I needed to migrate 3 Domain controllers from an old Datacenter Vmware 5.5 to the new vmware 6.5 infrastructure for a technological refresh.
Given that the best solution from Microsoft is the best practice is to create new VMs and promote them Domain Controllers and transfer FSMO roles.
That said, there are scenarios like mine, where this type of approach was not possible as it was mandatory to maintain the same FQDN and IP address due to application configuration problems.
Microsoft advised against demoting and promoting a DC with a different OS but with the same FQDN and IP, even if my environment was relatively small 3 DC one forest \ domain and not complex it could be done with the metadata cleanup procedure but the customer did not give the approval. So I have adopted the solution of Vm replica.
Scenario:
Virtual Environment:
vCenter Win:
Vmware 5.5.0 - build 2646482
VMware ESXi 5.5.0 - build 3029944
VCSA 6.7.0 - build 15129973
VMware ESXi 6.5.0 - build 15256549
Active Directory Enviroment:
- Remember that from the Windows 2012 R2 version it is possible to clone a DC through the official MS procedure.https://social.technet.microsoft.com/wi ... guide.aspx
https://www.interfacett.com/videos/clon ... ontroller/
AD Single Forest\Domain: functional level 2012 R2:
- If you have distributed FSMO roles on different DCs move them on a single DC before migration and carry out the preparatory checks post moving FSMO roles.
- DC01 all FSMO roles- Primary DNS - Sync time Externa NTP
Forest Role:
Master scheme
Domain name master
Domain role:
RID Master
PDC emulator
Master Infrastructure
- DC02 - Secondary DNS
- DC03
Veeam backup Enviroment: 9.5 U4
- Step by step check & migraion:
If possible, before proceeding with production, it is recommended to test everything in a laboratory and / or pre-production environment.
- First of all check the UUID of the 3 DCs:
- IMPORTANT ** Never change UUID to a Domain Controller. The GUID is the means for AD to identify a DC for replication. It is important that it remains unchanged, above all, unique for each DC).
- VM migration export and import generates new vHw device UUIDs, the new UUIDs for devices such as NICs tends to trigger re-activation windows license of the VM.
- wmic csproduct get "uuid" ( if UUID changes the windows license it will be reset and could also corrupt the active direcory db and \ or have replication problems etc).
- Save the UUIDs of each DC.
- Set up a replication job (Application aware enable & Domain Admin user, from Active directory it is possible to give granular permissions to a single users) for each single DC starting from the DCs without FSMO role.
- Assigning the backup service user "domain.local\service_veeam" "Domain Admin" and deny "interactive logon" and other restricition Deny "Logon as a Batch" 'or' "Deny Logon as a service" etc depends on your needs.
https://docs.microsoft.com/en-us/window ... ive-models
Task 1:
DC3 - no FSMO only DNS:
- Check FSMO roles:
from dos:
netdom query fsmo
frome PS:
Get-ADForest "domain.local" | ft DomainNamingMaster, SchemaMaster
Get-ADDomain "domain.local" | ft InfrastructureMaster, PDCEmulator, RIDMaster
- Disable the DC3 node from the virtual service of the netscaler load balancer. (optional)
- Full backup Active Directory (system state)dei 3 DC (VM Online).
- Precautionary reboot
- Shutdown DC3 Windows 2012 R2.
- Incr backup (VM power Off).
- Lunch Veeam Replica (VM power Off)
- Veeam Failover Now ---> start up VM DC03_Replica on new DC Vmware.
- Check & compare UUID on replicated DC3_Replica --> wmic csproduct get "UUID"
- Check functionality of new DC3_replica + check replication and check health AD status.
nltest /dclist:doamin.local
nltest /dclist:doamin.local
dsquery server -domain "doamin.local" | dsget server -isgc -dnsname
DsQuery Server -o rdn -Forest
netdom query fsmo
repadmin.exe /showrepl
repadmin.exe /replsum %computername%
dcdiag
netdiag.exe
- If you encounter problems from Veeam --->"Undo Failover" and turn on the old DC previously off.
- Check event viewer for AD service.
- no problems found --> Veeam --> "Permanent Failover"
- Removal of Veeam replica if confidant ---> Veeam "Permanent Failover"
- Reactivation of the Netscaler DC3 side balancing node. (optional)
Task 2:
DC2 - no FSMO only secondary DNS - perform the previous steps of DC3
- Disable the DC2 node from the virtual service of the netscaler load balancer. (optional)
Task 3:
DC01 all FSMO roles:
- Moving fsmo role from DC1 to DC2
Move-ADDirectoryServerOperationMasterRole -Identity "dc2.domain.local" -OperationMasterRole SchemaMaster, DomainNamingMaster, PDCEmulator, RIDMaster, InfrastructureMaster
- Waiting for replication check, check time domain etc.
- Disable the DC1 node from the virtual service of the netscaler load balancer. (optional)
- Full backup Active Directory (system state)dei 3 DC (VM Online).
- Precautionary reboot
- Shutdown DC1 Windows 2012 R2.
- Incr backup (VM power Off).
- Lunch Veeam Replica (VM power Off)
- Veeam Failover Now ---> start up VM DC01_Replica on new DC Vmware.
- Check & compare UUID on replicated DC1_Replica --> wmic csproduct get "UUID"
- Check functionality of new DC1_replica + check replication and check health AD status.
nltest /dclist:doamin.local
nltest /dclist:doamin.local
dsquery server -domain "doamin.local" | dsget server -isgc -dnsname
DsQuery Server -o rdn -Forest
netdom query fsmo
repadmin.exe /showrepl
repadmin.exe /replsum %computername%
dcdiag
netdiag.exe
- If you encounter problems from Veeam --->"Undo Failover" and turn on the old DC previously off.
- No problems found --> Veeam --> "Permanent Failover"
- Check event viewer for AD service.
- Removal of Veeam replica ---> Veeam "Permanent Failover"
- Reactivation of the Netscaler DC1 side balancing node. (optional)
- Moving fsmo role da DC2 a DC1 + wait active directory replication or force it & check preparatory post fsmo roles move:
nltest /dclist:doamin.local
nltest /dclist:doamin.local
dsquery server -domain "doamin.local" | dsget server -isgc -dnsname
DsQuery Server -o rdn -Forest
netdom query fsmo
repadmin.exe /showrepl
repadmin.exe /replsum %computername%
dcdiag
netdiag.exe
- Moving FSMO roles da DC2 a DC1 + wait Active Directory replication or force it & check AD status healt post fsmo roles move.
- reconfigure NTP server on DC1
w32tm /config /manualpeerlist:"Ip your external time sync server" /syncfromflags:manual /reliable:yes /update
net stop w32time
net start w32time
- Confirm that the server is configured correctly:
w32tm /monitor
w32tm /query /status
- Run the command on two DCs that are not PDC DC02 and DC03.
w32tm /config /syncfromflags:domhier /update
w32tm /resync /nowait
net stop w32time
net start w32time
w32tm /query /configuration
- Check that the configured time server is reachable from the PDC.
w32tm /stripchart /computer:"Ip your external time sync server" /samples:3 /dataonly
- Check the correct domain time on the servers and clients
- Create a user, a group and verify that the objects are replicated on all DCs.
- Create a file in the sysvol and verify the correct replication of the file on the sysvol of the DC partners.
- Check Ip DNS forwarder.
Migration completed successfully ..
you are free to comment, if you liked the step by step guide you can contact me on the forum for a donation.
Thank you Veeam for good software!
thanks