AD domain controller upgrade requirements
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit 1ce5c01 · +37 −40 lines · also on GitHub
⋯ 6 unchanged lines
77
ms.date: 12/16/2021
88
ms.topic: article
99
---
10
−# Upgrade Domain Controllers to new version of Windows Server
10
+# Upgrade Domain Controllers to a newer version of Windows Server
1111
12
−>Applies to: Windows Server 2022, Windows Server 2019, Windows Server
12
+>Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016
1313
1414
This topic provides background information about Active Directory Domain
1515
Services in Windows Server and explains the process for upgrading domain controllers from an earlier version of Windows Server.
1616
17
−## Pre-requisites
17
+## Prerequisites
1818
19
−The recommended way to upgrade a domain is to promote domain controllers that run newer versions of Windows Server and demote the older domain controllers as needed. That method is preferable to upgrading the operating system of an existing domain controller. This list covers general steps to follow before you promote a domain controller that runs a newer version of Windows Server:
19
+The recommended way to upgrade a domain is to promote new servers to domain controllers (DCs) that run a newer version of Windows Server and demote the older domain controllers as needed. This method is preferable to upgrading the operating system of an existing domain controller, also known as an in-place upgrade. This list covers general steps to follow before you promote a server to a domain controller that runs a newer version of Windows Server:
2020
21
−1. Verify the target server meets system requirements.
22
−1. Verify Application compatibility.
23
−1. Review Recommendations for moving to latest version of Windows Server.
24
−1. Verify security settings. For more information, see [Features removed or no longer developed starting with Windows Server 2019](../../../get-started/removed-deprecated-features-windows-server-2019.md).
21
+1. Verify the target server meets the [system requirements](../../../get-started/hardware-requirements).
22
+1. Verify application compatibility.
23
+1. Review recommendations for moving to a newer version of Windows Server.
24
+1. Verify security settings.
2525
1. Check connectivity to the target server from the computer where you plan to run the installation.
26
−1. Check for availability of necessary operation master roles:
27
− - To install the first DC that runs the latest Windows Server version in an existing domain and forest, the machine where you run the installation needs connectivity to the **schema master** in order to run `adprep /forestprep` and the infrastructure master in order to run `adprep /domainprep`.
26
+1. Check for availability of the necessary Flexible Single Master Operation (FSMO) roles in Active Directory. This is required for the following scenarios:
27
+ - To install the first DC that runs the latest Windows Server version in an existing domain and forest, the machine where you run the installation needs connectivity to the **schema master** in order to run `adprep /forestprep` and the **infrastructure master** in order to run `adprep /domainprep`.
2828
- To install the first DC in a domain where the forest schema is already extended, you only need connectivity to the **infrastructure master**.
2929
- To install or remove a domain in an existing forest, you need connectivity to the **domain naming master**.
3030
- Any domain controller installation also requires connectivity to the **RID master.**
3131
- If you are installing the first read-only domain controller in an existing forest, you need connectivity to the **infrastructure master** for each application directory partition, also known as a non-domain naming context or NDNC.
32
+
33
+ You can find out which server or servers holds which FSMO role by running the following commands in an elevated PowerShell session, using an account that is a member of the Domain Admins group:
34
+
35
+ ```PowerShell
36
+ Get-ADDomain | FL InfrastructureMaster, RIDMaster, PDCEmulator
37
+ Get-ADForest | FL DomainNamingMaster, SchemaMaster
38
+ ```
3239
33
−### Installation steps and required administrative levels
40
+### Installation actions and required administrative levels
3441
35
−The following table provides a summary of the upgrade steps and the permission requirements to accomplish these steps
42
+The following table provides a summary of the installation actions and the permissions requirements to accomplish these steps.
3643
3744
|Installation action|Credential requirements|
3845
| ----- | ----- |
3946
|Install a new forest|Local Administrator on the target server|
4047
|Install a new domain in an existing forest|Enterprise Admins|
4148
|Install an additional DC in an existing domain|Domain Admins|
42
−|Run adprep /forestprep|Schema Admins, Enterprise Admins, and Domain Admins|
43
−|Run adprep /domainprep|Domain Admins|
44
−|Run adprep /domainprep /gpprep|Domain Admins|
45
−|Run adprep /rodcprep|Enterprise Admins|
46
−
47
−For additional information on new features in Windows Server, see [What's new in Windows Server](../../../get-started/whats-new-in-windows-server-2022.md).
49
+|Run `adprep /forestprep`|Schema Admins, Enterprise Admins, and Domain Admins|
50
+|Run `adprep /domainprep`|Domain Admins|
51
+|Run `adprep /domainprep /gpprep`|Domain Admins|
52
+|Run `adprep /rodcprep`|Enterprise Admins|
4853
4954
## Supported in-place upgrade paths
5055
5156
Only 64-bit version upgrades are supported. For more information about supported upgrade paths, see [Supported Upgrade Paths](../../../get-started/supported-upgrade-paths.md).
5257
53
−## Adprep and Domainprep
58
+## Adprep - forestprep and domainprep
5459
55
−If you are doing an in-place upgrade of an existing domain controller, you need to run `adprep /forestprep` and `adprep /domainprep` manually. `Adprep /forestprep` needs to be run only once in the forest. `Adprep /domainprep` needs to be run once in each domain in which you have domain controllers that you are upgrading.
60
+If you are doing an in-place upgrade of an existing domain controller, you need to run `adprep /forestprep` and `adprep /domainprep` manually. `Adprep /forestprep` needs to be run only once in the forest for each newer version of Windows Server. `Adprep /domainprep` needs to be run once in each domain in which you have domain controllers that you are upgrading for each newer version of Windows Server.
