I hate DC Upgrades (2012R2 -> 2019)

[Warwick_Tech]

So here's the story -

 

I currently have 2 DC's, both 2012R2 - One does AD, GPO etc. the other does DHCP, DNS etc.

 

I want to upgrade the main DC to 2019 - So my plan was to promote the second DC to be the main DC and then wipe and rename the primary to Server 2019, then transfer all the roles back and decommission the second -

 

I found this great technet article, does anyone have any advice before I take the plunge? I hate configuring DC's....

 

https://blogs.technet.microsoft.com/canitpro/2017/05/24/step-by-step-migrating-active-directory-fsmo-roles-from-windows-server-2012-r2-to-2016/

Edited March 27, 2019 by ZeroHour
improving title a little - ZH

[mrbios]

Why do you have one DC doing one set of jobs and one DC doing a different set of jobs? Why don't they both do everything? Makes upgrading easier, as taking one down doesn't affect anything that way. (Technically if one is only doing DHCP and DNS, it's not really a DC)

[CCCSecMan]

I would agree in a school environment to have a "primary" DC doing all the FSMO roles as well as the primary DNS server, then have 2 more additional domain controllers (also configured as alternative DNS servers on your clients). Ensure forwarders are configured correctly too taking into account the desired flow of DNS resolution.

 

DHCP on other hand is best kept off domain controllers and I'd suggest a separate server just doing the DHCP role.

[HPlum78]

In place upgrades if you ain't changing hardware.

[Tefters]

I have in-places upgraded my DC’s from 2012 R2 to 2016 and then to 2019 with 0 issues.

 

I can see the people here cringing now however the in-place upgrade process is pretty much that of Windows 10 versions nowadays and while not 100% full proof it is very well done.

 

If you have a quick restoral process (mine is Veeam) then you can have the DC reversed in less than an hour if anything does go wrong.

 

Some roles/servers can be upgraded while others can’t, a good example is my ADFS and WAP servers due to farm levels however the migration process for that is simple and I have to plan to allow more time compared to just hitting upgrade.

[BroganOs]

Why do you recommend a separate server for dhcp? Would a virtual server do?

[mrbios]

Why do you recommend a separate server for dhcp? Would a virtual server do?

 

It's for security purposes if i remember correctly, personally never seen much risk in it in a school environment though, i think it's a low risk thing anyway, it's just best practice not to put it on a DC. Virtual is fine.

[DrCheese]

huh? I've never ever heard that - I don't see how that's best practice... (There's zero advantages)

[HPlum78]

I know what @Tefters has said is correct people have a fear of in place but from an MS perspective its the recommend way and is fully supported.

 

DHCP MS don't have a definitive answer to if you should or not run this on a DC, there is an artical from memory about making sure you change the account that DHCP runs as if you are running it on your DC and allowing for dynamic updates to NS recs.

 

As for the number of DCs 2 for any secondary school should be plenty as long as they are speced right. (unless your data center DR policy specifies differently then follow that!)

[mrbios]

huh? I've never ever heard that - I don't see how that's best practice... (There's zero advantages)

 

I agree, personally i run it on my DCs, and DNS dynamic updates has a service account.

 

 

As for the number of DCs 2 for any secondary school should be plenty as long as they are speced right. (unless your data center DR policy specifies differently then follow that!)

 

I'd also agree with that, just make sure your virtual environment has a policy on it to not run both DCs on the same host, and that any automatic power on rules is set to power on the DCs first.

Edited April 2, 2019 by mrbios

[mikkydoos]

eh? DC2,3,4,5 are there for failover. Split roles ?

 

DC1 FSMO yes, the rest just failover.

[HPlum78]

@mikkydoos 5 DC for failover how many geographical locations do you have? And what risk have you identified that requires that amount of DC's? If your power goes out do all your DCs go dark? Is the question I will ask..

[tubs]

"> huh? I've never ever heard that - I don't see how that's best practice... (There's zero advantages)"

 

Its to do with user security - only a domain administrator can be an administrator on a Domain Controller.

 

If the DHCP is on a member server, a user can be added to the local "administrators" group, which would then mean they can admin the server, and DHCP without being a domain admin.

