Removing 2012 R2 DC

[Bankesy]

Good morning,

 

I've never had to remove a DC before so thought I would reach out here before I make any terrible mistakes, my primary concern is that I know some things still point to it for secondary DNS.

 

I've got two other DCs in the domain, one is also used for DNS so how do I go about using the second DC for DNS to replace the one I want to remove?

 

If anybody has done this before and has some advice I would appreciate it.

 

Thanks

[Davit2005]

Use the same IP addresses on new domain controllers.

 

I usually do this by building new DCs with a temp IP address, make sure everything looks ok by running DCDIAG etc. Then give the old DCs a different temp address and the new DCs the original IP addresses.

 

There should be no need to keep the same name unless you have other services running on the DCs.

 

Once happy with the new DCSs and the FSMO roles have been transfered over then remove DC services from the old DCs by un promoting them.

Edited November 7, 2024 by Davit2005

[Bankesy]

@Davit2005 thanks, I'm not creating two new DCs though.

 

I've inherited three DCs and I'm trying to remove the 2012 R2 one and leave the other two.

[Davit2005]

@Davit2005 thanks, I'm not creating two new DCs though.

 

I've inherited three DCs and I'm trying to remove the 2012 R2 one and leave the other two.

 

Yep you still have an issue if a service is using the DNS you will prob need to find out what server is using the 2012 for DNS then adjust it's DNS settings. Any device with DHCP providing the DNS servers should be easy but any static you will have to modify the client manually.

[Bankesy]

@Davit2005

 

That makes sense and is along the lines of what I was thinking but can I just use the other remaining DC for DNS simply because it is a DC and has the DNS role installed or is there something else I need to do?

 

Also, I've never had to change DNS in DHCP. If I were to run ipconfig now on a client device I would get one of the "new" DCs and the one I'm trying to remove as DNS so how do I go about changing this?

 

Thanks, I know these question are probably quite basic.

[CHiLL]

Yep you still have an issue if a service is using the DNS you will prob need to find out what server is using the 2012 for DNS then adjust it's DNS settings. Any device with DHCP providing the DNS servers should be easy but any static you will have to modify the client manually.

This isn't something I've done before but as I was reading this I was thinking...if it's a VM DC, would adding a new virtual NIC to an existing DC and giving it the IP address of the defunct DC work? Same with a physical DC but using another NIC on the server (if it has one) or installing an additional network card? That way the IP would still be valid. Then again, it's a patch job and I wonder if just having the IP inactive would be the best long term solution and tackling issues as they arise?

[Julian]

Active directory, is build on DNS, I therfore have DNS on both DC's for redunacy (I am also running DHCP on both DC's for redudany).

[Davit2005]

Active Directory intergrated (I think it is called??) is better solution if running on premise.

 

You would need to change the DNS servers in the relevant DHCP scope. Anything manually set will need manual intervention.

 

Yep I suppose an extra VM NIC with jus the IP address and subnet mask but no DNS or gateway set would work as @CHiLL mentions but would want to be careful not to dual home the DC. And you still want to adjust clients in the long term.

 

This is partly why I suggest reservations in DHCP rather than setting clients statically. You have benefit of the client always been at the same address and flexibility to change any of it's IP settings without going to the device most of the time. Of course any DCs, DNS or gateways, etc. should always have static IP addresses. But things like printers are better on a reservation in my opinion.

[Fazza]

@Davit2005I've never had to change DNS in DHCP. If I were to run ipconfig now on a client device I would get one of the "new" DCs and the one I'm trying to remove as DNS so how do I go about changing this?

 

On the DC that is your DHCP server, open up DHCP and then for each Scope you have, click on Scope Options and then edit 006 DNS Servers and remove the one you dont want to be there.

 

[Bankesy]

@Fazza thanks for the screenshot, I understand what to look for now.

@Davit2005 pretty much every client device we have is on a reservation because that's just the way the people before me set it up. Nothing gets an IP without a reservation, it's a bit complicated but basically I was left a database on the deployment server and a script on the DC.

 

Script looks at deployment database for MAC addresses and then creates reservation and assigns an IP for them.

[Davit2005]

@Fazza thanks for the screenshot, I understand what to look for now.

@Davit2005 pretty much every client device we have is on a reservation because that's just the way the people before me set it up. Nothing gets an IP without a reservation, it's a bit complicated but basically I was left a database on the deployment server and a script on the DC.

 

Script looks at deployment database for MAC addresses and then creates reservation and assigns an IP for them.

