Advice: DC 2012R2 to 2025

[-]

Cormacolinde@reddit

DO NOT, DO NOT USE 2025 FOR A DOMAIN CONTROLLER. It’s bugged. Badly. Don’t do an in-place upgrade either. First make sure your SYSVOL has been migrated to DFSR. Then make sure your 2012R2 servers have the last available patches. Setup TWO new 2022 servers, do NOT install any patches on them. Promote them to domain controllers. Swap one of the new ones with the IP of the old one. Turn off the old one for a week, make sure everything works. Spin it up again, demote it properly. Update the 2022 servers to the latest patches.

Reply

[-]

Whole-Scheme4523@reddit

Why stall the patches?

Reply

[-]

Cormacolinde@reddit

Because recent patches have updated DCOM and Kerberos in ways that can be backwards-incompatible, especially for domain controllers. you’re like to have multiple issues if some of your domain controllers are running 2012R2 with october 2022 patches, and 2022 servers with august 2025 patches.

Reply

[-]

ChefeTwo@reddit (OP)

Damn the 2022 is already setup and fully patched. Should I install again without patching? I used the last eval version from Microsoft. Downgrade Key is already on the way. What patch should be on the 2012r2? We don't have ESU so the last official patch can be applied.

Reply

[-]

Cormacolinde@reddit

That’s the october 2023 patch: https://support.microsoft.com/en-us/topic/october-10-2023-kb5031419-monthly-rollup-85700dab-19b9-4494-be12-4ab36f96d4f6 (sorry I wrote 2022 earlier). There’s ways around some of the Kerberos issues, but the DCOM stuff at this point is non-reversible with the current patches. Personally, I would uninstall the patches or reload a new server to minimize the risk.

Reply

[-]

ChefeTwo@reddit (OP)

Can I apply the current patches after promote to domain controller? FSMO roles are still on the 2012r2

Reply

[-]

Cormacolinde@reddit

I don’t recommend patching until the 2012R2 is done with the de-promote.

Reply

[-]

ChefeTwo@reddit (OP)

May you have the patch KB which causes issues on the server 2022? Or how can I check if my 2022 server could causing issues

Reply

[-]

Rivereye@reddit

I don't think it's an issue with the 2012R2 Servers are fully patched, but I did run into an issue during a migration a while back when if I fully patched the new servers, I couldn't replicate ADDS from the old Domain Controllers. Found out the company hadn't installed patched on the old DCs in several years.

Reply

[-]

anotherucfstudent@reddit

He likes his user base on darknet lists

Reply

[-]

proudcanadianeh@reddit

Whats wrong with 2025DC's? I just finished moving all of ours to 2025 and the only issue I had was having to reset the pwd for the krbtgt account.

Reply

[-]

Cormacolinde@reddit

Multiple kerberos issues that seem to crop up mostly in heterogeneous environments. If all your DCs are at 2025 it works better. There was also un unpatched exploit with dMSA for many months. Overall, 2025 has been problematic with Kerberos with multiple bugs since its release. Historically, every new server release on a new kernel has been problematic (2008, 2012, 2016) whereas subsequent updates (the two R2s, 2019, 2022) are much more solid.

Reply

[-]

LBarto88@reddit

I have one 2025 DC. It's been fine so far, but there have been several issues which cause me to pause updates. Also, 2025 in general, you can't use the "forwarded events" log because it's just busted. I would not implement several 2025 at scale yet.

Reply

[-]

Excellent-Program333@reddit

I am in the process of two of these for clients. I am polishing my Entra skills and will retire on prem AD and Entra Join the machines. These are both smaller clients under 10 machines each location. Will be nice to retire 3 servers at each location. And less overheard for the customers.

Reply

[-]

Good_Principle_4957@reddit

As others have said you need to stand up another DC that is server 2016, 2019, or 2022, and then upgrade the forest level to 2016, switch sysvol to dfsr, and transfer the fismo roles to that new one. I am guessing your environment is not virtualized? If it is not then you can just use a regular computer and install server OS on it and promote it to a DC temporarily so you can do the above and then install 2022 on your server hardware and transfer the roles back to it. If you are not familiar with upgrading the forest or transferring roles it is easy and there are plenty of step by step guides for it.

Reply

[-]

ChefeTwo@reddit (OP)

DC is virtual. Iam going to setup a 2022 also virtual. I know as well that best practice is metal. Is this a huge mistake to have 2 virtual DCs on different hosts? I know best practice is on metal.

