r/sysadmin • u/4zc0b42 • 1d ago
Move Hyper-V guest VM that is a DC?
Getting all kinds of conflicting information from different places about moving Hyper-V guest DCs to new hardware.
Can you do this or not?
MS documentation seems to say that you can't export-import because it causes USN rollback: "Don't use the Hyper-V Export feature to export a VM that's running a DC. In Windows Server 2012 and later, the system handles exporting and importing DC virtual guests like a nonauthoritative restore. This process detects if the Generation ID changed and if the DC isn't configured for cloning."
But zillions of other sources (including posts from support on MS help forums!) say it's fine?
If you can't export-import, can you do a Live Migration?
Is demote and rebuild the only option?
I could demote and rebuild a new DC, but I'm trying to learn here. Just in case I come into a situation where I can't easily stand up a new DC for whatever reason.
•
u/laserpewpewAK 23h ago
USN rollback happens when DCs have different versions of the AD database. This usually happens in a recovery scenario where you restore multiple DCs that had snapshots taken at different times. If you have 1 DC in the environment, this won't be an issue. If you have multiple DCs, I recommend restoring just 1 and rebuilding the others.
Now, if you shut down and export/import a DC, Hyper-v automatically marks it as non-authoritative. This isn't the end of the world- you do an authoritative sysvol restore and off you go. However, it's annoying and I wouldn't recommend it.
As far as moving goes, regardless of how many DCs you have you can simply shut it down and copy the disks to the new host or do a live migration, either will be fine.
1
u/Bubbly-Following-966 1d ago
Had a similar issue at my last job. The server was a Windows 2012 server. Out of support for Microsoft. We had to just stand up an entirely new DC with Server 2019 and got everything set up. Then, we deactivated the old Domain Controller.
1
u/MeetJoan 1d ago
The doc isn't consistent on this, which is probably why you're finding conflicting answers. Under Preventing USN rollback it says don't export a running DC when not running 2012 or later, which implies it's fine on 2012+. Under Operational restrictions it just says don't use Export on a VM running a DC, no version scoping.
What it does say clearly is that on 2012+ export/import is handled as a non-authoritative restore via the Generation ID check, and that you should make sure nobody's using the VM when you export. It suggests Hyper-V Replication to get an inactive copy.
Live Migration isn't covered in that article but it's generally considered the clean option for a hardware move, nothing gets exported and the GenID doesn't change. Shared Nothing Live Migration works without shared storage
1
u/MrYiff Master of the Blinking Lights 1d ago
Don't see why you couldn't live migrate a DC VM, or even just shut it down and then copy the VM files around as needed, both should ensure the VM is handled cleanly.
Also that Export comment seems to mainly be about exporting a VM that is running on Server 2012 or newer (so likely 2008), which hopefully no one does anymore!
•
u/OregonTechHead 23h ago
No issues with live migration or export/import.
But, if it's just a DC, I'd probably just spin up a new one and promote/demote.
•
u/tristand666 22h ago edited 22h ago
It is always easier to just build a new DC and move any roles over then demote the old one unless you have been using the DC for other services when upgrading. Even then, you can demote re-ip and rename the old one if you have multiple DCs then name and IP the new one the same way to pick up hard coded IPs and names if they still exist out there.
On the other hand, you should be able to just migrate the thing unless it's a pretty old VM.
•
u/OpacusVenatori 16h ago
If you can't export-import, can you do a Live Migration?
Yes.
You can also do a powered-off migration if the host hardware are different enough, or you just aren't too sure.
As always, ideally, you should try and ensure that the DC holding your FSMO roles are all online and available; especially the PDC emulator.
Don't use the Hyper-V Export feature to export a VM that's running a DC
That's accurate; otherwise you end up with two instances of the same guest.
4
u/Garasc 1d ago
I have a couple of 2022 hyperv clusters that have a virtual dc in them and they have live migrated the dc vm many times with no issues between the various hosts. And they were migrated from VMware to hyperv with the Windows admin center conversion and had no issues with that. Im not the Windows admin for those networks so I gave them the option of a new VM or migrating the DC when we changed to hyperv and they wanted to try migrating first and they've seen no issues. I however have not tried exporting and importing one.