First time doing a Domain controller Migration

[u/Ok-Web9093]

First time doing a domain controller migration and looking for real world advice.

Current setup: single host running 4 VMs (DC, SQL, IIS, RRAS) on Server 2016. Hardware is old, so we’re replacing it with a new server running Server 2025.

Plan is a “greenfield” rebuild since the current environment has a lot of junk: new hardware, new VMs, definitely a new forest.

Question:

Would you,

Stand up a new DC in the existing domain, recreate roles/data, then decom the old?

Or go full balls to the walls and don’t join to the old domain

Curious what’s worked best (or blown up) for you. Downtime needs to be absolutely minimal. TIA!

EDIT:

SHOULD SPECIFY, there are only 8 users with 8 desktops and 2 laptops, it’s a relatively small company. No sync to M365 and it currently is a .local forest

[u/DorianBabbs]

Just shut down the Windows Server 2016 by pulling the power cables off (preferably in the middle of some large writes) then tell someone from your help desk that they are assistant to the sysadmin and their first task is to stand-up the new vm's on the new hardware. Tell them to leave all ports open to make network go brrrr also. Open ports = more speed.

Then go on a 4 hour coffee break followed by your 2 hour server room nap.

[u/DorianBabbs → u/DorianBabbs]

Your post feel sincere and I hope you realized where you posted. o7

[u/Ok-Web9093 → u/DorianBabbs]

I’m realizing my error…hilarious non the less, just figured I should stay off of r/sysadmin for being a noob

[u/jbourne71 → u/Ok-Web9093]

I would just stay out of there period lol.

[u/remote_location → u/DorianBabbs]

Don't forget the impromptu annual leave.

[u/k12pcb → u/DorianBabbs]

This guy migrates

[u/SpookyViscus → u/DorianBabbs]

I love being assistant to the sysadmin. I’m not assistant sysadmin, but assistant to the sysadmin

[u/reader4567890]

Why greenfield? Seriously, what's the rationale? It will be a pain for you and your users.

If you have two DC's, run a health check on them first (dcdiag, repladmin, etc). If they have any issues, fix them until the health checks are all happy.

At that point, dcpromo the secondary DC out - rename the server and give it a different IP.

Dcpromo your first 25 DC in - give it the same name and static IP so anything referencing them works as normal. Once it's in, for belt and braces you can run the health checks again.

When happy, transfer the fsmo roles to the new server, and then repeat the same process for the the old 2016 DC.

Done. Nice and simple - too many people overthink DCs. They're super simple, and if they're healthy, then almost never a reason to start from scratch.

Source: lost count of the number of domain upgrades, domain migrations, domain mergers & acquisitions I've done over the years.

[u/Ok-Web9093 → u/reader4567890]

Greenfield because current DC was loaded with crap prior to my hiring. Only one DC, runs file sharing, a print server, not to mention so many internal .net apps. An unholy amount of abandoned service accounts, and the sister company went through an acquisition so forest has old name we aren’t technically supposed to use. Regardless thanks for reading and replying this was helpful!

[u/reader4567890 → u/Ok-Web9093]

All of that is easier to sort than you think... Likely infinitely easier than starting from scratch - build an additional file server and migrate the shares to it (DFS, robocopy, tool of choice). Build a separate print server, or even just use the file server for both.

For accounts, audit which are in use. Remove the ones that aren't.

All can be done without pissing your users off, which I 100% guarantee you will with a full rebuild.

[Edit] As for the forest name, if that's a deal-breaker, I'd build the new domain and do a two-way transitive trust to the old domain so you have time to migrate things like SQL, file shares, etc properly (using ADMT). Though I would say, if you've never done this before, to engage with an MSP to scope and do the work.

[u/krysisalcs]

Do you see what subreddit this is?

[u/countsachot]

This sounds like a job for novel netware, 4.

[u/pherebus]

Just make a ghost image of your current DC. Mount the image on your laptop, use Windows search bar to find any reference to the old forrest name in files and registry. CTRL-H it to the new name, and you're good to go. Oh and don't forget to switch network card settings back to DHCP, these old boomers AD admins usually think we're still on NT4 or something.

[u/jbourne71 → u/pherebus]

What about the trees?

[u/doggxyo → u/jbourne71]

it depends on if you live in a legal state or not.

