Kiest26

Assuming the CA which issues the new certificate is trusted by the machines they should just behave as normal.

I'd just upgrade; its just a matter of adding a new DC to your existing domain and demoting the old. There's no real advantage to starting a fresh it's just going to cause you significantly more work for no real benefit. The process is very well documented a quick Google search turned up the links below: https://blogs.technet.microsoft.com/canitpro/2013/05/05/step-by-step-adding-a-windows-server-2012-domain-controller-to-an-existing-windows-server-2003-network/ https://technet.microsoft.com/en-us/library/cc771844(v=ws.10).aspx

I have no idea if this would work but could you just call the theme file via a login script?

I've never used a theme but I've pushed out a screensaver and desktop background without issue

https://www.microsoft.com/en-us/evalcenter/evaluate-hyper-v-server-2016 This states it's an evaluation for some reason however this isn't the case it is actually the the full version and is provided at no cost. We've been running the 2012 r2 version for several years

I think you misunderstood me. There's a version of server 2016 which is specifically for HyperV and has no other features and this is totally free with no license required what so ever.

Yeah it's very straight forward the link below seems to document it quite well Adding a Windows Server 2016 Domain Controller | PeteNetLive

Would both 2 virtual and 2 physical be possible? 1 physical running HyperV the other Physical as DC, DNS, DHCP and could even be a file server if you wish. The HyperV could then have 2 VM's one with SIMS etc and the other as a backup DC/DNS. You really should look at adding a second DC it makes restoring from failures so much easier and prevents outages. As for VPN will you have any spare server hardware? This could be re used as a router and would allow you to keep the VPN functionality at no cost what so ever with something like pfsense.

Isn't HyperV Server 2016 more suited? And best of all it's free

Was that not changed? I'm sure I read something a while ago saying this was no longer the case

Any way of getting any additional licenses? Dell do the Poweredge T20 which is cheap (the Xeon variant being around £300) I'd offload AD, DHCP, DNS and Possibly PDQ inventory off onto one of them and get something with a bit more grunt for your SIMS etc

Personally I'd virtualise the lot over several nodes in a cluster but that's not gonna be cheap. Have you ever added an additional DC to a domain? The upgrade process basically involves adding the new DC as an additional domain controller and then demoting the old it's really not that difficult

As to a new domain is there any particular reason for that? I'd just migrate to 2016 have a bit of a cleanup, maybe review Group Policy and see if there's anything that could do with being tweaked

It looks like a little OTT in terms of roles to me. I could be wrong but I think it's not considered good practice to install SQL or VPN on a DC.

Is this as a Hypervisor or one Server instance running all those roles?

Sounds like a waste of money to me. Surely those additional funds could be spent in other ways to improve your entire network?

Which operating system are you going to be going with? As Microsoft recently announced that the latest Gen of Intel and AMD CPU's are 'incompatible' with anything lower than Windows 10 and therefore are blocking all Windows updates for anything lower than 10

Do the new servers have remote management such as HP ILO enabled? Maybe there's an IP conflict

Interesting how sometimes both have to be restarted as a single DNS server should be sufficient. Are both fully operational even when everything is working fine? Maybe one is constantly having issues and the other is failing occasionally so your then failing over to the other giving the impression of an intermittent issue

Usually as long as it's the correct form factor (generally 2.5" for a laptop) and the connector is correct normally SATA 3 for a modern laptop any drive meeting those criteria should work fine

Yeah I'd ping a machine which is unlikely to be cached. How do you filter web traffic? As some solutions mess with DNS and override the forwarders you have on your dns servers

Are you sure it's available? As the records could be cached allowing you to access the DNS server. If it is working I'd check your root hints (I noticed recently quite a few of mine were invalid) and try different external DNS forwarders if possible

When it completely dies does internal DNS resolution still work ok?

I've never used Esxi so don't really have any experience there. During the periods of no internet access are the servers accessible?

By any chance do you change the port to a none SSL port?