Replacing Domain Controller

Posted by Business_Ad5131@reddit | sysadmin | View on Reddit | 46 comments

Hi everyone,
Hope you're doing great!

I'm currently in the process of replacing one of our Domain Controllers and wanted to get some input or confirmation on a few points.

We currently have two DCs:

DC01-16 – 192.168.100.57 (Windows Server 2016)
DC02-16 – 192.168.100.60 (Windows Server 2016)

I’m replacing DC02-16 with a new server:

DC02-25 – 192.168.100.77 (Windows Server 2025)

The new DC02-25 is already promoted to a Domain Controller and also running DNS and DHCP. As far as I can tell, all services (AD replication, DHCP, DNS) are working correctly except for automatic DHCP failover replication to DC01-16.

My plan is to reassign the old IP address (192.168.100.60) to DC02-25, because many clients still reference that IP in their DNS settings.

Before I make the IP switch, is there anything I should be careful about? For example:

Should I clear DNS caches or old A records on either DC?
Any best practices to avoid issues when reusing an IP for a new machine?
Anything special related to DHCP failover or replication that might be affected?

Any input is appreciated!

Thanks in advance.

[-]

BrainWaveCC@reddit

Your plan is generally fine. You didn't mention setting FSMO roles to new servers, though.

Also, depending on what FFL and DFL you have now, you might need to upgrade the schema.

You'll also want to wait a day and clean up DNS from the old entries.

DHCP failover replication is easy to break and re-establish with the new server.

[-]

Business_Ad5131@reddit (OP)

The FSMO roles are still on DC01-16. The plan is: once DC02-25 is finished, DC01-25 will be introduced to replace DC01-16, and this new server will take over the FSMO roles. Both the FFL and DFL are already set to Server 2016 — I upgraded them a few months ago from 2008 R2, if I remember correctly.
Thanks for your advice!

[-]

Reasonable_Task_8246@reddit

That’s a valid plan of action. I would never run dhcp on a domain controller though.

[-]

Library_IT_guy@reddit

Why is running DHCP on your DCs such an issue? I've heard this said before, but in some environments like ours (less than 150 total devices on network) it doesn't really make sense to buy a separate machine or spin up a new VM which requires more licensing just to run DHCP separately. I get that it makes sense in these 10,000+ device networks, but for smaller orgs?

[-]

BigFrog104@reddit

It seems to only be an issue for consultants and MSP that want to charge extra $ for another server they can bill for. I have no issues putting DHCP on a DC in a datacenter and serving a few thousand clients.

[-]

hobovalentine@reddit

Well you don't even need a physical machine you could just run a few hyper V machines off one machine with each VM offering a specific service as long as long you keep backups so the VMs can be recovered in case something happens.

That way you can reboot one service without affecting all the others but of course in the case of a hardware failure those VMs still rely on the hypervisor but a decent server doesn't typically break down that easily and parts are easy to swap out.

[-]

hobovalentine@reddit

I think it's also the "don't put all your eggs in the same basket" theory so that if say your DNS server fails it won't also take the DHCP server down with it and vice versa.

[-]

fireandbass@reddit

DHCP on a DC is a security risk and not recommended by Microsoft because it runs as the Network Service and on DCs the Network Service is a member of the Enterprise Domain Controllers group which has full privileges to DNS, therefore a DHCP exploit can change any DNS entry, which means the DNS entries for your DCs can be changed to redirect to a compromised or fake server masquerading as your real DC.

https://learn.microsoft.com/en-us/services-hub/unified/health/remediation-steps-ad/disable-or-remove-the-dhcp-server-service-installed-on-any-domain-controllers

[-]

_p00f_@reddit

Thanks for that info. I've heard this a lot to and what you're saying has opened my eyes where security is concerned.

[-]

Serious-City911@reddit

This took me back to Microsoft saying things like DHCP is not supported on a DC and Exchange is not supported on a DC and then they sold SBS where they put everything on the same install.

[-]

SnakeOriginal@reddit

Security is expensive. SBS was not expensive...you get the idea

[-]

Library_IT_guy@reddit

Interesting, thank you! So the issue is that DHCP can change DNS entries on the same server, which could be used for all kinds of nefarious things. That would assume that the server is either accessible to the web though, or the attack comes from the internal network, and that there is an exploit to attack at the time. I mean it's possible but it seems very unlikely and it's a lot of money to spend. It makes sense in a larger environment where spinning up an extra windows server is no big deal, but for a small shop, it's a lot of extra money to combat a scenario that is very unlikely to ever arise.

[-]

kuahara@reddit

You want domain controllers hardened up as much as possible, and they should be completely fungible.

[-]

Business_Ad5131@reddit (OP)

I'm thinking the same. We have around 300 devices, and running DHCP on the DCs works well for us.
No issues so far, except with the new 2025 version — and even then, only related to replication.

[-]

taterthotsalad@reddit

And Id like to add when a security issue is raised, and the first statement goes something like,

...running DHCP on the DCs works well for us.
No issues so far...

This is when I mark that person mentally, I need to double check what they do for security reasons. Esp during Change Management.

[-]

ITGuyThrow07@reddit

You've had no issues except for when you ran into an issue.

This is part of the reason for separating roles to their own server. If one thing breaks, it's just that one thing breaking.

[-]

Stonewalled9999@reddit

I like to run it on a DC so it can autoregister client names for us.

[-]

fireandbass@reddit

Doesn't need to run on a DC to accomplish that.

[-]

Stonewalled9999@reddit

$1200 for a Windows server license......

[-]

ccatlett1984@reddit

Server standard comes with 2vms included.

