This guide will demonstrate a few methods that can be used to move the various AD roles from one domain controller to another. This guide assumes the domain controller currently holding the roles is still online, available, and in a relatively healthy or usable state. If not, a hostile takeover process will need to be followed instead.

The PowerShell method is generally the quickest / easiest method and probably the most supported / reliable when performed on the new DC, so probably just go straight there, but the other methods exists for older servers, or for users were PowerShell isn’t preferred.

Generally, the roles to be transferred are:

• Operations Master
• PDC Emulator
• RID Master
• Infrastructure Master
• Schema Master
• Domain Naming Master

Before starting out, ensure that your new domain controller has been prompted to a Domain Controller.

Ensure that it has all relevant updates have been installed.

Ensure that both domain controllers’ NICs have both DC IP addresses as their DNS Servers.

Ensure that both domain controllers’ NICs have the AD domain name in the domain suffix

Launch Active Directory Sites and Services

Expand Sites > Inter-Site Transports > IP

Double-click on the site link listed

Usually the default replicate time is 180 mins, reduce this down to around 15 mins (15 mins is good as long as no DC’s will be offline for more than this)

Ensure that all relevant sites are listed in this site link (in most cases, there is a single site and a single link). In more complex sites, tread carefully, consult someone senior if in doubt!

Expand out Default-First-Site-Name -> Servers

Ensure that all domain controllers are listed that should be in this site, again, most environments are single site and single link. Tread carefully for more complex networks…

Your new domain controller should be listed

Next, launch ADSI Edit

Right-click on the ADSI Edit in the top of the tree in the left pane, click Connect To

In the Connection Settings window, drop down the list under Select a well known Naming Context, and select Configuration

Click OK

Expand out CN=Configuration, CN=Sites, CN=<Site Name>, CN=Servers

Ensure there are no old, no longer existent domain controllers listed here, if there are, you’ll need to perform a clean up in both here and in DNS (ideally, you would have checked this and cleaned up BEFORE promoting your new DC)

Perform AD Health Check & Clean UP – Before Adding New DC

Using an elevated command prompt on each domain controller, issue the command:

dcdiag /e

Check the output for errors

If either DC has a VSS-level backup, or has been rebooted within the last 24 hours, you will get errors for DFRSEvent stating:

There are warning or error events within the last 24 hours after the SYSVOL has been shared.  Failing SYSVOL replication problems may cause Group Policy problems.

This is normal – often caused by backups, VSS tasks and reboots.

The rest of the output in a healthy AD environment will pass every check / test

FINALLY, once all the above checks have been performed and the transfer process (below) have been completed successfully, allow 24-48 hours to pass, perform a final DCDIAG check, then change the replication time back from 15 mins to at least 60 mins.

Transferring FSMO roles through PowerShell is a much easier and faster process without unnecessary clicks.

You can transfer one or more FSMO roles to a DC using the following command. For example, to transfer the PDC Emulator.

Launch an elevated PowerShell session

Execute the following command – TargetDC = New DC Name:

Move-ADDirectoryServerOperationMasterRole -Identity <TargetDC> -OperationMasterRole pdcemulator, ridmaster, infrastructuremaster, schemamaster, domainnamingmaster

After pressing Enter, you will be prompted to confirm the transfer

Finally, using PowerShell, use the following to determine:

• The forest-specific FSMO roles for a Forest:

Get-ADForest | Select-Object DomainNamingMaster, SchemaMaster

• The domain-specific FSMO roles for a Domain:

Get-ADDomain | Select-Object InfrastructureMaster, RIDMaster, PDCEmulator

• Finally, a list of all DC’s hosting FSMO roles:

Get-ADDomainController -Filter * | Select-Object Name, Domain, Forest, OperationMasterRoles | Where-Object {$_.OperationMasterRoles}

Open up the Active Directory Users and Computers console, right-click on the “Active Directory Users and Computers” at the very top of the tree in the left pane, select Change Domain Controller.

Select the domain controller you want to move the roles to…

Click OK

Now right click the domain itself and then on Operations Masters…

In the Operations Masters window there are three tabs (RID, PDC, Infrastructure) – each one shows the current domain controller hosting the role and the domain controller you want to move the role to.

Click Change on each one of these roles, then Close the window.

Now right-click on the domain, select All Tasks > Operations Masters…

The three tabs here may also need to have the roles transfered, then click Close.

Now launch an administrative command prompt window

Execute the following command:

regsvr32 schmmgmt.dll

Now launch mmc.exe (can do this in the CMD window or Winkey+R run dialog)

Select Active Directory Schema and click Add, then click OK

Right-click on Active Directory Schema [<Domain Controller Name>] and click Change Active Domain Controller…

Select the domain controller you’re migrating the role to and click OK

Now again, right-click on Active Directory Schema [<Domain Controller Name>] and click Operations Master…

Click change to change from the old DC to the new DC and click Close.

Now in the administrative command prompt, execute:

netdom query fsmo

This should output the various roles and which domain controller is now hosting them.

Launch a command prompt with administrative privileges.

Launch the NTDSUtil in the command prompt by issuing:

ntdsutil.exe

Type roles and press Enter.
Type connections and press Enter.
Type connect to server DC01 and press Enter, (replace DC01 with the server name that you will transfer the FSMO roles to)
Type quit and press Enter.

Next, we will transfer FSMO roles one by one with the corresponding command, as the case may be. After each Enter appears a confirmation window. Just click Yes to continue.

For Schema Master, type transfer schema master and press Enter.
For RID Master, type transfer rid master and press Enter.
For Domain Naming Master, type transfer naming master and press Enter.
For PDC Emulator, type transfer pdc and press Enter.
For Infrastructure Master, type transfer infrastructure master and press Enter.

Finally, exit NTDSUtil by typing quit and pressing Enter

Now verify the transfers by issuing the command:

netdom query fsmo

launch the DNS Manager

You’ll need to expand out EVERY folder for both forward and reverse lookup zones on the left – you’re going to comb through EVERY one of these – checking for previous, no longer existent domain controllers listed, and ensuring that each zone has only current domain controllers listed…

So in the various AD-specific zones & meta data, check that no old DC’s remain – remove any old ones

For each zone, right click and select Properties, then click the Name Servers tab

Check & confirm that only current servers are listed – remove any old ones

Using an elevated command prompt on each domain controller, issue the command:

dcdiag /e

Check the output for errors

If either DC has a VSS-level backup, or has been rebooted within the last 24 hours, you will get errors for DFRSEvent stating:

There are warning or error events within the last 24 hours after the SYSVOL has been shared.  Failing SYSVOL replication problems may cause Group Policy problems.

This is normal – often caused by backups, VSS tasks and reboots, however, good practice to browse to each DC in Explorer to ensure the NETLOGON and SYSVOL shares are present on each DC and contain relevant data.

The rest of the output in a healthy AD environment will pass every check / test

You’ve successfully stood up a new domain controller to an existing AD and migrated the various FSMO & PDC Emulation roles to the new DC.