Small Town Sysadmin

Active Directory

Retiring old domain controllers before Server 2016 support ends

Windows Server 2016 leaves extended support on January 12, 2027. Here's a safe, step-by-step way to replace old domain controllers in a small domain.

Windows Server 2016 reaches the end of extended support on January 12, 2027. After that date it stops getting security updates unless you pay for Microsoft’s Extended Security Updates, which Microsoft has said will be available for up to three more years. Server 2012 and 2012 R2 already left extended support in October 2023.

In a lot of small domains, the oldest servers in the building are the domain controllers. They work, nobody wants to touch them, and they hold the keys to everything. This guide walks through replacing them the way Microsoft recommends: build new domain controllers, move the roles over, then retire the old ones. You don’t upgrade them in place.

Take a full backup of at least one existing domain controller before you start, including system state, and confirm you can restore it. Everything below is routine when the domain is healthy. The backup is for when it isn’t.

Pick the target version

As of this writing, Windows Server 2025 is the newest release, with support running into 2034. Server 2022 is also a solid choice if your other software isn’t certified for 2025 yet.

The version you pick changes one prerequisite:

  • Server 2025 domain controllers require both the domain and forest functional levels to be at least Windows Server 2016 before you can promote one into an existing domain.
  • Server 2019 and 2022 domain controllers require a forest functional level of at least Windows Server 2008.
  • Every newer domain controller requires SYSVOL to replicate with DFSR, not the old FRS.

Check your line-of-business software before you commit, especially anything that talks directly to Active Directory. An on-prem Exchange server is the classic one, since each Exchange version supports only certain domain controller versions.

Step 1: Take inventory

On a domain controller or a machine with the Active Directory PowerShell module, list your domain controllers and their operating systems:

Get-ADDomainController -Filter * | Select-Object Name, OperatingSystem, IPv4Address, IsGlobalCatalog

Then check the current functional levels:

(Get-ADForest).ForestMode
(Get-ADDomain).DomainMode

And see which domain controllers hold the operations master (FSMO) roles:

netdom query fsmo

Write all of this down. You’ll want it for the change record and for the audit folder.

Step 2: Make sure the domain is healthy

Don’t add a new domain controller to a sick domain. Run the basic health checks and fix anything they flag first:

dcdiag
repadmin /replsummary

Then confirm SYSVOL is on DFSR:

dfsrmig /getglobalstate

If the result says the migration state is Eliminated, you’re on DFSR and ready. If the command reports that migration hasn’t started, the domain is still on FRS, and you’ll need to complete the FRS-to-DFSR migration before any newer domain controller can join. That’s its own project, so plan for it.

Step 3: Raise functional levels if needed

If you’re adding Server 2025 domain controllers and your levels are below Windows Server 2016, you’ll need to raise them first. That’s only possible once every existing domain controller runs Server 2016 or later, so any 2012 R2 domain controllers have to be retired before this step.

Raising the level is quick, but treat it as permanent. Rolling back is only possible in narrow cases. Check application compatibility first, schedule it like any other change, and raise the domain level before the forest level.

Step 4: Build and promote the new domain controller

Start from a clean install of the new Windows Server version. Give it a static IP address, point its DNS at an existing domain controller, patch it fully, and join it to the domain.

Install the role and promote it. Server Manager’s wizard works fine, or use PowerShell:

Install-WindowsFeature AD-Domain-Services -IncludeManagementTools
Install-ADDSDomainController -DomainName "yourdomain.local" -InstallDns -Credential (Get-Credential)

It will prompt for a Directory Services Restore Mode password. Store it somewhere you’ll find it in three years.

After the reboot, give replication time to settle, then run dcdiag and repadmin /replsummary again. In a small domain, build two new domain controllers if you can. One domain controller is one failure away from a very bad week.

Step 5: Move the FSMO roles

Once the new domain controller is healthy, transfer all five operations master roles to it:

Move-ADDirectoryServerOperationMasterRole -Identity "NEW-DC01" -OperationMasterRole SchemaMaster, DomainNamingMaster, PDCEmulator, RIDMaster, InfrastructureMaster

Confirm with netdom query fsmo.

The PDC emulator is also the domain’s time source, so configure the new one to sync from a reliable external time source:

w32tm /config /manualpeerlist:"time.nist.gov" /syncfromflags:manual /reliable:yes /update

Step 6: Update everything that points at the old servers

This is the step that bites small shops, because old domain controllers usually do more than domain controller work. Before you demote anything, find and update:

  • DHCP scope options that hand out the old domain controller as a DNS server
  • Static IP settings on servers, printers, and network gear
  • Firewall, VPN, and Wi-Fi settings that use the old server for DNS or RADIUS
  • Copiers and scanners that authenticate with LDAP against a specific server name
  • Applications with a hard-coded domain controller name
  • Any other roles on the old server: file shares, DHCP, print, certificate services, or that one scheduled task

Step 7: Demote and retire the old domain controller

When nothing depends on it anymore, demote it:

Uninstall-ADDSDomainController

After it’s demoted, check that its records are gone from DNS and from Active Directory Sites and Services. Remove any leftovers. Keep the old server powered off but intact for a week or two before you wipe it, in case something you missed comes looking for it.

Once every old domain controller is gone, you can raise the functional levels to the highest your new domain controllers support.

Sources

All articles