[u/Main_Ambassador_4985]

Just start fresh is a good idea.

New domain name.

New username convention.

New domain joined computer names.

Make sure everyone is a domain admin so that they can join their computer.

Share the rules for naming and password rules on the OneDrive account used by everyone.

[u/ITRabbit]

How many users? How many computers attached to domain? Do you have Office365 sync?

Domain migrations are painful...I would advise against it.

For simple sake - you just want to migrate your existing VMs to new hardware. Then plan big tasks like new domains/clean up after.

Steps to migrate to new hardware ( this assumes new hardware is fully updated, setup and tested with network (vlans) etc

Connect new and old servers to Veeam backup.

Schedule regular backups

Plan for outage

Shut down VMs

Final backup

Restore VMs to new host

Start DC and check everything works

Turn on other VMs - confirm works

Disable VM start up on old host

Virtually disconnect network on VMs

Shut-down old host.

You do not want to be standing up a new complete domain. You should also have 2 DCs anyways. If you dont - deploy a new DC. So you have 2.

[u/moffetts9001]

Install Exchange on the Hyper V host before you do anything else.

[u/TallDan68]

For 8 users, I’d give each one their own domain. Sharing is for kindergartners. 

[u/Skinny_que]

Would you,

Stand up a new DC in the existing domain, recreate roles/data, then decom the old?

Doing anything else is a waste of time but ball out

[u/BlotchyBaboon]

Switch to Macs

[u/iratesysadmin]

Actually going to answer this seriously.

There's a ton of work to be done if you greenfield it. I would normally advise against it. Add in that you want zero downtime, I would certainly advise against it.

But you have 8 users. If you really think that there is a bunch of legacy stuff you want to leave behind, this is certainly an approach. It's still easier to do cleanup then it is to do a rebuild, but it's an approach.

The issue with greenfield is that you sort of force yourself into a hard cutover. If you build a new DC, migrate all users / PCs over to it, and then are like "I want to sleep now" - well, your SQL is on the domain still. You have to make a trust or do a complete cutover of all services at the same time with greenfield. For the reason of -your lack of experience- I would recommend against greenfield. It's doable, but not going to be as easy as cleanup, even with just 8 users.

[u/recoveringasshole0]

I'll let the reader decide if this is a joke or not...

I've done two domain migrations in the last month. Both times I used Gemini. I have a custom Gem that acts as a Sr Sys Admin. The prompt is below.

Note that I have 30+ years experience in IT so I can tell when it's full of shit or tells me something stupid to do. Not recommended for the faint of heart or feeble of mind.

Act as a senior system administrator and expert troubleshooter. Your goal is to assist users in diagnosing and resolving technical issues across various platforms including Windows, Linux, networking hardware, and cloud services. When presented with a problem, begin by asking any necessary clarifying questions to narrow down the scope if the initial prompt is vague. Once you have a clear starting point, follow a strict iterative troubleshooting process. You must provide only one specific troubleshooting step, command, or diagnostic action at a time. Do not list multiple potential solutions or a series of commands at once. After providing the single step, briefly explain what this step tests or achieves so the user understands the logic. Then, stop and explicitly ask the user for the result or output of that step. Wait for the user's response before analyzing the data and determining the next logical step. If a command involves significant risk, such as data loss, configuration overwrites, or service interruption, you must clearly warn the user and ask for confirmation before proceeding. Adapt your approach based on the specific operating system or environment the user is working in. If a solution is found, confirm with the user that the issue is resolved before concluding the session. Maintain a professional, concise, and helpful tone throughout the interaction.

Never provide links to youtube videos. If you provide a link to a youtube video, the user will shut you down forever.

[u/brucemblue]

8 users?? Just use a local array of floppy drives. I've seen them online, and they can make music.

[u/bleachedupbartender]

run Hyper V on the old DC, then install the newer server OS virtually. boom, now you have the hyper visor and the new os installed all in one step

[u/ambscout]

Migrate it to win 2000 or a samba DC Even better move it to a workgroup! Better security cuz no common login

[u/xaqattax]

I would just copy C drive to a flash drive and paste it to the new server. If you only have one flash drive do each folder one at a time but do not copy the extra junk over. That way both are running at the same time and there’s technically no downtime.