERVER-2 and all 3 DCs show the same 2 entries about SERVER-2 in their event logs so I suspect the problem lies with SERVER-2.

 

However, what I did notice which I think may be the root of the problem, when SERVER-2 resolves it's self, it resolves to the IPv6 loopback address of ::1, rather than its IPv4 address. I have disabled IPv4 in the properties of the NIC but I believe I need to create the DisabledComponents Registry key as described here to completely disable IPv6 as loopback doesnt use the network card.

 

Ideally, I'd like to get this resolved before I attempt to move the FSMO roles.

 

Any advice on how to proceed would be greatly appreciated.

 

Thanks,

fraser.

[3s-gtech]

I always set the primary DNS address of my DCs (which run DNS too) to the address of another DNS server, but that shouldn't really matter here. It's been a while, but is your sysvol defintely using FRS to replicate rather than DFS-R? If so, I would get that changed first - FRS is not as good.

[DavePa]

A little late to be of use in this instance but useful tool for checking replication status is Microsoft's active directory replication status tool which is a free download from Microsoft.

[Fraser-09]

Ok so I ran dfsrmig /getglobalstate on SERVER-2 and it spat back:

The current domain functional level is not Windows Server 2008 or above.
DFSRMig is only supported on Windows Server 2008 or above level domains.

 

It would seem this is escalating into a much bigger job than I intended! Am I right on thinking I need to update my domain Schema - If so can you point me in the right direction on how to do this? It's been a while since I've done this.

 

I use DSF-R to replicate various folders between my DCs so I suspect its just NETLOGON and SYSVOL using FRS

 

Thanks

[3s-gtech]

Raise the functional level next. It's extremely easy - one click. Extra click if you have a root forest. Then change FRS to DFS-R for the sysvol/netlogon -four step process which doesn't take long. It's extra work, but by going through it and keeping everything up to date it should keep your domain working nicely. My Windows domain is just coming up 15 years old, never been rebuilt because the tools available keep it working nicely.

[Fraser-09]

Thanks,

 

Got the domain level updated and currently on stage 2 of the FRS to DFS-R migration. I guess migrating to DFS-R for Netlogon/sysvol will fix my FRS issue with that branch server

 

Fraser.

 

Edit: Stage 3 now - No going back now!

Edited June 2, 2016 by Fraser-09

[Fraser-09]

Stage 3 Complete.

 

Will attempt to move FSMO roles over to the new server over the weekend. Do the roles need to be moved in any particular order?

 

Thanks,

[Fraser-09]

Hi all,

 

Sorry for the late reply. I got the FSMO role migrated over without a hitch! The new DC is has now been physically moved to the new site and everything seems to be working well.

 

Thanks for all the help.

Fraser.