Reply

[-]

Good_Principle_4957@reddit

As long as they are on different host I don't think so

Reply

[-]

Unnamed-3891@reddit

DO NOT run DCs on 25, at least not yet.

Reply

[-]

IXXCI@reddit

You will not be able to go straight to Server 2025 due to the Domain Functional Level being incompatible (2025 only supports Domin Functional Level as low as 2016), and you will need a Server 2022 as a middle step I'd recommend making sure you have moved to DFSR first before looking at adding any new Domain Controllers https://techcommunity.microsoft.com/blog/filecab/streamlined-migration-of-frs-to-dfsr-sysvol/425405

Reply

[-]

Echo-On@reddit

More would need to be known about the DC and how it's being used. DHCP, Redirected Folders, GPO, Shared Folders... The correct answer isn't always the same from one DC to the next. In a case where none of those apply, you'd raise the Domain Functional level if applicable, join the new DC to the domain, run dcdiag to be sure all looks good, transfer the FSMO roles, then decommission the old server. Things get a little more complicated as other factors come into play. Opinions have always been mixed when it comes to upgrading the OS on existing servers. It's not the ideal answer, but at least it sees your server eligible for updates once again.

Reply

[-]

ChefeTwo@reddit (OP)

DHCP and GPO are running as well. Correct me if I'm wrong but DHCP is export and import and GPO is sync with other DCs?

Reply

[-]

Echo-On@reddit

It "may" require migrating FRS to DFSR before the GPO would replicate, I can't recall off hand if 2012 used DFSR out-of-the-box... Only takes about 20min if so, unless dcdiag reports a hot mess that is. DHCP can be exported / imported, correct. Just don't enable the scope in DHCP Manager till you're ready.

Reply

[-]

rjchau@reddit

***NEVER*** in-place upgrade a domain controller. It's not supported and especially as you only have one, it will bring down your entire domain during the upgrade and hose your domain entirely if (when?) it fails. A second domain controller in a production environment isn't just a good idea - it's pretty much essential. Build a **new** domain controller and add it to your domain. Transfer the FSMO roles and verify replication is working. If the hardware your existing domain controller is running on is old enough that it came with Server 2012 R2, then do ***not*** install Server 2025 on it. Chances are good, you won't be able to.

Reply

[-]

dcaldrich@reddit

Step 1: Add a second DC asap. Step 2: Add another DC Step 3: Demote and retire the 2012r2 DC

Reply

[-]

Stonewalled9999@reddit

Step A.1 - don't put in 2025. Stay with 2022

Reply

[-]

stillpiercer_@reddit

I’ve 5 2025 servers out there, no issues so far. They all replaced 2019 servers. New VMs, not upgrades.

Reply

[-]

Stonewalled9999@reddit

Come back in a month and tell us if you are still problem free. Most of my clients that tried 2025 had me roll them back

Reply

[-]

stillpiercer_@reddit

They’ve been in production for 3-4 months if I had to guess, it’s been a while.

Reply

[-]

WendoNZ@reddit

Just curious, are they processing logins/password changes? Or are they in a DC and all the clients are authing against a local DC? It _appears_ a lot of the 2025 problems are around kerberos and user and computer password changes against 2025 DC's, so if they aren't doing that it makes sense you haven't had issues. I'm actually curious what environment they are in that you aren't seeing issues

Reply

[-]

stillpiercer_@reddit

The 2025 servers have completely replaced the 2019s. The only servers in that environment whatsoever are all now running 2025. It’s been a few months, no major issues. Things seem to work. Replication is working. A bunch of new machines have joined the domain since then, new users, password changes, etc. Haven’t seen any widespread domain trust issues, so I’d think computer accounts are working properly. Honestly haven’t had to dig into them much at all so I can’t really speak to Kerberos intricacies with them. Every now and then when they reboot, the Duo auth proxy service doesn’t start or gets hung and needs manually restarted, but I’ve seen the same issue on 2016, 2019 and 2022 as well. I chalk that up to Cisco ruining yet another product.

Reply

[-]

WendoNZ@reddit

Ahh, if they are all 2025 then that makes sense. The problems appear to only be in mixed environments where you have 2025 DC's and lower version DC's too

Reply

[-]

TheIncarnated@reddit

That can be an issue with any mixed environments. We are just lucky with how fault tolerant it has been up until now

Reply

[-]

thomasmitschke@reddit

Most of my DCs are still on 2016 (did raise the func level to 2012R2 lately, due to Exchange 2019 migration). Do they need new features, or why did they install 2025 as Dc?

