AD domain controller upgrade requirements
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit 62c6c45 · +57 −54 lines · also on GitHub
11
---
2
−title: Upgrade Domain Controllers to a newer version of Windows Server
3
−description: This document describes how to upgrade from an earlier version of Windows Server to a later version 2022
2
+title: Upgrade domain controllers to a newer version of Windows Server
3
+description: This article describes how to upgrade from an earlier version of Windows Server to a later version.
44
ms.author: daveba
55
author: PatAltimore
66
manager: daveba
77
ms.date: 12/16/2021
88
ms.topic: article
99
---
10
−# Upgrade Domain Controllers to a newer version of Windows Server
10
+# Upgrade domain controllers to a newer version of Windows Server
1111
1212
>Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016
1313
14
−This topic provides background information about Active Directory Domain
15
−Services in Windows Server and explains the process for upgrading domain controllers from an earlier version of Windows Server.
14
+This article provides background information about Active Directory Domain Services in Windows Server and explains the process for upgrading domain controllers (DCs) from an earlier version of Windows Server.
1615
1716
## Prerequisites
1817
19
−The recommended way to upgrade a domain is to promote new servers to domain controllers (DCs) that run a newer version of Windows Server and demote the older domain controllers as needed. This method is preferable to upgrading the operating system of an existing domain controller, also known as an in-place upgrade. This list covers general steps to follow before you promote a server to a domain controller that runs a newer version of Windows Server:
18
+The recommended way to upgrade a domain is to promote new servers to DCs that run a newer version of Windows Server and demote the older DCs as needed. This method is preferable to upgrading the operating system of an existing DC, which is also known as an in-place upgrade.
2019
20
+Follow these general steps before you promote a server to a DC that runs a newer version of Windows Server:
21
+
2122
1. Verify the target server meets the [system requirements](../../../get-started/hardware-requirements.md).
2223
1. Verify application compatibility.
2324
1. Review recommendations for moving to a newer version of Windows Server.
2425
1. Verify security settings.
2526
1. Check connectivity to the target server from the computer where you plan to run the installation.
26
−1. Check for availability of the necessary Flexible Single Master Operation (FSMO) roles in Active Directory. This is required for the following scenarios:
27
− - To install the first DC that runs the latest Windows Server version in an existing domain and forest, the machine where you run the installation needs connectivity to the **schema master** in order to run `adprep /forestprep` and the **infrastructure master** in order to run `adprep /domainprep`.
27
+1. Check for availability of the necessary Flexible Single Master Operation (FSMO) roles in Active Directory. This step is required for the following scenarios:
28
+ - To install the first DC that runs the latest Windows Server version in an existing domain and forest, the machine where you run the installation needs connectivity to:
29
+ - The **schema master** to run `adprep /forestprep`.
30
+ - The **infrastructure master** to run `adprep /domainprep`.
2831
- To install the first DC in a domain where the forest schema is already extended, you only need connectivity to the **infrastructure master**.
2932
- To install or remove a domain in an existing forest, you need connectivity to the **domain naming master**.
30
− - Any domain controller installation also requires connectivity to the **RID master.**
31
− - If you are installing the first read-only domain controller in an existing forest, you need connectivity to the **infrastructure master** for each application directory partition, also known as a non-domain naming context or NDNC.
33
+ - Any DC installation also requires connectivity to the **RID master.**
34
+ - If you're installing the first read-only DC in an existing forest, you need connectivity to the **infrastructure master** for each application directory partition, which is also known as a non-domain naming context.
