Active Directory Domain Controller Migration – General Procedure

Document the Existing Environment

Identify all current domain controllers:

netdom query dc

Identify the current FSMO role holders:

netdom query fsmo

Document:

Put the results in the service ticket before making changes.

Verify Existing Active Directory Health

Run on the existing Domain Controller:

dcdiag /skip:systemlog

Check DNS health:

dcdiag /test:dns

Check replication:

repadmin /showrepl

Optional replication summary:

repadmin /replsummary

Resolve significant AD, DNS, or replication errors before promoting the replacement DC.

Save the results in the ticket.

Prepare the New Server

Before promotion:

Install Active Directory Domain Services

Using Server Manager → Add Roles and Features, install:

If this server will also replace the print server, install:

Do not configure printers yet unless needed.

Promote the New Server to a Domain Controller

From Server Manager:

AD DS → Promote this server to a domain controller

Choose:

Add a domain controller to an existing domain

Enable:

Complete the promotion and reboot.

Verify the New Domain Controller

After reboot, confirm SYSVOL and NETLOGON exist:

net share

You should see:

NETLOGON
SYSVOL

Check AD health:

dcdiag /skip:systemlog

Check DNS:

dcdiag /test:dns

Check replication:

repadmin /showrepl

Force a replication sync if needed:

repadmin /syncall /AdeP

Recalculate the replication topology if needed:

repadmin /kcc

Run another replication check afterward.

Do not continue with the old DC removal until replication, SYSVOL, NETLOGON, and DNS are healthy.

Transfer FSMO Roles

Verify the current FSMO holders first:

netdom query fsmo

Transfer all FSMO roles to the new DC:

Move-ADDirectoryServerOperationMasterRole -Identity "WC-DC01" -OperationMasterRole SchemaMaster,DomainNamingMaster,PDCEmulator,RIDMaster,InfrastructureMaster -Confirm:$false

Replace WC-DC01 with the correct new DC name.

Verify afterward:

netdom query fsmo

Confirm all five roles now point to the new Domain Controller.

Verify DNS

Verify that:

Run:

dcdiag /test:dns

Update DHCP and/or firewall DNS settings so clients receive the new Domain Controller as a DNS server.

Do not remove the old DC from DNS/DHCP settings until the new server has been verified.

Migrate DHCP if Applicable

If DHCP is hosted on the old Windows server:

If DHCP is provided by the firewall, update its DNS settings instead.

Migrate Print Services if Applicable

On the old print server:

Open Print Management.

Right-click the print server and select:

Export printers to a file

On the new server:

Open Print Management and select:

Import printers from a file

Verify:

Test printing before removing the old print server.

Final Active Directory Validation

Run on the new DC:

dcdiag /skip:systemlog

dcdiag /test:dns

repadmin /showrepl

repadmin /replsummary

Verify:

netdom query dc

netdom query fsmo

net share

Confirm:

Put final validation results in the ticket.

Demote the Old Domain Controller

Only after the new DC has been verified and required services have been migrated:

After demotion, reboot and verify Active Directory/DNS cleanup.

Run again from the new DC:

netdom query dc

dcdiag /skip:systemlog

dcdiag /test:dns

repadmin /replsummary

Remove stale DNS records or AD metadata only if they were not cleaned up automatically.

Optional: Raise Domain / Forest Functional Level

Only perform this after the Domain Controller migration is complete and Active Directory health and replication have been verified.

1. Check Current Functional Levels

Open PowerShell as Administrator:

Get-ADDomain | Select-Object DNSRoot,DomainMode
Get-ADForest | Select-Object Name,ForestMode

Before raising the level, confirm all Domain Controllers support the desired level.

Important:

2. Verify AD Health First

dcdiag /skip:systemlog
dcdiag /test:dns
repadmin /replsummary

Do not raise the functional level if there are unresolved AD or replication problems.

3. Raise the Domain Functional Level

Open:

Server Manager → Tools → Active Directory Domains and Trusts

Expand Active Directory Domains and Trusts.

Right-click the domain name and select:

Raise Domain Functional Level

Select the highest level supported by all Domain Controllers.

Example:

Windows Server 2025

Click:

Raise → OK

Microsoft requires all DCs in the domain to support the level being selected.

4. Raise the Forest Functional Level

In Active Directory Domains and Trusts:

Right-click the top-level:

Active Directory Domains and Trusts

Select:

Raise Forest Functional Level

Select the desired level.

Example:

Windows Server 2025

Click:

Raise → OK

The forest functional level should normally be raised after the domain functional level.

If every DC in every domain is Windows Server 2025, raising the forest to Windows Server 2025 can automatically raise the domains to the Windows Server 2025 functional level as well.

5. Verify

Run:

Get-ADDomain | Select-Object DNSRoot,DomainMode
Get-ADForest | Select-Object Name,ForestMode

Then verify AD health again:

dcdiag /skip:systemlog
repadmin /replsummary

Document the new Domain and Forest Functional Levels in the ticket.