How to Migrate a Domain Controller to Windows Server 2025 (Step-by-Step Guide)

Migrating a domain controller means standing up a new Windows Server 2025 DC alongside your existing one, replicating Active Directory to it, transferring the five FSMO roles, and then demoting the old server. Done in this order, the migration completes with no domain downtime and no rebuild of your directory.

This guide walks through the full process: the health checks that prevent most failed migrations, promotion of the new DC, FSMO role transfer by PowerShell and GUI, DNS and DHCP updates, safe demotion of the legacy server, and the functional-level raise that unlocks the Windows Server 2025 features.

🔑 Need a licence for the new server? Buy a genuine Windows Server 2025 Standard key from LicenceHouse — instant delivery, lifetime licence.

What does migrating a domain controller actually involve?

Migrating a domain controller is a side-by-side process, not an in-place upgrade. You add a new server to the existing domain, promote it to a domain controller so Active Directory replicates onto it, move the FSMO roles across, repoint DNS, then demote the old DC. The domain stays online throughout.

Two things commonly surprise administrators coming from older migrations. First, you no longer run adprep /forestprep and /domainprep as separate manual steps — promoting the first Windows Server 2025 DC through Server Manager runs schema preparation automatically, provided your account holds Schema Admins and Enterprise Admins membership.

Second, an in-place operating system upgrade of a production DC is technically possible but is not the recommended path. A clean server plus replication gives you a known-good directory and an easy rollback: if anything goes wrong before demotion, the old DC is still there holding everything.

Migration approaches compared

The rest of this guide covers the side-by-side method, since it is the approach Microsoft recommends and the one that suits single-domain and small multi-site environments alike.

What do you need before you start the migration?

Before promoting anything, confirm four things: your current forest and domain functional levels meet the minimum for the new DC, SYSVOL replicates using DFSR rather than the legacy FRS, Active Directory is healthy with no replication errors, and you hold a verified system state backup of the current DC.

Check your functional levels

A Windows Server 2025 domain controller requires the forest and domain to already be at a supported functional level. Run this on an existing DC:

Get-ADForest | Select-Object ForestMode
Get-ADDomain | Select-Object DomainMode

If your levels are still at Windows Server 2008 R2 or 2012 R2, raise them to at least Windows Server 2016 before adding a 2025 DC. Raising the functional level is one-way — you cannot lower it afterwards without a forest restore, so confirm no legacy DCs remain first.

Confirm SYSVOL uses DFSR, not FRS

This single check blocks more migrations than any other. File Replication Service (FRS) was deprecated and removed from modern Windows Server releases. If your domain still replicates SYSVOL using FRS, a new DC cannot replicate policy and script files correctly.

dfsrmig /getglobalstate

You want the response to report the "Eliminated" state. If it reports "Start" or "Prepared", complete the FRS-to-DFSR migration fully before continuing. Why this matters causally: Group Policy objects live in SYSVOL, so a broken SYSVOL replication produces a DC that authenticates users but silently fails to apply policy — a fault that often surfaces weeks later.

Run a health check

dcdiag /v
repadmin /replsummary
repadmin /showrepl

Resolve every error and warning before you promote. Migrating on top of an existing replication fault carries the fault forward into the new DC.

Take a backup

wbadmin start systemstatebackup -backupTarget:E: -quiet

A system state backup captures Active Directory, SYSVOL, and the registry. Keep it until the migration is fully verified and the old DC has been demoted cleanly.

How do you promote the new server to a domain controller?

Install Windows Server 2025, give it a static IP address, point its preferred DNS at your existing domain controller, join it to the domain as a member server, then add the Active Directory Domain Services role and run the promotion wizard — choosing to add a DC to your existing domain.

