Promote 2012 R2 BDC to PDC and then add server 2016 as PDC.

[Dan_ATR]

Hi chaps.

 

I used to know how to do this this years ago but I have no idea now. Please could you advice me.

 

At the moment I have two 2012 R2 servers.

 

2012 R2 Primary (PDC) => SVR-DC-01

2012 R2 Secondry (BDC) => SVR-DC-02

 

I want to change the BDC to the PDC and the PDC to the BDC so it looks like this.

 

2012 R2 Secondry (BDC) => SVR-DC-01

2012 R2 Primary (PDC) => SVR-DC-02

 

Then, I want to bin off SVR-DC-01 and create a new 2016 server.

 

2016 Secondry (BDC) => SVR-DC-01

2012 R2 Primary (PDC) => SVR-DC-02

 

Then make the 2016 server my primary. Noting I cant change the functionality level untill both are 2016.

 

2016 Primary (PDC) => SVR-DC-01

2012 R2 Secondary (BDC) => SVR-DC-02

 

Eventually both will be 2016.

 

2016 Primary (PDC) => SVR-DC-01

2016 Secondary (BDC) => SVR-DC-02

 

I know the FSMO roles need to me moved but I am lost a bit. I am sure it will all come back to me at some point. Do people still use DCPromo or is there now a new method? I found this but it looks too simple lol. https://technet.microsoft.com/en-us/library/cc816944(v=ws.10).aspx

Edited July 11, 2017 by Dan_ATR

[djm968]

DCPromo has been depreciated, have a look at these links.

 

https://social.technet.microsoft.com/wiki/contents/articles/12370.windows-server-2012-set-up-your-first-domain-controller-step-by-step.aspx

 

https://www.petri.com/promote-member-server-to-domain-controller-windows-server-2012

Edited July 11, 2017 by djm968

[Dan_ATR]

DCPromo has been depreciated, have a look at this.

 

https://social.technet.microsoft.com/wiki/contents/articles/12370.windows-server-2012-set-up-your-first-domain-controller-step-by-step.aspx

 

Yer I read that erlyer before I posted up. This is just to create a new DC and Domain Name.

 

This looks to be what I want im sure of it as I only need to transfure the FSMO roles accross which are Schema, Domain Naming, RID, PDC Emulator and Infrastructure

 

https://www.petri.com/transferring_fsmo_roles

[HPlum78]

Powershell command to do the same thing is like this Move-ADDirectoryServerOperationMasterRole -Identity "DC TO MOVE TO" -OperationMasterRole SchemaMaster,RIDMaster,InfrastructureMaster,DomainNamingMaster,PDCEmulator

 

Powershell to get FSMO role holders:-

 

Get-ADDomain | Select-Object InfrastructureMaster, RIDMaster, PDCEmulator

Get-ADForest | Select-Object DomainNamingMaster, SchemaMaster

Get-ADDomainController -Filter * |

Select-Object Name, Domain, Forest, OperationMasterRoles |

Where-Object {$_.OperationMasterRoles} |

Format-Table -AutoSize

[Dan_ATR]

Powershell command to do the same thing is like this Move-ADDirectoryServerOperationMasterRole -Identity "DC TO MOVE TO" -OperationMasterRole SchemaMaster,RIDMaster,InfrastructureMaster,DomainNamingMaster,PDCEmulator

 

Powershell to get FSMO role holders:-

 

Get-ADDomain | Select-Object InfrastructureMaster, RIDMaster, PDCEmulator

Get-ADForest | Select-Object DomainNamingMaster, SchemaMaster

Get-ADDomainController -Filter * |

Select-Object Name, Domain, Forest, OperationMasterRoles |

Where-Object {$_.OperationMasterRoles} |

Format-Table -AutoSize

 

Thanks so much. That looks better I have to say.

 

So correct me if I am wrong. First I run..

Move-ADDirectoryServerOperationMasterRole -Identity "SVR-DC-02.kinsonprimary.co.uk" -OperationMasterRole SchemaMaster,RIDMaster,InfrastructureMaster,DomainNamingMaster,PDCEmulator

 

Is the -Identity the machine name or the FQDN?

 

Then to test and check all is well I then do the following... or do I need to run the below in conjunction with the above?

