Upgrade Domain Controllers Hosting Multiple Roles

spiceuser-kidtu · 2024-06-13T20:56:30.917Z

Our domain has 3 domain controllers running on Windows Server 2012 R2. I am working on a plan to stand up new servers and promote them into the DC role and demote the existing ones.

Multiple roles have been installed on one or more DCs, including File and iSCSI Services, Windows Deployment Services, AD Lightweight Directory Services, DNS, DHCP, and Certificate Services.

I am planning to host only DNS & (possibly) DHCP Services on the new DCs. I’ll move the other services to dedicated servers or decommission them if they are no longer needed.

At a high level, my plan is to:

Migrate certificates services to two new servers (a Root CA and a Subordinate CA). The Root CA would not be domain joined.
Decommission unused services
Migrate remaining services to dedicated domain joined servers
Promote new servers to the DC role
Demote existing servers from the DC role

I am hoping to get some insight to these questions.

Is this a workable plan?
Is the sequence of the steps ok?
I understand that each of these steps will consist of several additional steps but, at a high level, have I overlooked anything?

Thanks for any thoughts or insight you have.

Rod-IT · 2024-06-13T21:37:29.851Z

Good plan, so many people join the root to the domain, and you shouldn’t.
Also a good plan
Migration, good.
Tick
Don’t do this too quickly, make sure replication is good and turn off the old for a few days to ensure all is well before decommissioning them.

Don’t forget to update your DHCP scope to use the new DCs as the DNS source and be sure you go round and manually change static IPs/DNS accordingly.

PatrickFarrell · 2024-06-13T21:40:43.858Z

That’s a great plan. You do not want a CA on your DC if you can avoid it. Your root CA should be offline, so after you create it and issue the cert for the Sub CA, shut the VM down and leave it off.

DNS should be on the DC. That’s fine to leave.
Microsoft best practice for security is that DHCP is not hosted on domain controllers. Everybody does it, but you technically shouldn’t. Separate if feasible. Have 2, put them in a DHCP failover relationsip.

Are you using lightweight directory services?
What are you doing with file/iscsi services?
WDS definitely should not be on a DC.

The biggest hurdle you have is spinning up the new enterprise PKI in my opinion. Once you get that done the rest is easy.

You will need to update DHCP scopes (as well as any static assigned devices) with the IP addresses of the new DNS servers.

Make sure have your DNS properly set up on your DCs both the existing and the new ones: Active Directory DNS Refresher

Rod-IT · 2024-06-13T21:43:12.536Z

PatrickFarrell:

The biggest hurdle you have is spinning up the new enterprise PKI in my opinion

I concur.

PatrickFarrell:

Microsoft best practice for security is that DHCP is not hosted on domain controllers.

I also concur, but didn’t mention it because

PatrickFarrell:

Everybody does it

PatrickFarrell · 2024-06-13T22:10:13.023Z

That’s how it goes. There’s what you want and what you can actually get. You make sacrifices when you are constrained by the decisions of people above you. I can probably guarantee you OP isn’t still running 2012 because they have a nostalgic fondness for it

spiceuser-kidtu · 2024-06-14T20:03:36.530Z

Thank you @PatrickFarrell and @Rod-IT for your replies and insights.

I will begin to plan migrating certificate services to new dedicated servers.