Active Directory 2008 R2 upgrade to Windows Server 2019 checklist

• Author
• Recent Posts

Vladan Seget

Vladan Seget is an independent consultant, professional blogger, vExpert 2009-2021, VCAP-DCA/DCD and MCSA. He has been working for over 20 years as a system engineer.

Latest posts by Vladan Seget (see all)

• How to use VMware vSAN ReadyNode Configurator - Fri, Dec 17 2021
• VMware Tanzu Kubernetes Toolkit version 1.3 new features - Fri, Dec 10 2021
• Disaster recovery strategies for vCenter Server appliance VM - Fri, Nov 26 2021

Usually, Active Directory is replicated among several members to enable redundancy. However, I've often seen small IT shops running a single copy of AD with almost no backup or other protections. If you want to migrate Microsoft AD on a single server, you can choose between an in-place upgrade and a clean installation of Windows Server 2019, with reinstallation of all your existing applications.

In-place upgrade vs. new install

There is no single way to approach these issues; it always depends on your situation. In addition, there is always an unknown variable which could mean your applications won't work after an upgrade.

Note: You could ask the relevant vendor if a particular application has been tested under Windows Server 2019, or you can test whether it is working simply by installing a clean copy of Windows Server 2019 as a virtual machine and then test your critical applications.

Microsoft published a detailed guide to an in-place upgrade for systems running Windows Server 2008 R2, however you should always check whether the in-place upgrade will actually works at the end. For example, you could check with your hardware manufacturer if your old server supports WS 2019.

It is not possible to do a direct, in-place upgrade of Windows Server 2008 R2 to Windows Server 2019. If you want to do an in-place upgrade, the process would require three steps:

• First step – Upgrade from Windows Server 2008 to 2012 or 2012 R2.
• Second step – Upgrade from Windows Server 2012 to Windows Server 2016.
• Third step – Upgrade Windows Server 2016 to Windows Server 2019.

That's quite a lot of upgrades. In addition, as being said, the hardware on which your old Windows Server 2008 R2 is installed would have to support Windows Server 2019.

Azure option

There is another option from Microsoft which basically extends the support for Windows Server 2008 R2 with security patches and updates. However, you would have to migrate your servers to Azure for three years. This might be an option for customers not willing to invest money in new hardware.

Active Directory 2008 R2 upgrade to 2019 checklist

We'll try to provide a detailed checklist, but as I said earlier, the upgrade scenario always depends on your specific situation, the application set you're running, and support for those applications on Windows Server 2019. This checklist is by no means intended to be a detailed, step-by-step guide; rather, it only gives you an overview of the issues you should consider.

Let's assume we're doing a single server update and that we do not have any other server with a copy of AD. I also assume you have bought new hardware so your physical server has the latest drivers and firmware to run Windows Server 2019.

• Your Microsoft AD is working – Ensure your AD is working properly and that nothing is broken before you start the upgrade process. Many command line options and GUI tools are provided by Microsoft.
• Backup – It is highly recommended to create a backup of your Windows Server 2008 R2. You can use many free backup tools. Just be sure to stop any enterprise application that might be running (MS SQL Server, Exchange, and any other database servers). This helps to make your backup application consistent. Ensure your backup tool also backs up the system's state as well as Active Directory.
• Update AD schema – Every new operating system introduces changes to your AD schema to allow for new functionality and features. Therefore, you have to update your AD schema before the upgrade to Windows Server 2019. This happens when you promote the 2019 server as an additional domain controller. There is no automatic rollback scenario for a schema update. If it goes wrong or if you applied it by mistake, you'll have to go back and restore your domain controller. You can find a detailed guide how-to update AD schema here.
• Install and configure Windows Server 2019 – This is perhaps the easiest part. Ensure your disk size and partition layout suits your needs and that your IP addressing scheme suits your environment. Make sure you create static DNS records (forward and reverse) on your DNS server.
• Promote Windows Server 2019 to DC – You will need to promote this newly installed system to be an additional domain controller within your domain. This is a common scenario of adding an additional domain controller to the domain. Then restart the system and check whether everything works as expected.
• Migrate resources – If any shares are defined on the old server, you'll need to migrate your shares and files to the new Windows Server 2019. I recommend using the Storage Migration Service, which allows you to migrate and transfer all files and configuration settings (shares, NTFS permissions, and ownerships) from older Windows Servers to new operating systems.

Microsoft Storage Migration Service

• Wait – Observe the behavior of your AD for at least a week. More than once, I've seen strange behavior occur after a day or two. Waiting allows you to detect any anomalies and gives you the chance to fix them before you decommission the old server.
• Move FSMO roles – The next step is to move Flexible Single Master Operation Roles (FSMO) to the new Windows Server 2019. There are many guides available on how to do this.
• Demote Windows Server 2008 R2 – Here, Microsoft AD is properly uninstalled from Windows Server 2008 R2. Microsoft has step-by-step guides on how to do this here. If errors occur and the assistant fails, use the force switch; however, only do this as a last resort because you'll have to manually "clean" AD of orphaned objects. It's possible and not that difficult, but it must be done with precision. Once this step is done, leave the server as a member server for a couple of days and observe it to ensure everything is working.
• Decommission Windows 2008 R2 – You can now disjoin the server from your domain. It's not recommended to keep it in your network once it cannot be no longer patched and protected against malware or hackers. Keeping this server on your network makes your network more vulnerable.

Conclusion

This was, in essence, a small guide for migrating a Windows Server 2008 R2 single host with Active Directory to Windows Server 2019. These instructions only apply to situations where you do not want to do an in-place upgrade. Personally, I prefer doing it this way as you can easily manage downtime (if any). If you do an in-place upgrade and something goes wrong (firmware/drivers) and your server won't reboot, you'll have to initiate a bare metal restore, which might take quite a while depending on how much data was stored on that server.

If you do a side-by-side migration, you also have redundancy; you'll have time to observe your systems, and if something does not work, you can roll back the changes and start again.