 

Get-ADDomain | Select-Object InfrastructureMaster, RIDMaster, PDCEmulator
Get-ADForest | Select-Object DomainNamingMaster, SchemaMaster
Get-ADDomainController -Filter * |
    Select-Object Name, Domain, Forest, OperationMasterRoles |
    Where-Object {$_.OperationMasterRoles} |
    Format-Table -AutoSize

Edited July 11, 2017 by Dan_ATR

[HPlum78]

Yeah you could just move the FSMO roles with the first command like you say (the -identity can be the FQDN although it will just accept the computer name). I would be tempted to run the second part first just so you have no surprises and you know where everything was living before you move it with the first command. I would then run it again after the move to check that they have all gone to the places you expect (if that makes sense).

[Dan_ATR]

ok, so if I ran that second chunk of PS on my server now, it will just tell me stuff and thats all it will do. I am not moving anything just yet.

[Dan_ATR]

Sweet. I have just run it and shows me everything fine. I will also run the following in a CMD window.

DCdiag /test:Knowsofroleholders

 

Out of interest, could all of this be transfured during the normal operating day? Or do all Users and Computers have to be off and signed out? Of course I cant be logged out. It is a very light weight network so it should be fine.

 

Also, as my DHCP is using my second DC as a fall over load balance, if I remember rightly, the database for this should be always duplicated. So I would have thought that my DHCP database would then go to the new DC after creation and DHCP Role has been installed. Please corect me if I am wrong.

 

Images below.

 

Edited July 11, 2017 by Dan_ATR

[HPlum78]

I have just done this (a few weeks ago) on a network that has 40K + users and a mass of end users devices and no one even knew, so to answer your first question yeah it can be done during the day. As for DHCP moving the FSMO roles around will not alter the operation of DHCP in my understanding of how that failover works within DHCP, I think that you would have to backup the DB on the Server you are going to bin off and change the mode to hot spare and then setup the fail over again when the new server is built (This is from distant memory as I aint used DHCP in failover mode on a windows server for a long while now!)

[HPlum78]

in fact here https://blogs.technet.microsoft.com/teamdhcp/2012/09/10/migrating-existing-dhcp-server-deployment-to-windows-server-2012-dhcp-failover/ will help you migrate the DHCP Failover config.

[Dan_ATR]

ok cool.

 

With Fallover I think I remember that if the server is binned off, then the database if on the second server which becomes the primary after the time I set which is 5 seconds.

[Dan_ATR]

Changed the FSMO roles, and like you said no problems.

 

Did as per this artical https://www.petri.com/transferring_fsmo_roles

The Schema, Domain Naming, RID, PDC Emulator, Infrastructure are now transfured. I will do some restarts tomorrow.

 

Now its just DHCP I would have thought. I take it that DNS is alreay taken care of automatically. And KMS Volume licecing is just going to be scrapped and the new one will be installed.

[Dan_ATR]

One more question.

 

After FSMO roles have been moved, I just need to remove the AD DS role and then click demote server right?

 

As per this artical here: https://www.interfacett.com/blogs/how-to-demote-a-domain-controller-dc-in-windows-server-2012-active-directory-domain-services-ad-ds/

 

But I am a bit unsure/confused about the last step that says:

Note: The Binaries for AD DS are still installed on the server. If this server is not going to be promoted back to a domain controller in the future rerun the Remove Roles and Features Wizard to remove the AD DS Role from the server.

 

But I thought that by moving FSMO to another server and by then demoting the old PDC that all the data reguarding AD and DNS would have been moved to the new PDC. Please correct me if I am wrong or tell me im doing this correct.

[HPlum78]

Forget about the whole PDC/ BDC thing, FSMO roles replaced the absolute concept of PDC/ BDC design and now all DC's are equal for the purpose of any thing past NT4, this is the simplistic view of the architecture of FSMO roles and the holders of them.

 

To answer your question by the Binaries that you have noted above they are referring to the files that are required to make a Windows Server a DC, nothing more and they are correct that a demotion of a DC will not remove the files a server will use to become a DC the sxs folder essentially.

 

As for the actual AD DB and everything that makes up AD along with DNS (as long as its AD integrated DNS) this will be replicated as part of the DC promotion to a new DC (and will continue to be replicated to all DC's in a domain) and will stop being replicated as soon as a DC has been demoted. FSMO roles have no dependencies on the replication of AD/ AD integrated DNS as this data is replicated to all DC's in the Domain, again a simplistic view of how this works.

 

If I where in your shoes and I had the hardware to support me I would add the new 2016 DC before I started to demote the older DC's in the domain, a topic I am about to pick up on a different thread in a few mins (one that you have commented on DAN).

[Dan_ATR]

Thanks for clearning this up. As I have never been on any offical MS traning I usually pick up from what i am told and have read and expirianced. When I suddenly read something which is slightly off or not correct I then start asking questions as I become very unsure.