Kiest26

Assuming the CA which issues the new certificate is trusted by the machines they should just behave as normal.

I'd just upgrade; its just a matter of adding a new DC to your existing domain and demoting the old. There's no real advantage to starting a fresh it's just going to cause you significantly more work for no real benefit. The process is very well documented a quick Google search turned up the links below: https://blogs.technet.microsoft.com/canitpro/2013/05/05/step-by-step-adding-a-windows-server-2012-domain-controller-to-an-existing-windows-server-2003-network/ https://technet.microsoft.com/en-us/library/cc771844(v=ws.10).aspx

I have no idea if this would work but could you just call the theme file via a login script?

I've never used a theme but I've pushed out a screensaver and desktop background without issue

https://www.microsoft.com/en-us/evalcenter/evaluate-hyper-v-server-2016 This states it's an evaluation for some reason however this isn't the case it is actually the the full version and is provided at no cost. We've been running the 2012 r2 version for several years

I think you misunderstood me. There's a version of server 2016 which is specifically for HyperV and has no other features and this is totally free with no license required what so ever.

Yeah it's very straight forward the link below seems to document it quite well Adding a Windows Server 2016 Domain Controller | PeteNetLive

Would both 2 virtual and 2 physical be possible? 1 physical running HyperV the other Physical as DC, DNS, DHCP and could even be a file server if you wish. The HyperV could then have 2 VM's one with SIMS etc and the other as a backup DC/DNS. You really should look at adding a second DC it makes restoring from failures so much easier and prevents outages. As for VPN will you have any spare server hardware? This could be re used as a router and would allow you to keep the VPN functionality at no cost what so ever with something like pfsense.

Isn't HyperV Server 2016 more suited? And best of all it's free

Was that not changed? I'm sure I read something a while ago saying this was no longer the case

Any way of getting any additional licenses? Dell do the Poweredge T20 which is cheap (the Xeon variant being around £300) I'd offload AD, DHCP, DNS and Possibly PDQ inventory off onto one of them and get something with a bit more grunt for your SIMS etc

Personally I'd virtualise the lot over several nodes in a cluster but that's not gonna be cheap. Have you ever added an additional DC to a domain? The upgrade process basically involves adding the new DC as an additional domain controller and then demoting the old it's really not that difficult

As to a new domain is there any particular reason for that? I'd just migrate to 2016 have a bit of a cleanup, maybe review Group Policy and see if there's anything that could do with being tweaked

It looks like a little OTT in terms of roles to me. I could be wrong but I think it's not considered good practice to install SQL or VPN on a DC.

Is this as a Hypervisor or one Server instance running all those roles?