3235
33
− You can find out which server or servers holds which FSMO role by running the following commands in an elevated PowerShell session, using an account that is a member of the Domain Admins group:
36
+ To find out which server or servers hold which FSMO role, run the following commands in an elevated PowerShell session by using an account that's a member of the Domain Admins group:
3437
3538
```PowerShell
3639
Get-ADDomain | FL InfrastructureMaster, RIDMaster, PDCEmulator
⋯ 6 unchanged lines
4346
4447
|Installation action|Credential requirements|
4548
| ----- | ----- |
46
−|Install a new forest|Local Administrator on the target server|
47
−|Install a new domain in an existing forest|Enterprise Admins|
48
−|Install an additional DC in an existing domain|Domain Admins|
49
−|Run `adprep /forestprep`|Schema Admins, Enterprise Admins, and Domain Admins|
50
−|Run `adprep /domainprep`|Domain Admins|
51
−|Run `adprep /domainprep /gpprep`|Domain Admins|
52
−|Run `adprep /rodcprep`|Enterprise Admins|
49
+|Install a new forest.|Local admin on the target server|
50
+|Install a new domain in an existing forest.|Enterprise admins|
51
+|Install an additional DC in an existing domain.|Domain admins|
52
+|Run `adprep /forestprep`.|Schema admins, enterprise admins, and domain admins|
53
+|Run `adprep /domainprep`.|Domain admins|
54
+|Run `adprep /domainprep /gpprep.`|Domain admins|
55
+|Run `adprep /rodcprep`.|Enterprise admins|
5356
5457
## Supported in-place upgrade paths
5558
56
−Only 64-bit version upgrades are supported. For more information about supported upgrade paths, see [Supported Upgrade Paths](../../../get-started/supported-upgrade-paths.md).
59
+Only 64-bit version upgrades are supported. For more information about supported upgrade paths, see [Supported upgrade paths](../../../get-started/supported-upgrade-paths.md).
5760
5861
## Adprep - forestprep and domainprep
5962
60
−If you are doing an in-place upgrade of an existing domain controller, you need to run `adprep /forestprep` and `adprep /domainprep` manually. `Adprep /forestprep` needs to be run only once in the forest for each newer version of Windows Server. `Adprep /domainprep` needs to be run once in each domain in which you have domain controllers that you are upgrading for each newer version of Windows Server.
63
+For an in-place upgrade of an existing DC, you must run `adprep /forestprep` and `adprep /domainprep` manually. You need to run `Adprep /forestprep` only once in the forest for each newer version of Windows Server. Run `Adprep /domainprep` once in each domain in which you have DCs that you're upgrading for each newer version of Windows Server.
6164
62
−If you are promoting a new server to a domain controller you do not need to run these manually. These are integrated into the PowerShell and Server Manager experiences.
65
+If you're promoting a new server to a DC, you don't need to run these command-line tools manually. They're integrated into the PowerShell and Server Manager experiences.
6366
64
−For more information on running adprep see [Running Adprep](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd464018(v=ws.10))
67
+For more information on running adprep, see [Running Adprep](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd464018(v=ws.10)).
6568
66
−## Functional level features and requirements
69
+## Functional-level features and requirements
6770
68
−Windows Server 2019 or later requires a Windows Server 2008 forest functional level as a minimum. Windows Server 2016 requires a Windows Server 2003 forest functional level as a minimum. If the forest contains domain controllers running an older forest functional level than the operating system supports, the installation is blocked. Those domain controllers must be removed and the forest functional level raised to a version that is supported prior to adding newer Windows Server domain controllers to your forest. See [Forest and domain functional levels](../active-directory-functional-levels.md) for more information about supported functional levels.
71
+Windows Server 2019 or later requires a Windows Server 2008 forest functional level as a minimum. Windows Server 2016 requires a Windows Server 2003 forest functional level as a minimum. If the forest contains DCs running an older forest functional level than the operating system supports, the installation is blocked. Those DCs must be removed and the forest functional level raised to a version that's supported prior to adding newer Windows Server DCs to your forest. For more information about supported functional levels, see [Forest and domain functional levels](../active-directory-functional-levels.md).
6972
7073
> [!NOTE]
71
−> There have been no new forest or domain functional levels added since Windows Server 2016. Later operating system versions can and should be used for domain controllers, however they use Windows Server 2016 as the most recent functional levels.
74
+> No new forest or domain functional levels have been added since Windows Server 2016. Later operating system versions can and should be used for domain controllers. They use Windows Server 2016 as the most recent functional levels.
