Adding a Windows Server 2019/2016 Domain Controller

KB ID 0001262

Problem

Once upon a time, adding a domain controller that was running a newer version of the Windows Server family involved opening command line and schema prepping, and GP prepping etc. Now all this happens in the background while the wizard is doing the heavy lifting for you.

Solution

2008 to 2019

2008 to 2016

Obviously the server needs to be a domain member first!

  • For Server 2019 Forest and Domain Functional levels need to be at ‘Windows Server 2008‘. (The documentation says 2008 R2, but Server 2008 also works flawlessly).
  • For Server 2016 Forest and Domain Functional levels need to be at ‘Windows Server 2003‘.

Before You Start!

Remember if your ‘retiring’ domain controller is also a DNS/DHCP server you will also need to address that, and make sure you don’t have a service or device that queries the old domain controller directly (Radius Devices, Firewalls, RSA Appliances, Proxy Filters, Security door software, etc).

Procedure

With a vanilla install Server Manager will open every time you boot, (unless you’ve disabled it!) To open it manually, run ‘servermanager.exe’  > Manage > Add Roles and Features.

2016-server-manager

I usually tick the ‘Skip this page by default’ option > Next.

2016 Server Adding Roles

Role Based… > Next.

Windows Server 2016 Roles

Ensure the local server is selected, (if you are managing another server, you can of course do the role install from here as well, but let’s keep things simple) > Next.

2016 Server Add Local Role

Select Active Directory Domain Services > Next.

2016 Active Directory Role

Next.

2016 Domain Controller Adding

Next.

Active Directory Services 2016

Ensure ‘Restart’ is selected > Next.

008-2016-add-active-directory

Next.

009-role-installed

Promote Windows Server To Domain Controller

Back in Server Manager > In the ‘Notifications’ section, click the warning triangle > ‘Promote This Server To Domain Controller’.

010-2016-promote-to-domain-controller

Assuming you already have a domain, and this is not a greenfield Install > Add a domain controller to an existing domain > Next.

011-2016-dcpromo

Type and confirm a Directory Services Restore Mode Password (DSRM,) make it something you will remember in a crisis, or store it securely somewhere > Next.

012-2016-dsrm-password

This is fine, You see this error because it’s trying to create a delegation for this DNS zone, and there isn’t a Windows server above you in the DNS hierarchy. For example if your domain name is petelnetlive.co.uk > Then I do not have access to create a delegation in the .co domain space. (So you can safely ignore) > Next

013-2016-dns-delegation

If you have a backup of AD you can ‘Install From Media’. This used to be handy on remote sites that had awful bandwidth, as it saved you having to replicate a large Active Directly over a ‘pants’ connection > I’ve not had to do that in a long time > Next.

2016 Active Directory Install From Media

Unless you want to change the default AD install locations > Next.

2016 AD install Location

Next.

Review 2016 Domain Install

Read any warnings  > Install

2016 Domain Pre-Requisites

Go have a coffee, we ticked ‘reboot’ earlier so it will complete, then reboot the server, which will come back up as a domain controller.

Reboot Domain Controller

You will notice, (if you’re interested,) that your schema version is now 88 (Server 2019), or 87 (Server 2016).

Schema Version 88 2019

 

2016 Schema Version

Find out your Domain Schema Version

Related Articles, References, Credits, or External Links

NA

Author: PeteLong

Share This Post On

35 Comments

  1. Amazing guide. Excellent Job.

    Post a Reply
  2. Thank you mister !
    Very clean guide.

    Post a Reply
    • You’re Welcome ThanQ 🙂

      Post a Reply
  3. Wow, this is what I would have expected to be available from Microsoft directly.
    Great Job, thank you!

    Post a Reply
  4. What about adprep commands? Should we be running them on the previous domain controller such as Server 2008 R2?

    Post a Reply
    • No not any more, it’s all handled for you 🙂

      Post a Reply
  5. Apologies if this qualifies as a non-smart question but is the process of adding a server 2016 DC to 2008r2 a solid process that should work without any caveats or warnings?
    I have a 2008r2 domain raised to highest FFL DFL.

    Hate tp be overly cautious but never hurts to ask.

    Post a Reply
  6. Excellent walkthrough. Thank You.

    Post a Reply
  7. The crucial part is to have a coffe after rebooting the machine 😀

    Many thanks, it was very helpful!

    Post a Reply
  8. This is very nice. Say, I have a Windows Server 2012 as my primary AD, and I do this steps, can I turn off my old 2012 AD and make 2016 my new primary, and add a 2nd 2016 as a backup, following all these steps again?

    Post a Reply
    • You would need to demote the 2012 DC before you powered it down, there’s not really a concept of Primary and Backup any more, that’s NT4 terminology. There are FSMO roles but they will move gracefully if you demote your old 2012 DC before you retire it.

      Pete

      Post a Reply
  9. It’s very helpful. Thanks for sharing

    Post a Reply
  10. just used this and it still works like a charm.

    Post a Reply
  11. Thank you VM! Great article

    Post a Reply
  12. in a Domain Controller running Windows 2003, can we introduce a Windows 2016 Domain Controller with no issues? Will servers running Windows 2003 (don’t ask 🙂 ) have issues ?