Reply

[-]

Stonewalled9999@reddit

For 2/3 of them they were on 2016 which is EOS Oct 2025. And well, MS sold them 2025 they weren't aware they could leverage downgrade rights.

Reply

[-]

TwinkleTwinkie@reddit

As Domain Controllers? They're not a problem as a member server, most of the issues come up when they're Domain Controllers.

Reply

[-]

stillpiercer_@reddit

Yep. Two of them are DCs and the rest are member servers with other roles.

Reply

[-]

graywolfman@reddit

This is important. Server 2025 is a nightmare . Wait until the OS is 1.5 years old before thinking of using it.

Reply

[-]

JwCS8pjrh3QBWfL@reddit

Why? I haven't heard any issues with 2025

Reply

[-]

TrueStoriesIpromise@reddit

There's a major security issue with 2025 DCs and the new dMSA accounts: [https://blog.netwrix.com/2025/07/21/dmsas-are-the-new-ad-privilege-escalation-target-heres-what-you-need-to-know/](https://blog.netwrix.com/2025/07/21/dmsas-are-the-new-ad-privilege-escalation-target-heres-what-you-need-to-know/) [https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory](https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory)

Reply

[-]

kuahara@reddit

If you lack infrastructure to follow those three steps, virtualize. Honestly, virtualize anyway. You should be able to shoot and replace a DC anytime you feel like it with no impact at all to your users.

Reply

[-]

Artur_King_o_Britons@reddit

Cloning is a great tool for AD DCs.

Reply

[-]

Artur_King_o_Britons@reddit

This is the way.

Reply

[-]

ChefeTwo@reddit (OP)

What OS on the two new ones?

Reply

[-]

dcaldrich@reddit

Server 2022. 2025 has issues with DC role atm. Standup 2 DC's. Validate replication. Transfer fsmo roles. demote old dc.

Reply

[-]

Darayavaush84@reddit

WHat kind of issues? The problem with the Firewall blocking the domain network should be fixed now, so I read

Reply

[-]

ChefeTwo@reddit (OP)

I do have license for 2019 and 2025. So I go with 2019? Or can I use the 2025 licence for 2022?

Reply

[-]

arvidsem@reddit

The 2025 license includes downgrade rights to 2022.

Reply

[-]

timsstuff@reddit

I'm a huge fan of adding a Windows Server Core VM as a secondary DC, it's a tiny footprint and doesn't have nearly as many updates and consequently fewer reboots, plus if shit hits the fan that VM could save your ass. Plus it helps hone your Powershell and remote management skills.

Reply

[-]

Feisty_Department_97@reddit

This is the way but avoid Server 2025 like the plague for DCs. Server 2022 is your friend.

Reply

[-]

anonpf@reddit

And before you demote your DC, give the new DC’s time to replicate, then fully test your new DC’s by powering down the old one for a week or two prior to demoting. Then scream test.

Reply

[-]

Terrible_Theme_6488@reddit

This, but I would check replication etc first

Reply

[-]

Protholl@reddit

Skip step 3 after demotion. Reformat and install Server 2025. A single domain controller is a bad idea since by definition it is a single point of failure. Convince whoever to allow you to dcpromo the old chassis so you have two DCs.

Reply

[-]

Kwuahh@reddit

This is the answer. Your Domain Controller is likely the beating heart of your organization. Do NOT pull the plug on it until you have working backup domain controllers in place.

Reply

[-]

mini4x@reddit

This is the way. Step 3 is move FISMO roles, then Demote the old one. Any other way is not worth the risks.

Reply

[-]

slapjimmy@reddit

Depends on what else is running on the DC and how big the user base is (in terms of impact if something goes wrong). Obviously adding a second DC and demoting the old one is the recommended method. However, I have done in-place upgrades on many 2012R2 to 2022 (wouldn't bother with 2025 yet, unless you have a need). Don't do it if you're running Exchange or SQL or any LOB apps on your DC (which you shouldn't be anyway). Make sure your AD and server are healthy first, by running health checks. Backup your 2012R2 and test a restore to make sure you can revert if something goes wrong. Clone a copy of your DC and test an upgrade on it in a sandbox. 2012R2 >in-place upgrade to> 2016/19 >then in-place upgrade to> 2022. If the test works, proceed to live.

