Pre-requisites:
You must perform tasks required as outlined here to ensure the AD is healthy and functioning properly
If the current AD is using File Replication Services (FRS) instead of Distributed File Services Replication (DFSr), and you’re adding a Windows Server 2019 or newer, then you must take steps required to upgrade the FRS to DFSr here
If any DC is older that Windows Server 2008 R2 (or Windows SBS 2011), then they will need to be demoted before FRS to DFSr migration can take place. If there is only one domain controller and its an older version of Windows that doesn’t support DFSr, then there are considerations that need to take place, options might include promoting a temporary Windows 2016 server as a DC before demoting the old DC, or building an entirely new directory. If in doubt, consult a senior engineer.
The new server needs to be added as a member server to AD before commencing with promotion to a domain controller.
Note: In Windows Server 2022, if you find that it installed with a default timezone of US Canada and you can’t change it in Windows Settings (as ts greyed out), launch an elevated PowerShell session or Command Prompt, then execute timedate.cpl which will launch the older Control Panel version. From here you can change the date & time without issues.
New Server Preparations:
DNS:
On the new server, ensure you:
- Configure static IPv4 on the NIC
- Configure static netmask & gateway on the NIC
- Configure statis DNS Address(es) on the NIC. Each DNS IP should be a domain controller, not the router or any other DNS IP addresses
- As the last DNS IP address, add in the IPv4 address of this server
In the Advanced network settings > DNS, add the AD domain name in the DNS suffix field and tick both tick boxes directly below:
Ensure that in command prompt, all existing domain controllers resolve to IP using both just their hostname and their FQDN:
Finally, confirm that the AD domain name resolves to the IPv4 address of an existing domain controller:
Join to AD:
Now, join this server to Active Directory as a member system and reboot when prompted.
Install Roles & Services:
Using Server Manager, install the following Server Roles:
- Active Directory Domain Services
- DNS Server
- DHCP Server (if applicable to this server)
- File Server
- DFS Namespace
- DFS Replication (if appliable)
Install the following Features (optional, not required):
- .NET Framwork 3.5 (includes .NET 2.0 and 3.0)
- .NET Framework 4.x
- .NET Framework
- ASP.NET
- SMB 1.0/CIFS File Sharing Support (if required for other devices on this network)
Note: The installation of .NET Framwork 2 & 3.5 will require access to the Windows installation files located on the Windows installation media in x:\Sources\SxS
Windows Firewall:
This is a recent learning, but has been an unspoken Microsoft recommendation for some time, but recently bit me costing a few hours of project overrun when adding a Windows 2022 server to an existing AD with Windows 2016/2019 as a pre-existing domain controller…
We need each domain controller to have a custom firewall rule added to allow all other DC’s any inbound access, so before we promote our new Windows Server 2022 to DC, lets get the firewall rules added…
On our new server, open Windows Firewall with Advanced Security
Select Inbound Rules and to the right, click New Rule…
For the Rule Type, we’re going to go with Custom
Next, in Program, leave this as Any, and in Protocols and Ports we’ll leave these also as Any
In the Scope section, we will specify the IP address of every other domain controller in the network – regardless of which AD site they reside
The IP address(es) are listed in the remote IP addresses section:
In the Action section, leave this to Allow the connection
In Profile, leave all defaults selected, and finally in the Name section, give it something meaningfule, like Domain Controllers In or something like this…
Now go back to every other domain controller and create the same rules, allowing all other DC’s inbound ANY just as above!
Note: As stated above, the addition of this firewall step is a recent learning due to security updates in Windows Server 2022 that were introduced in Sept 2023, which seems to cause issues with DFSr initial replications post promotion & DCDIAG errors in other areas, not performing the above steps will highly likely result in you needing to spend some additional time performing authoritive restores in AD SYSVOL replications, and the more domain controllers in the network, the more work is required to fix this.
Promote to DC:
Login to the new server with a domain admin account that is a member of both the Domain Admins and Enterprise Admins groups.
Launch Server Manager
Up the top right there should be a flag icon with a yellow exclamation warning over it
Click it and then select under Post-deployment Configuration, the blue text that reads Promote this server to a domain controller
Follow the wizard to Add a domain controller to an existing domain
It should auto populate with the AD domain and the domain admin account you’re logged into the server with
In the next screen, ensure that DNS option is selected, and is most cases, global catalog as well.
In rare cases, we may be required to create this DC as a read only domain controller (RODC), and if so, click this as well, but in 99.99% of cases, this doesn’t not apply so leave unticked.
In a multi-site AD, ensure the correct site name is selected for this domain controller to reside, in single site AD environments, there will only be one site to select from
Enter in the DSRM password and document this!
Now just Next, Next, Next your way through the wizard, until you reach the prerequisites checks summary
Check through this, look for errors (red coloured icon) which will prevent you from proceeding and fix these errors, but there should be nothing but warnings.
Check the warnings for any show stoppers, but in most cases, you should be fine to click the Install button
Notes:
In 99% of cases where the DNS delegation warning is present, this will be resolved shortly…
Due to some recent updates to Sever 2016-2022, I’ve been disabling IPv6 on the NIC of all DCs, and until this bug is fixed, I would recommend you do the same here (unless IPv6 is required on this network)
Once the install is completed, the server will reboot.
At this time, go to all other domain controllers on the network and add the IP address of this new DC to their network adapter DNS IP lists
Post Promotion:
Once the new domain controller has rebooted and you’ve logged in, go back into the network adapter settings > advanced and DNS, then at the bottom of the DNS server IP addresses, add in its own IP (if you skipped this earlier) and 127.0.0.1
Launch Active Directory Sites and Services
Drill down to Sites > IP and double-click on DEFAULTIPSITELINK
Change the default replication time down from 180 mins to something more frequent but still reasonable, say 30 mins:
Ensure the required sites are added to the link as well.
Now drill down into the site where the new DC was installed into, and ensure its listed there. Check this across all domain controllers
Note that if replication hasn’t occured to all DCs, then the new DC might not be listed just yet – you might have to wait until replication occurs.
Let the new DC sit for about 24 hours, then perform DCDIAG tests using elevated command prompts on every domain controller.
At the very end of the process, DCDIAG should return little to know errors, and you should be able to use Windows Explorer on the new DC to browse to \\localhost\ and see SYSVOL and NETLOGON shares available:
Hint: You can also check this using the NET SHARE command.
If the new DC doesn’t have these shares and its been online for several hours, check the DFSR Event logs for errors like the ones below:
If you’re seeing logs that state DFS is trying to initialise but nothing to suggest it completed, then you may need to perform what’s known as a D2 and/or D4 Authoritive Restore – see here! As mentioned above, this is likely due to the newly discovered requirement for a Windows firewall rule to allow any<>any traffic between all domain controllers.