 

I think you can specify DNS on individual reservations? It's not a bad way of dealing with it (if you need desktops on specified addresses) and a lot easier than dealing with static addresses, lol.

 

MAC addresses can be forged or cloned so not fool proof as security goes :-)

[mikes]

I have two old 2012 R2 DC's but one of them runs the Certificate Authority for our DA. They also do DNS/DHCP (which I can easily move) - Not sure if I can move DHCP/DNS from our old DC's to our new 2022 DC's, demote the old DC's and get rid of them, then rename the new DC's to the same name as the old DC's so Certificate Authority is happy? (apparently Certificate Authority goes mad if the server name is different)

Unfortunately on one of our old 2012 R2 DC's I also set up federated services for o365 SSO so I need to remember how to move that too :-(

[FN-GM]

Unfortunately on one of our old 2012 R2 DC's I also set up federated services for o365 SSO so I need to remember how to move that too :-(

 

ADFS is no longer supported for Office 365. Does it actually still do anything?

[mikes]

ADFS is no longer supported for Office 365. Does it actually still do anything?

 

It's been a while since I've set it up so I need to do some re-reading. Entra Connect "Azure AD Sync" I've moved off and onto its own dedicated server when I updated it. That syncs our AD information.

But our STS.school.org.uk which is the external sign in page points to our DC-02 so I presumed it was the ADFS that handled it as well as remembering it being responsible for SSO on domain joined machines. (though reading up it might be Entra handling that?)

 

On our ADFS service event logs I can see logins (including failed brute forces for non existent account such as sales and info but not as many as I'd have thought) and I'll occasionally get a call from a sixth former who can't log on off site and a reboot of that server fixes it. Think I need to look at modernising it as apart from AD sync I haven't touched it in a good 7+ years now, it went from an experiment so something some people use quite a lot (though we are still mainly a Google school)

[FN-GM]

It's been a while since I've set it up so I need to do some re-reading. Entra Connect "Azure AD Sync" I've moved off and onto its own dedicated server when I updated it. That syncs our AD information.

But our STS.school.org.uk which is the external sign in page points to our DC-02 so I presumed it was the ADFS that handled it as well as remembering it being responsible for SSO on domain joined machines. (though reading up it might be Entra handling that?)

 

On our ADFS service event logs I can see logins (including failed brute forces for non existent account such as sales and info but not as many as I'd have thought) and I'll occasionally get a call from a sixth former who can't log on off site and a reboot of that server fixes it. Think I need to look at modernising it as apart from AD sync I haven't touched it in a good 7+ years now, it went from an experiment so something some people use quite a lot (though we are still mainly a Google school)

 

You should probably get it out of service then! besides, it's not needed now, you can do all it's functions serverless.

[Julian]

Are you using a phyical server or a virual server?, If virtual, why not do a inplace upgrade? As that would save you lots of hassel.

[mikes]

I wasn't sure doing a direct in place upgrade of a DC was considered a good idea - esp one with ADFS and other custom roles added. I think the server is still needed as if I shut it down nobody can log into o365 from off site. It's a virtual server so I could take a snapshot and try an in place upgrade but again I'm not sure if restoring a snapshot of a DC will break things. Got until summer so am doing all the reading now - it's stuff I've neglected for years in favour of gluing plastic nodules back onto chromebook keyboards which was a bit dumb really.

[MatthewL]

Turn it off for a week and see if anything breaks, if it doesnt, power it back on for 24 hours let it replicate back up to date then dcpromo it down and remove it then like a normal server.

[mikes]

Turn it off for a week and see if anything breaks, if it doesn't, power it back on for 24 hours let it replicate back up to date then dcpromo it down and remove it then like a normal server.

 

yeah tbh I've no idea how I set it up. I set up Web Application Proxy on our webserver so people can sign in from outside or as part of SSO - thing is our webserver has been without its external IP for years so it can't be doing anything. Unless it handles Single Sign On for internal users (we use the desktop o365 office apps here)

 

But when people sign in to Office 365 off site they still get sent to sts.school.org.uk which is the server ADFS runs on, so it must still be being used. (we have a hybrid deployment) - I edited the login page parameters and they showed up so it's definitely using the ADFS I set up probably 8 years ago now!

 

I wonder if there's an option I can set in o365 where they can sign in direct to Microsoft rather than being directed to sts.school.org.uk as part of the hybrid stuff.

 

It's half term next term so I can shut things down and have a play about see exactly how I set it up. I only set it up originally as an experiment for our ICT teacher who wanted to use it, but now it's used for a lot more - we had a new SMT team who heavily used o365 in their old school so they use it a lot too.