 

You'd do this to separate out admin roles - maybe you want the "apprentice" or the "primary school admin" to be able to reserve IP addresses without being a full domain admin.

 

Maybe you want to restrict Domain Admins to only a few user IDs, so that they aren't being used all over the place so the less it is needed the less it is used. Indeed if you get permissions right, the only thing a Domain Administrator is needed for is DC works and DNS changes - GPOs, AD Joining, NTFS, Server Admin etc can all be done by delegation & permission to userIDs.

[mikkydoos]

@mikkydoos 5 DC for failover how many geographical locations do you have? And what risk have you identified that requires that amount of DC's? If your power goes out do all your DCs go dark? Is the question I will ask..

 

I dont have 5... just an example.

 

 

I have 10.

[HPlum78]

Ah 10 is a much better number of DCs to have. We had one per user at one point :-p

[Warwick_Tech]

Why do you have one DC doing one set of jobs and one DC doing a different set of jobs? Why don't they both do everything? Makes upgrading easier, as taking one down doesn't affect anything that way. (Technically if one is only doing DHCP and DNS, it's not really a DC)

 

That is my plan, I have two ATM, dropping down to one

 

In place upgrades if you ain't changing hardware.

 

In-Place would be ok, I just figured it's always best practice to wipe and rebuild - not sure on the history of this machine (One server I inherited was running 2012R2 from a 2000 in-place upgrade - Go Network Neighbourhood!)

 

I have in-places upgraded my DC’s from 2012 R2 to 2016 and then to 2019 with 0 issues.

 

I can see the people here cringing now however the in-place upgrade process is pretty much that of Windows 10 versions nowadays and while not 100% full proof it is very well done.

 

If you have a quick restoral process (mine is Veeam) then you can have the DC reversed in less than an hour if anything does go wrong.

 

Some roles/servers can be upgraded while others can’t, a good example is my ADFS and WAP servers due to farm levels however the migration process for that is simple and I have to plan to allow more time compared to just hitting upgrade.

 

This will likely be the plan I go with - Would you recommend 2016 then 2019 or skip 2016?

 

We have Veeam, but It's the free version so Windows Server Backup does the bulk of system images - Can you get a full restore from the free version as I thought it was files only.

 

Ah 10 is a much better number of DCs to have. We had one per user at one point :-p

 

Joking aside I've met people who would probably have a DC per IT suite - Muddy the waters.

[mikkydoos]

Joking aside I've met people who would probably have a DC per IT suite - Muddy the waters.

 

 

I'm now thinking of one DC per user. You can do anything with virtual.

[Tefters]

This will likely be the plan I go with - Would you recommend 2016 then 2019 or skip 2016?

 

We have Veeam, but It's the free version so Windows Server Backup does the bulk of system images - Can you get a full restore from the free version as I thought it was files only.

 

2019, it loads a faster than 2016 and also Windows Updates hell of a lot faster!

 

When it comes to Veeam free edition I honestly couldn't tell you as I haven't used the free edition in years. The paid edition I can do any restore method you can think of and lickerdy split!

[DrCheese]

I'm now thinking of one DC per user. You can do anything with virtual.

 

Sod it, why not do it via VDI and a golden image? Spin up a new DC everytime a user logs on.

 

*shudders* What's scary is you probably could script all this...

[mikkydoos]

This will likely be the plan I go with - Would you recommend 2016 then 2019 or skip 2016?

 

 

 

https://www.microsoft.com/upgradecenter/scenario/WS2012R2-on-prem-to-WS2019

[ITGURU]

I never inplace upgrade any machine. all clients and workstations are always 100% clean installs. With dc's i tend to move the FSMO and other roles (DHCP etc_ to other DCs a day before i plan to demote and install newest OS just so i know everything is replicated and working properly. However, i have 2 DHCP servers for redundancy so removing 1 dc at atime for upgrades doesnt have any impact. Only issue i find is that exchange hangs onto DC's so can take a while to realise 1 DC is offline and use the others.

[HPlum78]

In place was my stance for a long time, but now it's makes no sense to do a rebuild. MS's position is in place is fully supported and is also their recommendation. As already noted if its tin that is being replaced then its a fresh install and even the its in with the new out with the old!

 

Again the process employed by MS for win10 and server 19 is in place upgrades essentially.