Migrate a Windows Server 2003 Domain Controller to Windows Server 2016
How to update a Windows Server 2003 Domain Controller to Windows Server 2016 Domain Controller?
Despite Windows Server 2003 being out of Microsoft support since July 2015, many organizations still rely on this out-of-date operating system for business operations, many more still use it as part of their primary domain controller infrastructure. This is a major security concern as Microsoft is no longer releasing any security updates or Windows Updates for Windows Server 2003.
This is a detailed guide that explains the step-by-step process to upgrade Active Directory 2003 to 2016. Before you start, please ensure you have updated Windows Server 2003 to the very latest available through Windows Update.
How to Update Server 2003?
In the interests of completeness, here is a quick guide to patching Windows Server 2003 with the latest patches. If possible, do not use Internet Explorer browser as this causes issues with ActiveX Controls – FireFox or Google Chrome should work.
Use the start button to navigate to Windows Update:
Start menu -> Programs -> All Programs -> Windows Update
Update Active Directory 2003 to 2016
Please note that there is no direct update path from Windows Server 2003 to Windows Server 2016. If you attempt to install Windows Server 2016 on top of Windows Server 2003 you will get a setup error. It is simply not possible.
Theoretically you can follow the upgrade path of upgrading Windows Server 2003 to Windows Server 2008, and then upgrade to Windows Server 2016. That is possible if you have the 64-bit operating system, but it is messy and not recommended.
If you are running 32 bit Windows Server 2003, forget about trying to upgrade. If you are not sure which version you are running do this:
Start Menu -> Run -> Type “WinVer”
Add Server 2016 to 2003 domain
The best option, in my opinion, is to build a clean installation of Windows Server 2016 and then migrate the domain controller services over from Windows Server 2003 to Windows Server 2016.
There are many pre-requisites for this process to be successful.
Your domain must meet the following criteria:
- The Windows Server 2003 Domain controller MUST be on the Domain Functional Level “Windows Server 2003”. If you are on Windows Server 2000 Mode then you must upgrade to “Windows Server 2003” Domain Functional Level
- You must also have a server with a fresh licenced copy of Windows Server 2016 installed
How to check your Domain Functional Level on Windows Server 2003
- First Check your Domain Functional Level.
- This is done by opening Active Directory Users and Computers
- Right click on the domain root name (turbogeek.co.uk in the example below) and select Raise domain functional level
- Above you can see the Domain Functional Level is Windows Server 2003
- If the current domain functional level DOES NOT equal Windows Server 2003 – stop here and raise the DFL.
- When migrating to Windows Server 2016, eventually the Forest Functional Level will be changed to “Windows Server 2016”
- Ensure you have built a Windows Server 2016 server with a basic installation.
Build your Windows Server 2016 Domain Controller
This blog assumes you already have a Windows Server 2016 machine built.
- From Server Manager, go to Add Roles & Features and Install the Active Directory Domain Services role
- After the ADDS role is installed, open server manager again and select Promote this server to a domain controller
- On the deployment configuration pages Select Add a domain controller to an existing domain
- Enter the name of your domain
- Enter the Domain Admin credentials and click next
- On the Domain Controller Options page, ensure you select Domain Name System (DNS) and Global catalogue. Then click next.
- You will receive a warning ” A Domain controller running Windows Server 2008 or later could not be located on this domain”
- Enter a restore mode password if needed and click next
- On the DNS Options page you will recieve the following warning
- If your try and Click Next, you will most likely get this error message as well
- Switch to your Server 2003 Domain Controller (or your DNS Server if you have a dedicated DNS server) and open the DNS Manager application. The quickest way to do this is:
Start > Run > dnsmgmt.msc
- Create a new Delegation Zone and point it at your 2016 Server IP (see picture below for exact location)
- Switch back to your Server 2016 Domain Controller and press Next on the DNS Options page
- You will now be able to proceed with the installation
- On the “Additional Options” screen, ensure replicate from “ANY DOMAIN CONTROLLER” is seleted.
- Click next on the Review options page
- The installation will now Check all prerequisites have been met.
- Click next to add the 2016 server as a domain controller
- The server will need a reboot to complete the installation
- Once completed you will now have a domain controller on the domain running server 2016. It is highly recommended to leave the domain to sync. It should only take as long as the domain is set to replicate. However, from experience, if possible, leave the domain running for 48hrs. Then switch off the 2003 domain but don’t decommission yet. You have 180 days until the 2003 server will tombstone.
- Next, build another 2016 domain controller. After you eventually decommission the 2003 server, you can then ensure the domain functional level is set to 2016.
If you have questions or would like some further reading, here is a link to official Microsoft Q&A about Windows Server 2003 end of life.