Reply

[-]

VTi-R@reddit

Grab a 2019 iso, build a temporary DC, demote the old one and swap IP addresses between the two. Upgrade the forest level then build your 2025 DC. Alternatively, and I don't prefer the approach, upgrade the schema then there existing DC to 2019, and repeat to get to 2025.

Reply

[-]

BlackV@reddit

> Upgrade the forest level then build your 2025 DC. Upgrade the forest level *and domain level*, then build your 2025 DC.

Reply

[-]

VTi-R@reddit

Forest upgrade enforces domain upgrade, which is why I didn't specify. Good thought on FRS to DFSR, there are plenty of environments where it was never done.

Reply

[-]

BlackV@reddit

oh does it... well now TIL, ive only ever done it in 2 steps, domain then forest

Reply

[-]

TheBestBeer@reddit

You are running a single domain controller in production and want to do an in-place upgrade of it? Build another one before upgrading the 2012 one, transfer FSMO roles to the 2025 one and demote the 2012 one. On the 2012 one don't do an in-place upgrade and just wipe and install 2025 then promote as a DC. Not knowing your environment there could be a good deal more that needs to be done.

Reply

[-]

ChefeTwo@reddit (OP)

As I mentioned this is not possible directly from 2012r2 to 2024 or am I wrong? 2025 DC needs 2016 structure?

Reply

[-]

eyecannon@reddit

Wrong, we moved from 2008 to 2022, it was shockingly easy. Just listen to everyone in this thread

Reply

[-]

havocspartan@reddit

You aren’t reading any of the details, no one said 2008 to 2022. 2012 can not go directly to 2025. The functional level maximum for 2012 r2 is 2012 and 2025 can only go down to 2016. u/chefetwo needs to hop to a temp server to go to 2025.

Reply

[-]

ChefeTwo@reddit (OP)

Thank you

Reply

[-]

kuahara@reddit

Honestly, just to second what a lot of people are saying, only go to 2022 with your domain controllers. 2025 has frequent patch problems as a DC. I get Windows Health release emails about 2025 in the DC role too often to make me comfortable using it for that.

Reply

[-]

eyecannon@reddit

Yeah everyone is suggesting not to do an in place upgrade

Reply

[-]

Successful_Pilot_312@reddit

Virtualize a 2019 or 2022 server, promote to DC. Have enough resources? Spin up another one. Transfer FSMO roles after 24-48 hours. Wait another 24-48hours and demote the 2012R2 box. Take lunch while you upgrade it to 2019.

Reply

[-]

canchanchan386@reddit

Make sure all of your DCs are migrated from FRS to DFS-R FIRST. I get really nervous when it comes to in-place upgrades of servers, but that's just me. I'd prep 2 new VMs with 2019, promote them, migrate FSMOs and DNS, to one of the new boxes, and decom the 2012 R2. Before going forward, take snapshots of your 2019 VMs. Take one of the 2019 boxes that's not holding the PDC role and attempt the in-place upgrade. If it succeeds, migrate your FSMOs to the newest box and upgrade the other box. It sounds convoluted, I know. Better to be safe than sorry, though.

Reply

[-]

brokenmkv@reddit

virtualize, take snap shot, try in place upgrade - then you can revert if it fails. and also get to working on building a secondary (eventually primary) 2025 DC :)

Reply

[-]

fattes@reddit

just a heads up here; I have seen posts where people upgraded to 2025 on their DC's and ran into problems. they reverted back to 2022.

Reply

[-]

clinthammer316@reddit

We just finished two domains, one with two 2012 r2 DCs and second with four 2012 DCs. Spun up new 2022 DCs and migrated the roles. Holy shit it was so easy!

Reply

[-]

labmansteve@reddit

I’ve run almost a few dozen 2012 R2 to 2022 upgrades over the past few months several were DC’s. Back up the server and run it. Will take a long time, but should be fine.

Reply

[-]

ChefeTwo@reddit (OP)

You did an in-place upgrade or side by side? How long did it take?

Reply

[-]

labmansteve@reddit

In-place. Took about 2 hours per server. But was very much a "click go and go make a sandwich" type of process.

Reply

[-]

Lukage@reddit

Option C: Build TWO new 2022 DCs. Migrate the roles. Demote/decom the old one.

Reply

[-]

CatsAreMajorAssholes@reddit

Don't do 2025 as a DC right now, lots of problems.

Reply

[-]

BlackCodeDe@reddit

Spin up a DC 2022. Server 2025 as DC is still too buggy. Wait a year or more

Reply

[-]

ChefeTwo@reddit (OP)

Is 2019 also a good option? Right now we only own 2019 and 2025 licences.

