Replacing DC's - what is best practice?

[mdrabble]

I have a couple of VMs running 2012r2 Domain Controllers and looking to swap them to 2019

 

Was planning on spinning up new 2019 VMs and installing roles etc and then transferring FMSO roles, etc

 

Thinking of reusing IP address and possibly the hostname - is this still a big no no or have things changed?

 

So what is considered best practice when doing these kind of changes?

 

Cheers

[HPlum78]

In place is fully supported https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/deploy/upgrade-domain-controllers i cannot find the 2019 version for this, but its essentually supported.

[djm968]

There was another thread for this here, might be useful: http://www.edugeek.net/forums/windows-server-2019/201974-going-server-2012r2-2019-place-upgrade.html

[dhicks]

Thinking of reusing IP address and possibly the hostname - is this still a big no no or have things changed?

 

We just done pretty much what you're planning - set up a couple of new Server 2019 VMs, installed the Domain Services role, promoted them to Domain Controllers, moved the FSMO roles over to one machine, also moved DHCP to one of the new DCs, then demoted the old DCs and turned them off, changed IP address of new DCs to match old ones (so DNS settings can stay the same). Nothing seems to have broken so far.

[3s-gtech]

I'll be in-placing mine in Summer - one DC hosts NPS, FSMO roles, AADC, etc and I don't fancy the faff of shuffling all of that round. I'm optimistic that it'll work fine.

[FragglePete]

Do you not need to have migrated to DFSR of the SYSVOL before going to 2019? Can't quite remember, I know we migrated ours last Summer but have stayed with 2016 for now.

 

Pete

[jthompson]

Just done ours, but since our old DCs were physical 2008R2 servers I created a couple of new 2019 VMs, promoted them to DCs, transferred FSMOs, DHCP, NPS, etc. then left it a week or so before demoting the old DCs. Didn't reuse hostnames or IP addresses as I wanted to run both pairs of DCs alongside one another for a bit. During that time I did a sweep to update the various LDAP connections across our systems to work against the new DCs.

 

Note: If your upgrade work involves migrating NPS to Server 2019, NPS on 2019 appears to have a bug whereby you need to manually add rules to Windows firewall to allow RADIUS requests in. The rules that are auto-created when adding the NPS role look fine, but didn't actually work for me. Manually adding new rules with all the same options got it working.

Edited February 24, 2020 by jthompson

[KevinB]

In-place upgraded our DCs a month ago from 2012R2 to 2019 and it worked flawlessly. Everybody seems to say that migration is better than in-place, but if in-place works, it's certainly the easiest option.

 

As @FragglePete mentions, you do need to be using DFSR and not NTFRS but this guide will check/fix that for you.

[SteveB_NI]

I'm in a similar situation - I'm currently running DCs on Server 2008r2. I'm building a new server with VMs on Server 2019.

 

I'm debating at present about completing re-doing the network - as I have the following changes I want to make:

1. New format usernames for the school

2. New Images required - need to create Windows 10 images ASAP

 

In place upgrade, or brand new creation, running alongside the current set up? I didn't set up the current network so would be good to learn, and understand all the group policies etc.

[caffrey]

I'm deliberating what to do too, especially as our domain is single label

[djm968]

I'm in a similar situation - I'm currently running DCs on Server 2008r2. I'm building a new server with VMs on Server 2019.

 

I'm debating at present about completing re-doing the network - as I have the following changes I want to make:

1. New format usernames for the school

2. New Images required - need to create Windows 10 images ASAP

 

In place upgrade, or brand new creation, running alongside the current set up? I didn't set up the current network so would be good to learn, and understand all the group policies etc.

 

If you have the capacity to build the new virtual infrastructure, which you obviously have, I would definitely re-build the entire network. As you say, you can get this up and running alongside your existing network, complete testing then move everything across at a convenient times. Pretty sizeable chunk of work but a great learning opportunity and a chance to get the network exactly how you want it to be.

[timbo343]

Do you not need to have migrated to DFSR of the SYSVOL before going to 2019? Can't quite remember, I know we migrated ours last Summer but have stayed with 2016 for now.

 

Pete

Yep you have to make sure you are using the newer DFSR to support 2019. There are guides online on how to do this but patience is a must. Don't rush it like i did otherwise it will bite back.

 

I created a thread on how mine went on edugeek and on technet http://www.edugeek.net/forums/windows-server-2019/208671-server2019-ad-upgrade-frs-dfs.html and https://social.technet.microsoft.com/Forums/en-US/f3dcdfd7-d3c4-447c-96ec-27ff897d8d00/sysvol-to-sysvoldfsr-issue?forum=winserverGP.

 

Also this guide is helpful too https://www.mowasay.com/2017/06/guide-to-migrate-frs-to-dfsr/

[TwistedHelixis]

I thought FRS had been decommissioned after 2008r2, cant believe it was still being supported in server 2016, unless I am thinking of something else.

[3s-gtech]

It was deprecated but not removed in 2008 R2, after being the default for new domains in 2008 R1 when it was introduced. I remember changing it over when we went to 2008 R2 back in 2009.