Server 2016 DCs and Migration

[lmrogers]

Hey everyone,

 

Has anyone updated their Domain to Server 2016 yet? Has anyone ran into any problems so far?

 

Cheers

[Sagima]

Yes and Yes. I've done it many times but with 2016 it caused all sorts of probs.

 

KMS: Set Windows 7 to Non-genuine. Imaging, a 2012R2 KMS server and using Active Directory Activation to sort

DHCP: Stopped issuing leases, required deauthorising, uninstalling and reinstalling and reauthorising to fix

NPS: Manual service start required

Radius accounting: Stopped logging, deleted logs and restarted service

Time Server: Stopped being one - used this key to fix: reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\w32time\TimeProviders\NtpServer /v Enabled /t REG_DWORD /d 1 /f

 

They're the ones I've noticed thus far

[lmrogers]

Was that an inplace upgrade or a fresh install?

[FN-GM]

Yes and Yes. I've done it many times but with 2016 it caused all sorts of probs.

 

KMS: Set Windows 7 to Non-genuine. Imaging, a 2012R2 KMS server and using Active Directory Activation to sort

DHCP: Stopped issuing leases, required deauthorising, uninstalling and reinstalling and reauthorising to fix

NPS: Manual service start required

Radius accounting: Stopped logging, deleted logs and restarted service

Time Server: Stopped being one - used this key to fix: reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\w32time\TimeProviders\NtpServer /v Enabled /t REG_DWORD /d 1 /f

 

They're the ones I've noticed thus far

 

We have upgraded and seen none of that. To be fair we don't have Windows 7 anymore but the others haven't been an issue.

[Sagima]

In place. I never had any issues updating DCs before. Has put me off in-plcae-updating anything to 2016 though.

[FN-GM]

I never do in-place upgrades. All my upgrades where clean installations.

[lmrogers]

I never do in-place upgrades. All my upgrades where clean installations.

Did you move the AD roles to a secondary ad and promote that then do a fresh upgrade and move all the ad roles back over?

[FN-GM]

Did you move the AD roles to a secondary ad and promote that then do a fresh upgrade and move all the ad roles back over?

 

I have more than one DC. I moved any roles the old one had to an existing DC. Demoted the old one, created a new VM and prompted the new one.

[lmrogers]

Was there an easy step by step guide for that anywhere?

[ITGURU]

I never do in-place upgrades. All my upgrades where clean installations.

 

Same, every time I upgrade server OS it is ALWAYS a clean install and migrate services over. If I were to be doing this I would add a 2016 server as an additional domain controller, check DNS etc syncing, then point 1 PC to it to check all DNS etc is working before adding to the DHCP DNS list.

 

Backups, Planning etc are all part of every major change.

[FN-GM]

Same, every time I upgrade server OS it is ALWAYS a clean install and migrate services over. If I were to be doing this I would add a 2016 server as an additional domain controller, check DNS etc syncing, then point 1 PC to it to check all DNS etc is working before adding to the DHCP DNS list.

 

Backups, Planning etc are all part of every major change.

 

A key thing is not to rush it. Something I am not good at and need to hold myself back!

[lmrogers]

So at the minute, I have a physical DC and 2 virtuals, would you suggest making a new virtual with 2016, promoting that up to PDC and then doing clean installs on the others, then lastly making either one of the virtuals or the physical the PDC?

[Blue_Cookeh]

So at the minute, I have a physical DC and 2 virtuals, would you suggest making a new virtual with 2016, promoting that up to PDC and then doing clean installs on the others, then lastly making either one of the virtuals or the physical the PDC?

 

It doesn't matter where the PDC is, and you don't even have to have a physical DC anymore.

 

We have x2 DCs (virtual/physical). I installed a new Server 2016 Core virtual machine, promoted that up to a DC, got it to replicate all our DFS shares, migrated DHCP over one evening (you need to backup and restore the DHCP database, plenty of guides through Google) and changed the DNS to the new IP, left it running for a few days, then demoted and deleted the old 2012 DC.

 

Worked a charm and not seen any issues.

[mtillbrook]

great feedback guys - I'm conscious of the usual "wait for the first service pack" thing - what are people opinions on this - is it still a relevant point or have we finally moved on past that?

I'll be interested to hear what people think!

[FN-GM]

great feedback guys - I'm conscious of the usual "wait for the first service pack" thing - what are people opinions on this - is it still a relevant point or have we finally moved on past that?

I'll be interested to hear what people think!

 

Well there isn't going to be a service pack so you would be waiting a while

[Davit2005]

I even give it 24+ hours and check replication, dcdiag, etc before demoting old DC's.

 

Done a few now and always create new DC's, the one time I done an in place upgrade (at home) I eventually had issues.

 

It is simple enough if you have resources jus to do one at a time and create additional DC's one by one not demoting any till you have enough in place. Once all done make sure the DC with the PDC emulator FSMO role is pointing to a suitable time source there is a best practice guidance from Microsoft explaining where the certain FSMO roles should be placed.

 

https://support.microsoft.com/en-gb/kb/223346

Edited November 15, 2016 by Davit2005

[mtillbrook]

Well there isn't going to be a service pack so you would be waiting a while

 

yer, yer - good point but you know what i mean

[lmrogers]

So I have installed a new virtual DC and promoted it and everything. I can connect to it with RSAT and see AD Users and computers just fine, in server manager though it says that it still needs promoting. Could this just be a case of waiting a day or so to ensure replication is all complete?

[mtillbrook]

So I have installed a new virtual DC and promoted it and everything. I can connect to it with RSAT and see AD Users and computers just fine, in server manager though it says that it still needs promoting. Could this just be a case of waiting a day or so to ensure replication is all complete?

 

Ok, maybe a silly question but have you refreshed server manager?

[lmrogers]

Yeah, I've refreshed server manager and rebooted the server, still coming up though. When click on promote I get the following message.

 

"Error determining whether the target server is already a domain controller: The target server is already a Domain Controller"

[lmrogers]

Its alright, it literally is not coming up now.

[lmrogers]

Has anyone got experience in migrating a DHCP split scope from servers over to one server?

[FN-GM]

Has anyone got experience in migrating a DHCP split scope from servers over to one server?

 

I use the newer (and better ) fail-over and it works fine.

[lmrogers]

That's what I want to do but when I started working here it was setup as a split scope so was just wondering if anyone has any experience of migrating from split scope as I've never done it.

[lmrogers]

I just demoted one of the existing DCs after setting up another DC. All replication seemed to have happened. Once the old DC was demoted though it seemed to cause a lot of DNS issues. Promoting the server again resolved the issues. I can't find where the problem is though. Has anyone else had these kind of issues before? Thanks,