[-]

Finn_Storm@reddit

Free with MAS or resetting the eval period ;)

[-]

ITGuyThrow07@reddit

For me, it's just a best practice to try to keep each server doing one thing.

With DHCP on a DC, you have two critical services (three, if you count DNS) all running on one box. If any of those services break and you have to troubleshoot(for example, a reboot) now you're affecting all of those servers.

OPs dilemma is a perfect example. They want to replace a DC. If DHCP had been running on another box, they probably wouldn't have had the issue that required them to make this post.

[-]

ScubaMiike@reddit

Yep this works

[-]

Business_Ad5131@reddit (OP)

Sounds like a solid plan, thank you! The tip with the temporary IP and waiting for DNS replication is especially helpful — I’ll definitely bring that up internally and take it into account. Appreciate it!

[-]

T1JNES@reddit

its not that big off a deal and saves some money in licenses except if you insane amounts of dhcp activity

[-]

F1rkan@reddit

Im still reading about weird things with 2025 as DC's , i would stick to 2022 for now

[-]

Quintalis@reddit

I literally just had to nuke my 2025 DC and seize the fsmo roles back to a 2019 server because it refused to replicate after 30 days of being the PDC. Wait on 2025!

[-]

onboarderror@reddit

Like what?

[-]

iamafreenumber@reddit

Here's something from two months ago:

https://www.reddit.com/r/activedirectory/s/KaQL5SUK48

[-]

FatBook-Air@reddit

Hmm. What types of things do you see?

[-]

Adam_Kearn@reddit

Before you switch the IPs I would switch the old server to automatic IP and do a release and renew to get a new ADDRESS.

This should clear the old DNS cache automatically for you. Then you can set the new server back to that IP and reserve it on DHCP

[-]

thebotnist@reddit

Mmm I don't know about that...

[-]

doctorevil30564@reddit

adjust the A record in DNS for the old host's IP address so it points to the IP of the new server if you reassign the IP address as a secondary IP and use that IP strictly for DNS. At least in my opinion that is how to do it. I recently had to retire a server 2019 DC that developed issues after trying to update to the CU from March 2025, if it tried to update the update would fail, or the server would be showing a blue screen of death when I checked it after applying the update and letting it reboot.

I used that method, so anything that was using that DC when you checked it's info would be able to quickly switch over to using the new domain controller instead, and I had way too many devices out in our environment (printers,etc) that were using that DC server's IP address for their secondary IP.

It's been running solid with no issues for over 3 months now like this. I was constantly checking the logs for over a month after the forced migration to the new server to make sure everything was working smoothly.

I'm getting ready to start the process of replacing our last server 2012 DC at an offsite location that I don't directly support, so I will finally be able to start provisioning new Server 2025 domain controllers soon. We just got our Volume License agreement setup so I now have the ability to provision a good number of properly licensed server 2025 VMs in our ProxMox environment with Software Assurance for upgrades, and the correct number of user CAL licenses.

[-]

ibringstharuckus@reddit

As others have said check the FSMO roles and see if it's a global catalog server

[-]

Shot-Document-2904@reddit

I didn’t anything about your FSMO roles. Maybe you know where they are but if you don’t, figure that out first.

[-]

Superb_Golf_4975@reddit

Make sure any hostname-nased DNS configs you have anywhere in your infrastructure get changed to reflect the new hostnames. Personally I see no reason to specifically name them based on the version they're running, just keep it consistent otherwise you're asking for trouble. Not like you're going to be running multiple DCs with a variety of versions.

[-]

ipreferanothername@reddit

My plan is to reassign the old IP address (192.168.100.60) to DC02-25, because many clients still reference that IP in their DNS settings.

i work in health IT, we have like 15 DCs, i had to swap them a couple years ago.

IF you promote a DC and its running DNS, and IF you have a lot of records to sync from another DC....the DC may not yet have a DNS record if a client queries it. which basically returns a 'no such record' response, and the client takes that as valid and doesnt ask another DNS server so you kinda get screwed.

we have servers mixed by datacenter to point to DC 1 or DC 2 as primary [to put it briefly] and clients waiting on DC2 to sync in dns records were screwed for a minute. if some clients source this device as a primary DNS server you may want to stop dns servers while AD syncs things up, or block the firewall so it wont take DNS requests at all until the sync is done.

[-]

Ixniz@reddit

In short. Don't run DHCP on the DC for reasons already mentioned.

Don't join a DC as a member server before promoting it to a DC. Worst case you get a bunch of policies applied from whatever member server security baselines you're running, that can tattoo settings that won't be undone when promoting.

Install two new DCs. Replace the old servers (reuse IPs) with two new member servers running DNS resolvers (caching only) and DHCP and just forward the DNS queries to the new Domain Controllers. That way you won't have to worry about clients DNS settings and you can replace DCs whenever and just update the DNS forwarding addresses on the new servers.

[-]

SidePets@reddit

Check to make sure all FSMO roles have been transferred. If you’re using DFS move any connections. Use dcdiag with dns and verbose switch. Just some suggestion’s..

[-]

Business_Ad5131@reddit (OP)

Yes, got it! Currently, DC01-16 holds all the FSMO roles.

[-]

itworkaccount_new@reddit

Yeah you can reuse the IP. DHCP configuration doesn't replicate automatically. You need to configure fail over on the new DC and existing. DHCP and fail over are completely independent of active directory and that replication; they have nothing to do with the promotion of a domain controller.

[-]

Business_Ad5131@reddit (OP)

Thanks for the clarification! That makes sense — I’ll make sure to look into setting up DHCP failover separately. Appreciate your input!

[-]