5661
57
−If you are promoting a new Windows Server you do not need to run these manually. These are integrated into the PowerShell and Server Manager experiences.
62
+If you are promoting a new server to a domain controller you do not need to run these manually. These are integrated into the PowerShell and Server Manager experiences.
5863
5964
For more information on running adprep see [Running Adprep](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd464018(v=ws.10))
6065
6166
## Functional level features and requirements
6267
63
−Windows Server 2016 or later requires a Windows Server 2003 forest functional level. That is, before you can add a domain controller that runs Windows Server 2016 or later to an existing Active Directory forest, the forest functional level must be Windows Server 2003 or later. If the forest contains domain controllers running Windows Server 2003 or later but the forest functional level is still Windows 2000, the installation is blocked.
64
−
65
−Windows 2000 domain controllers must be removed prior to adding Windows Server 2016 domain controllers or later to your forest. In this case, consider the following workflow:
66
−
67
−1. Install domain controllers that run Windows Server 2003 or later. These domain controllers can be deployed on an evaluation version of Windows Server. This step also requires running `adprep.exe` for that operating system release as a prerequisite.
68
−1. Remove the Windows 2000 domain controllers. Specifically, gracefully demote or forcibly remove Windows Server 2000 domain controllers from the domain and used Active Directory Users and Computers to remove the domain controller accounts for all removed domain controllers.
69
−1. Raise the forest functional level to Windows Server 2003 or higher.
70
−1. Install domain controllers that run Windows Server 2016 or later.
71
−1. Remove domain controllers that run earlier versions of Windows Server.
68
+Windows Server 2019 or later requires a Windows Server 2008 forest functional level as a minimum. Windows Server 2016 requires a Windows Server 2003 forest functional level as a minimum. If the forest contains domain controllers running an older forest functional level than the operating system supports, the installation is blocked. Those domain controllers must be removed and the forest functional level raised to a version that is supported prior to adding newer Windows Server domain controllers to your forest. See [Forest and domain functional levels](../active-directory-functional-levels) for more information about supported functional levels.
7269
7370
### Rolling back functional levels
7471
75
−After you set the forest functional level (FFL) to a certain value, you cannot roll back or lower the forest functional level, with the following exceptions:
72
+After you set the forest functional level to a certain value, you cannot roll back or lower the forest functional level, with the following exceptions:
7673
77
−- If you are upgrading from Windows Server 2012 R2 FFL, you can lower it back to Windows Server 2012 R2.
78
−- If you are upgrading from Windows Server 2008 R2 FFL, you can lower it back to Windows Server 2008 R2.
74
+- If you are upgrading from Windows Server 2012 R2 forest functional level, you can roll back to Windows Server 2012 R2.
75
+- If you are upgrading from Windows Server 2008 R2 forest functional level, you can roll back to Windows Server 2008 R2.
7976
8077
After you set the domain functional level to a certain value, you cannot roll back or lower the domain functional level, with the following exceptions:
8178
8279
- When you raise the domain functional level to Windows Server 2016 or later and if the forest functional level is Windows Server 2012 or lower, you have the option of rolling the domain functional level back to Windows Server 2012 or Windows Server 2012 R2.
8380
84
−For more information about features that are available at lower functional levels, see [Understanding Active Directory Domain Services (AD DS) Functional Levels](../active-directory-functional-levels.md).
81
+For more information about features that are available at each of the functional levels, see [Forest and domain functional levels](../active-directory-functional-levels.md).
8582
86
−## AD DS interoperability with other server roles and Windows operating systems
83
+## Active Directory Domain Services interoperability with other server roles and Windows operating systems
8784
88
−AD DS is not supported on the following Windows operating systems:
85
+Active Directory Domain Services (AD DS) is not supported on the following Windows operating systems:
8986
9087
- Windows MultiPoint Server
9188
- Windows Server Essentials
⋯ 5 unchanged lines
9794
9895
## Administration of Windows Servers
9996
100
−Use the Remote Server Administration Tools for Windows 10 or later to manage domain controllers and other servers that run Windows Server. You can run the Windows Server Remote Server Administration Tools on a computer that runs Windows 10 or later.
97
+Use the Remote Server Administration Tools for Windows 10 or later to manage domain controllers and other servers that run Windows Server. You can run the Windows Server Remote Server Administration Tools (RSAT) on a computer that runs Windows 10 or later.
10198
102
−## Step-by-Step for Upgrading to Windows Server
99
+## Step-by-Step for adding a new domain controller with a newer version of Windows Server
103100
104
−The following is a simple example of upgrading the Contoso forest from am previous version of Windows Server to a later version of Windows Server.
101
+The following is a simple example of upgrading the Contoso forest from a previous version of Windows Server to a later version of Windows Server.
105102
106103
1. Join the new Windows Server to your forest. Restart when prompted.
107104
⋯ 34 unchanged lines
142139
143140
144141
1. Demote and remove the earlier Windows Server domain controller. For information on demoting a DC, see [Demoting Domain Controllers and Domains](../../ad-ds/deploy/Demoting-Domain-Controllers-and-Domains--Level-200-.md)
145
−1. Once the server is demoted and removed you can raise the forest functional and domain functional levels to the latest version of Windows Server.
142
+1. Once the server is demoted and removed you can [raise the forest functional and domain functional levels](../../raise-active-directory-domain-forest-functional-levels) to the latest version of Windows Server.
146143
147144
## Next Steps
148145
⋯ 3 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 18:27 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.