7275
73
−### Rolling back functional levels
76
+### Roll back functional levels
7477
75
−After you set the forest functional level to a certain value, you cannot roll back or lower the forest functional level, with the following exceptions:
78
+After you set the forest functional level to a certain value, you can't roll back or lower the forest functional level, with the following exceptions:
7679
77
−- If you are upgrading from Windows Server 2012 R2 forest functional level, you can roll back to Windows Server 2012 R2.
78
−- If you are upgrading from Windows Server 2008 R2 forest functional level, you can roll back to Windows Server 2008 R2.
80
+- If you're upgrading from Windows Server 2012 R2 forest functional level, you can roll back to Windows Server 2012 R2.
81
+- If you're upgrading from Windows Server 2008 R2 forest functional level, you can roll back to Windows Server 2008 R2.
7982
80
−After you set the domain functional level to a certain value, you cannot roll back or lower the domain functional level, with the following exceptions:
83
+After you set the domain functional level to a certain value, you can't roll back or lower the domain functional level, with the following exceptions:
8184
8285
- When you raise the domain functional level to Windows Server 2016 and if the forest functional level is Windows Server 2012 or lower, you have the option of rolling the domain functional level back to Windows Server 2012 or Windows Server 2012 R2.
8386
84
−For more information about features that are available at each of the functional levels, see [Forest and domain functional levels](../active-directory-functional-levels.md).
87
+For more information about features available at each of the functional levels, see [Forest and domain functional levels](../active-directory-functional-levels.md).
8588
86
−## Active Directory Domain Services interoperability with other server roles and Windows operating systems
89
+## Active Directory Domain Services interoperability
8790
88
−Active Directory Domain Services (AD DS) is not supported on the following Windows operating systems:
91
+Active Directory Domain Services isn't supported on the following Windows operating systems:
8992
9093
- Windows MultiPoint Server
9194
- Windows Server Essentials
9295
93
−AD DS cannot be installed on a server that also runs the following server roles or role services:
96
+Active Directory Domain Services can't be installed on a server that also runs the following server roles or role services:
9497
9598
- Microsoft Hyper-V Server
9699
- Remote Desktop Connection Broker
97100
98
−## Administration of Windows Servers
101
+## Administration of Windows Server
99102
100
−Use the Remote Server Administration Tools for Windows 10 or later to manage domain controllers and other servers that run Windows Server. You can run the Windows Server Remote Server Administration Tools (RSAT) on a computer that runs Windows 10 or later.
103
+Use the Remote Server Administration Tools for Windows 10 or later to manage domain controllers and other servers that run Windows Server. You can run the Windows Server Remote Server Administration Tools on a computer that runs Windows 10 or later.
101104
102
−## Step-by-Step for adding a new domain controller with a newer version of Windows Server
105
+## Add a new domain controller with a newer version of Windows Server
103106
104
−The following is a simple example of upgrading the Contoso forest from a previous version of Windows Server to a later version of Windows Server.
107
+The following example shows how to upgrade the Contoso forest from a previous version of Windows Server to a later version.
105108
106
−1. Join the new Windows Server to your forest. Restart when prompted.
109
+1. Join the new Windows Server to your forest. Restart when you're prompted.
107110
108111
109112
110113
1. Sign in to the new Windows Server with a domain admin account.
111
−1. In **Server Manager**, under **Add Roles and Features**, install **Active Directory Domain Services** on the new Windows Server. This will automatically run adprep on the earlier version forest and domain.
114
+1. In **Server Manager**, under **Add Roles and Features**, install **Active Directory Domain Services** on the new Windows Server. This action automatically runs adprep on the earlier version forest and domain.
112115
113116
114117
115
−1. In **Server Manager**, click the yellow triangle, and from the drop-down click **Promote the server to a domain controller**.
118
+1. In **Server Manager**, select the yellow triangle. From the drop-down, select **Promote the server to a domain controller**.
116119
117
− 
120
+ 
118121
119
−1. On the **Deployment Configuration** screen, select **Add a domain controller to an existing forest** and click next.