Reply

[-]

TheRogueMoose@reddit

2019 extended support ends on 2029-01-09. So if you have licenses for it, use it. I was also under the assumption that when you get a license, it works for the version before it as well. So your Server 2025 licenses should work on 2022... I may be wrong on that though.

Reply

[-]

daorbed9@reddit

Do 2022 and save your sanity.

Reply

[-]

ChefeTwo@reddit (OP)

We do have license for 2019 and 2025 - can I go with 2019 as well?

Reply

[-]

daorbed9@reddit

There is really only one good answer, 2022. It's not like you are deciding what mousepads to go with.

Reply

[-]

Benificial-Cucumber@reddit

2019 is out of mainstream support now so keep that in mind. With that said, if I had to choose between 2019 and 2025 I would pick the former. I have a personal rule not to adopt an OS within 2 years of its release unless I absolutely have to. I'm probably being dramatic with that but the Windows Update issues with 2016 caused me no end of headaches, so I'm playing it safe.

Reply

[-]

UMustBeNooHere@reddit

It’s best practice to never upgrade a domain controller. Always build new. Like others have said, stand up 2 new ones (you want at least 2), migrate FSMO roles, let it bake for a day or two, demote the old one. Assume the old IP address on one of the new ones if you were using it for DNS if you don’t want to change any DHCP scopes or static IPs manually.

Reply

[-]

nixerx@reddit

I can’t speak to 2025, but we moved to 2022 from 2012R2 a couple of years ago. Dome something as crucial as your AD you should have fresh hardware and a )solid back uo) even if it’s a repurposed workstation. Since you’re a single DC I’m assuming your org isn’t massive.

Reply

[-]

MavZA@reddit

Add a new DC Promote the new one Remove the old one after you demote it out.

Reply

[-]

Darayavaush84@reddit

While the suggestion to promote a new dc and demote the old one is the best practice and the gold standard, all my life I did in place upgrades of dc’s and always worked like a charme

Reply

[-]

secret_configuration@reddit

Don't go to 2025, stick with 2022.

Reply

[-]

RobieWan@reddit

Your priorities are all off here. Not sure why there is even a hint of a dilemma on what you need to do. The ONLY valid answer: 1- Add 2019 DC 2- Migrate FSMO roles to 2019 DC 3- Add second 2019 DC 4- Demote 2012r2 DC 5- Update domain/forest levels to 2016 (there is no 2019 level) Getting a second DC in place is FAR more critical than going to 2025 right now. Do that AFTER you get on a supported (and redundant) setup. In-place upgrades are never a good idea under regular circumstances, let alone for domain controllers.

Reply

[-]

ChefeTwo@reddit (OP)

This sound like a good solution to me.

Reply

[-]

OhioIT@reddit

Spin up a new server on 2022 (not 2025!), migrate the FSMO roles over, make sure the SYSVOL is DFSR and you should be good. Keep your 2012r2 DC around until you build another new one. Did the exact same thing a few months ago. Make sure you always have at least two DCs at all times.

Reply

[-]

Terrible_Theme_6488@reddit

Spin up another machine, promote it to dc and then transfer the roles (remember to set time source for the new dc) Then you can try an in place upgrade on your 2012 if you want Personally as another employee at an sme i would never dream of trying to upgrade my only dc.

Reply

[-]

ledow@reddit

Tough choice: Go back in time 10 years. Migrate 2012R2 piecemeal through 2016, 2019, 2022, 2025. Or just... build a 2025 and join it, scrap the R2 when it's done. Add another 2025. Raise the domain functional level to something vaguely this decade.

Reply

[-]

oubeav@reddit

First of all. Wait until you can get a second DC up and full functional. Then either upgrade in-place the "old" one or demote and fresh install. Personally, I hate in-place upgrades. Fresh installs for the win.

Reply

[-]

JazzlikeAmphibian9@reddit

You have to run 2016 functionality to upgrade to 2025 So yeah you need to go via 2016-2022 and raise functionality for the domain and forest to 2016 at least to be able to upgrade. In place upgrade is a non starter since that doesn’t work on dcs.

Reply

[-]

xXFl1ppyXx@reddit

I wouldn't try to in place upgrade my only DC, besides you might want to hold back on 2025 it seems to be somewhat buggy from what I've heard

Reply

Reply to Post

96 Comments