    We have 1 DC (windows 2003) plan is to raise Domain and Functional level to 2016.

    1. install 2016 server, raise as DC
    2. switch all the FSMO roles to the new server
    3. install a 2nd 2016 server, raise as DC
    4. demote the 2003 DC
    5. decommission the 2003 server
    6. Raise the Doamin and Functional level (in steps 1st to 2008 R2, then 2012 R2 and finally to 2016)

    question is if we have windows 2003 servers in the environment, will there be any issues

    Post a Reply
    • You should be fine a 2016 DC will support a 2003 Domain and Forest Functional Level, (check your’s is NOT set to 2000 or the upgrade will fail!)

      P

      Post a Reply
  13. Thank you for this how to.
    We currently have 4 DCs in our environment, 1 2008R2, 2 2012R2 and 1 2016.
    One of the warnings that appeared was about migrating from FRS to DRS. Will demoting and removing the 2008R2 resolve that issue on its own, or will a migration still happen? Also will the same happen with regards to the KB 942564?

    Post a Reply
  14. I am going to give these instructions a run for their money. This weekend I am adding a Windows 2016 server to a 2008 r2 domain. I will let you know how it goes. is there any consideration for the current desktops, or do they just go on as they were. I mean first they login to a 2008 domain, then when I am done they will be logging into a 2016 domain. Anything to be concerned about? thank you ahead of time. Wish me luck! TFI

    Post a Reply
    • That should be fine make sure the domain and forest functional levels are not something daft like windows server 2003 fist mind! Your clients wont really care, replacing old servers with new servers is not really a problem until you have OLD clients taking for shared folders on new servers, (as SMB1 no longer works). But that wont affect your domain controllers. In fact watch this space, I might put another video up in this post before the weekend to walk you though it.

      Post a Reply
  15. We have 2008R2 DC and i have already joined 2016 to the domain. The tree is 2008R2. The 2008R2 is DC and DNS but not DHCP. It does delegate printers with group policy, and has Windows Update Services working.

    My plan is to add the 2016 as a DC, move the master roles to the 2016, then demote the 2008R2, then finally remove it totally.

    Then finally format, and install 20016 on the old 2008R2, and add it back as a second dc.

    I can change the DNS setting in my DHCP server for the workstations to work.

    What about Windows Update Services?

    What about Printer Deployment — Group Policy 2008 is currently printer server.

    Post a Reply
    • I would simply instal WSUS from scratch on a new server? You can migrate printers by installing the print server role on the new server and doing an import/export from the NEW print server, though if the old one has a lot of x32 bit drivers on it, it’s usually quicker to start from scratch.

      Post a Reply
  16. What about the DNS nic settings on the new Windows 2016/2019 server that will become your new domain controller? I’ve got one 2008R2 DC and another 2012R2 DC. I will be demoting the 2008R2. For the new 2019 server, I will point the primary DNS to the 2012R2 DC initially to join the domain. At what point do you modify the Primary DNS on the 2016/2019 server to point to itself? Is this done before, or after adding Active Directory roles?

    Post a Reply
    • Typically after it’s promoted you will see 127.0.0.1 added automatically, (but it wont bye at the top of the list), I manually change this afterwards, to is looks to itself FIRST after it’s been promoted.
      P

      Post a Reply
  17. Hi , great video tutorial , but, i don’t undestand why , you don’t change the forest functional levels to at least Windows 2016 in the 2019 new DC in your video ( 2008 to 2016)

    Why we cannont choose 2019 forest functional level in the 2019 PDC
    We must change forest functional level step by step ?

    Thank you

    Post a Reply
    • Because in all my time, the only time I’ve ever needed to change a DFL or a FFL is when I’m ‘about’ to upgrade something, why change it ‘after’ I’ve upgraded something (as its non reversible), I’ve never been picked up in an audit because my DFL or FFL was to old. 🙂 Why potentially break something that cant be fixed, for the sake of cosmetics? (just my $0.02).

      Post a Reply
  18. Hello Pete. I realize this is an older article. But, i have a question regarding multiple domain controllers. we have 8 DCs in our domain. If I replace the Dc which holds the fsmo roles with a 2016 DC and transfer the fsmo roles to the 2016 Dc, do I have to upgrade the remaining 2008 DCs immediately? Or can that be done later?

    Thanks in advance for your help.

    Post a Reply
      • Thanks for your quick response. After adding the 2016 DC and transferring roles, does that in itself raise the functional levels? Or is that done manually?

        Also, a question that was posed to me today. Is it possible to change the IP address of a DC? I remember being told in the past that changing IP address was not allowed.we have some apps that point to the address of the dc which currently holds all of the fsmo roles. The thought is we could change the ip address of the current dc, assign that ip address to the 2016 dc and assign a new ip address to the 08 dc. is this just asking for trouble?

        Post a Reply
        • You need to raise the levels manually.

          If you change the IP on a DC (with or without FSM|O roles,) simply reboot it afterwards.

          Pete

          Post a Reply
          • Thanks a lot for your quick response. So, we will just wait until the last of the 08 DCs have been removed and raise the functional levels.

          • Correct.

Submit a Comment

Your email address will not be published. Required fields are marked *