122
+1. On the **Deployment Configuration** screen, select **Add a domain controller to an existing forest** and select **Next**.
120123
121124
122125
123
−1. On the **Domain Controller options** screen, enter the **Directory Services Restore Mode (DSRM)** password and click next.
124
−1. For the remainder of the screens click **Next**.
125
−1. On the **Prerequisite Check** screen, click **install**. Once the restart has completed you can sign back in.
126
−1. On the earlier version of Windows Server, in **Server Manager**, under tools, select **Active Directory Module for Windows PowerShell**.
126
+1. On the **Domain Controller options** screen, enter the **Directory Services Restore Mode (DSRM)** password and select **Next**.
127
+1. For the remainder of the screens, select **Next**.
128
+1. On the **Prerequisite Check** screen, select **Install**. After the restart has completed, sign in again.
129
+1. On the earlier version of Windows Server, in **Server Manager**, under **Tools**, select **Active Directory Module for Windows PowerShell**.
127130
128131
129132
130
−1. In the PowerShell window use the `Move-ADDirectoryServerOperationMasterRole` to move the FSMO roles. You can type the name of each `-OperationMasterRole` or use numbers to specify the roles. For more information see [Move-ADDirectoryServerOperationMasterRole](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd464018(v=ws.10))
133
+1. In the PowerShell window, use the `Move-ADDirectoryServerOperationMasterRole` cmdlet to move the FSMO roles. You can enter the name of each Operation Master Role or use numbers to specify the roles. For more information, see [Move-ADDirectoryServerOperationMasterRole](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd464018(v=ws.10)).
131134
132135
``` powershell
133136
Move-ADDirectoryServerOperationMasterRole -Identity "DC-W2K16" -OperationMasterRole 0,1,2,3,4
⋯ 1 unchanged line
135138
136139
137140
138
−1. Verify the roles have been moved by going to the new Windows Server, in **Server Manager**, under **tools**, select **Active Directory Module for Windows PowerShell**. Use the `Get-ADDomain` and `Get-ADForest` cmdlets to view the FSMO role holders.
141
+1. To verify the roles were moved, go to the new Windows Server. In **Server Manager**, under **Tools**, select **Active Directory Module for Windows PowerShell**. Use the `Get-ADDomain` and `Get-ADForest` cmdlets to view the FSMO role holders.
139142
140143
141144
142145
143146
144
−1. Demote and remove the earlier Windows Server domain controller. For information on demoting a DC, see [Demoting Domain Controllers and Domains](../../ad-ds/deploy/Demoting-Domain-Controllers-and-Domains--Level-200-.md)
145
−1. Once the server is demoted and removed you can [raise the forest functional and domain functional levels](/troubleshoot/windows-server/identity/raise-active-directory-domain-forest-functional-levels) to the latest version of Windows Server.
147
+1. Demote and remove the earlier Windows Server DC. For information on how to demote a DC, see [Demoting domain controllers and domains](../../ad-ds/deploy/Demoting-Domain-Controllers-and-Domains--Level-200-.md).
148
+1. After the server is demoted and removed, you can [raise the forest functional and domain functional levels](/troubleshoot/windows-server/identity/raise-active-directory-domain-forest-functional-levels) to the latest version of Windows Server.
146149
147
−## Next Steps
150
+## Next steps
148151
149
−- [What's New in Active Directory Domain Services Installation and Removal](../../ad-ds/deploy/What-s-New-in-Active-Directory-Domain-Services-Installation-and-Removal.md)
152
+- [What's new in Active Directory Domain Services installation and removal](../../ad-ds/deploy/What-s-New-in-Active-Directory-Domain-Services-Installation-and-Removal.md)
150153
- [Install Active Directory Domain Services (Level 100)](../../ad-ds/deploy/Install-Active-Directory-Domain-Services--Level-100-.md)
151
−- [Windows Server Functional Levels](../active-directory-functional-levels.md)
154
+- [Windows Server functional levels](../active-directory-functional-levels.md)
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 23:52 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.