PDC has failed so need to promote SDC

[Caffeine11]

I have a Windows Server 2012 r2 primary domain controller that has failed and is not going to be repaired. I want to move the fsmo roles to our secondary domain controller and make it the primary domain controller i.e. we had two domain controllers, now we only have one.

 

There are plenty of articles on the net explaining how to move the roles but I have not had to do this before. What I want to know is is there anything I should do/need to/must do before I start moving the roles.

 

According to netdom query fsmo, I need to move:

 

schema master

domain naming master

PDC

RID pool manager

infrastructure manager

 

Thank you

[3s-gtech]

I’ll be a little wary on recommendations here - you’re talking about a long since unsupported OS for a server, and you’re dropping to run on one DC only. I can’t recommend either of those at all.

 

There’s no primary/secondary DCs. Haven’t been for years. FSMO role holder and not. The terminology will help you.

 

You need to seize the FSMO roles. As the other DC isn’t coming back, that’s fine. Work through the commands, make your remaining DC the role holder and test.

 

*Then build another DC with a supported OS and transfer everything to that.*

[kevin_lane]

https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/transfer-or-seize-operation-master-roles-in-ad-ds

[Fazza]

As others have already said Primary and Backup DC (never hear of a secondary one before, just PDC and BDC for me) - it's all about the roles and you need to seize them at the command prompt on the working DC that you have and then you can decide if you want to split the roles again.

[aac]

Technically BDC role was used in the pre Active Directory days Windows NT 4 so that brings back a few memories for me however some people do still float the term BDC when simply referring to a server that does not hold the FSMO roles. As the server has failed you may not be able to transfer the FSMO roles using the normal method of transfer so as mentioned above seizing the roles may be the only option...

[Caffeine11]

Thank you all for taking the time to reply.

 

*Then build another DC with a supported OS and transfer everything to that.*

 

Yes I would but the school wants to move entirely to the cloud.

[3s-gtech]

That's fair enough, but it's a bit like having a puncture and not replacing the spare - a gamble. Do you have solid backups of the remaining DC available?

[psydii]

"one is none"

 

I'd be tempted to recommend a 2019 for the new DC and then work out a plan to move to 2022 as soon as possible. 2022 and 2025 might not be fully compatible with other ancient things that are probably lurking on the domain (Exchange 2013?)

[aac]

I would go 2022 if it is holding FSMO roles as there are a large number of issues with 2025 DC's ATM that Microsoft are yet to fix. I say this as I have a 2019 DC holding the FSMO roles and another DC running 2025 and have no issues but I dare not upgrade the 2019 one yet until Microsoft have sorted out the known issues with 2025...

[Fazza]

Thank you all for taking the time to reply.

 

*Then build another DC with a supported OS and transfer everything to that.*

 

Yes I would but the school wants to move entirely to the cloud.

 

Until they have finished moving they risk the network failing should the remaining DC go down. Just tell them youve sought expert advice and you need to create a temporary VM with a DC on it that can easily be decommissioned when they have completed the move in to the cloud and make it clear if they dont want that then that's at their own risk - you're only 1 windows update away from something going wrong!

[TwistedHelixis]

Our entire county (almost all primary schools) have only one DC in each school. It only takes 10 - 15 minutes to restore from a backup and you don't have to worry about authoritative restores, tombstones entries or any of the extra Windows updates or DC sync issues. Hell you can even get away with in-place upgrades if you want, but I wouldn't recommend that on multi DC setups.

 

Just make sure you have plenty of backups and they have been tested recently.

 

I don't work for them anymore, but they have over 200 schools, so that's about 200 single DC systems all like this and in the 9 years I was with them, it was never an issue. The only people saying its an issue is MS, who want everyone to have thousands of servers.

[Caffeine11]

Hi TwistedHelixis

 

Thanks for the post. What did you use for backups? I am using Windows Server Backup (because it is free and we have no budget) to swapped external drives but people seem to have very mixed opinions of Windows Server Backup. How did you test a bare metal restore. Did you use a VM?

[Davit2005]

Hi TwistedHelixis

 

Thanks for the post. What did you use for backups? I am using Windows Server Backup (because it is free and we have no budget) to swapped external drives but people seem to have very mixed opinions of Windows Server Backup. How did you test a bare metal restore. Did you use a VM?

 

I'd look at Veeam free version, leaps and bounds ahead of Windows backup INMO.

Edited February 27, 2025 by Davit2005

[TwistedHelixis]

Thanks for the post. What did you use for backups? I am using Windows Server Backup (because it is free and we have no budget) to swapped external drives but people seem to have very mixed opinions of Windows Server Backup. How did you test a bare metal restore. Did you use a VM?

 

Back then they were using Redstore backup & Windows server backup, depending on the school. Both worked without any issues.

 

Now I help out at a few local primary schools. Most of the school files are in the cloud, so local backup is not such a big issue anymore. They also have zero money to spend on IT.

 

All DCS I manage now are VMs, so this makes backing up and restoring much simpler.

 

I use the schools old server (rather than chucking it out), and configure that as an ISCSI host. (ISCSI is built into Windows, just needs enabling)

The main server is a Hyper-V host and has 2 VMs, DC and Data.

On the main server I use ISCSI initiator to connect to the old server. The server sees this just like it would an external drive.

WBS backs up both VMs to the ISCSI (old server)

Every Saturday the backup is copied off to an external drive. I have 3 external drives on rotation.

 

To restore, I mount the backup on a different server that is also running hyper-V and WBS, run Windows restore and the DC and Data VMs will be listed in Hyper-V ready to be turned on and tested that they work.

 

I do a test restore of both the DC and Data servers a few times every term.

[Caffeine11]

Hi All

 

I have seized the roles and run dcdiag on both servers. They are showing the errors I would expect.

 

failed test DFSREvent (SYSVOL is being shared)

failed test Replications

 

According to Google, I can disable DFS replication using DFS Manager but that role is not installed on the server? Can I just install the role or is there another way of stopping the sharing of SYSVOL?

 

Again, according to Google, I can fix the replication issue using the following commands:

 

repadmin /option +Disable_Outbound_repl

repadmin /option +Disable_Inbound_repl

 

Once I have cleared these errors, am I OK to follow the Microsoft docs and delete the server from AD?

Edited March 7, 2025 by kha11