Hero Banner

Products Discussions

Share best practices and get the latest Microsoft product info

Reply
Arkom
Level 1 Contributor

Planning to upgrade AD 2008 R2 to AD 2016

Hi Microsoft Support 

I planning to upgrade AD 2008 R2 to AD 2016. The current environment information as below:

1. Active Directory Windows 2008 R2

2. Domain function level is Windows server 2003

3. Forest function level is Windows server 2003

4. Exchange 2010 SP3 RU19 running on Windows 2008 R2

I have some business application server running on windows server 2003 R2 ( No planning upgrade now). 

My question is:

1.  Can I upgrade the active directory to Windows server 2016 (if I do not need to up Domain function level )?  

2. What any affect to Exchange server 2010 ? 

3. What any concern about this upgrade?

Thank you

Arkom

 

 

6 REPLIES 6
rachelgomez_123
Level 5 Contributor

The recommended way to upgrade a domain is to promote new servers to DCs that run a newer version of Windows Server and demote the older DCs as needed. This method is preferable to upgrading the operating system of an existing DC, which is also known as an in-place upgrade.

Follow these general steps before you promote a server to a DC that runs a newer version of Windows Server:

Verify the target server meets the system requirements.

Verify application compatibility.

Review recommendations for moving to a newer version of Windows Server.

Verify security settings.

Check connectivity to the target server from the computer where you plan to run the installation.

Check for availability of the necessary Flexible Single Master Operation (FSMO) roles in Active Directory. This step is required for the following scenarios:

To install the first DC that runs the latest Windows Server version in an existing domain and forest, the machine where you run the installation needs connectivity to:
The schema master to run adprep /forestprep.
The infrastructure master to run adprep /domainprep.
To install the first DC in a domain where the forest schema is already extended, you only need connectivity to the infrastructure master.
To install or remove a domain in an existing forest, you need connectivity to the domain naming master.
Any DC installation also requires connectivity to the RID master.
If you're installing the first read-only DC in an existing forest, you need connectivity to the infrastructure master for each application directory partition, which is also known as a non-domain naming context.
To find out which server or servers hold which FSMO role, run the following commands in an elevated PowerShell session by using an account that's a member of the Domain Admins group:

PowerShell

Copy
Get-ADDomain | FL InfrastructureMaster, RIDMaster, PDCEmulator
Get-ADForest | FL DomainNamingMaster, SchemaMaster

 

Greeting,

Rachel Gomez

terrylee
Level 4 Contributor

Hello, @Arkom, it is quite a complex procedure that includes setting up the new servers, migrating the FSMO roles, DNS and DHCP servers operations, migrating the Certificate Authority and the NPS roles, and decommissioning the old servers as a final result.

 

Check this helpful step-by-step guide to see all the details. Don't forget to backup your MO365 accounts, it is vital in our times when data is the life and money of your organization and any day can bring the risks of cyberattacks or ransomware issues.

pedramxp
Visitor 1

Hi,

you have to install at least Exchange 2010 SP3 RU22. otherwise Exchange 2010 doesn't support ADC2016  schema

Cheers

DSPatrick
Level 6 Contributor

As long as the 2003 domain controllers are gone 2003 DFL/FFL is supported.

https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-functional-levels

See the support matrix here.

https://technet.microsoft.com/en-us/library/ff728623%28v=exchg.150%29.aspx?f=255&MSPPError=-2147217396

https://blogs.technet.microsoft.com/rmilne/2018/06/21/exchange-2010-support-for-windows-server-2016-domain-controllers/

 As to concerns; I would not do an in-place upgrade. Always much safer to clean install. 

 I'd use dcdiag / repadmin tools to verify health correcting all errors found before starting. Then I'd stand up the new 2016, patch it fully, license it, join existing domain, add active directory domain services, promote it also making it a GC (recommended), transfer FSMO roles over (optional), transfer pdc emulator role (optional), use dcdiag / repadmin tools to verify health, when all is good you can decommission / demote old one.

 

 

 

Arkom
Level 1 Contributor

Hi DSPatrick

Thank you for your reply information. 

Arkom

DSPatrick
Level 6 Contributor

You're welcome.