1. Install and patch the OS. Apply all available updates before adding any roles.
2. Set a static IP. Domain controllers should never use DHCP for their own address.
3. Set preferred DNS to your existing DC. The new server must resolve the domain to find it. You will change this after promotion.
4. Join the domain as an ordinary member server and restart.
5. Add the AD DS role: Server Manager → Manage → Add Roles and Features → Active Directory Domain Services. Add the DNS Server role too if your existing DCs host DNS.
6. Promote: click the notification flag in Server Manager → "Promote this server to a domain controller".
7. Select Add a domain controller to an existing domain and supply credentials with Domain Admins rights (plus Schema and Enterprise Admins for the first 2025 DC in the forest).
8. Tick Global Catalog (GC) and DNS server, set a DSRM password, and choose to replicate from any available DC.
9. Review the prerequisites check and click Install. The server restarts automatically.

The same promotion sequence applies whether you are coming from Windows Server 2016, 2019, or 2022. Only the functional-level prerequisites differ.

Verify replication before going further

Give replication time to complete, then confirm the new DC is healthy and holding a copy of the directory:

dcdiag /v
repadmin /showrepl
Get-ADDomainController -Filter * | Select-Object Name, Site, IsGlobalCatalog

Do not transfer FSMO roles until replication reports clean. Transferring roles onto a DC that has not finished replicating is one of the few ways to genuinely damage a directory during migration.

How do you transfer FSMO roles to the new domain controller?

Run Move-ADDirectoryServerOperationMasterRole from the new DC with all five role numbers in a single command. The five Flexible Single Master Operations roles — Schema Master, Domain Naming Master, RID Master, PDC Emulator, and Infrastructure Master — can each be held by only one DC at a time.

Identify the current role holders

netdom query fsmo

Or with PowerShell:

Get-ADForest | Select-Object SchemaMaster, DomainNamingMaster
Get-ADDomain | Select-Object PDCEmulator, RIDMaster, InfrastructureMaster

Transfer all five roles in one command

Open PowerShell as Administrator on the new domain controller and run:

Move-ADDirectoryServerOperationMasterRole -Identity "NewDCName" -OperationMasterRole 0,1,2,3,4

Replace NewDCName with your new server's hostname. The numbers map as follows: 0 = PDC Emulator, 1 = RID Master, 2 = Infrastructure Master, 3 = Schema Master, 4 = Domain Naming Master. Confirm each prompt, or append -Confirm:$false to accept them all.

Verify the transfer

netdom query fsmo
Get-ADDomainController -Filter * | Select-Object Name, OperationMasterRoles

All five roles should now name the new server.

The GUI alternative

If you prefer the consoles, the roles live in three separate places — which is exactly why PowerShell is faster:

• RID, PDC, Infrastructure: Active Directory Users and Computers → right-click the domain → Operations Masters
• Domain Naming Master: Active Directory Domains and Trusts → right-click the root → Operations Master
• Schema Master: register the snap-in first with regsvr32 schmmgmt.dll, then open Active Directory Schema → right-click → Operations Master

In the GUI, you must be logged onto the target DC — the console transfers the role to the server you are connected to, not to one you pick from a list.

Transfer versus seize — an important distinction

A transfer is a graceful handover between two online DCs and is what you want during a planned migration. A seizure forcibly assigns a role when the current holder is permanently offline and unrecoverable. After seizing a role, the old holder must never be brought back onto the network, because two DCs claiming the same role causes directory inconsistencies. Only seize in a genuine failure scenario.

What needs updating after the roles move?

Update DNS on the new DC to point at itself, change the DNS servers handed out by DHCP, and check any device or application with a hard-coded DC address. Clients keep authenticating against whichever DC DNS tells them about — so DNS, not Active Directory, is what actually completes the cutover.

1. On the new DC: set the preferred DNS server to its own IP address, with a secondary pointing to another DC if you have one.
2. In DHCP: update scope option 006 (DNS Servers) to list the new DC. This is the change that moves the bulk of your clients.
3. Check DNS forwarders and conditional forwarders carried over from the old server.
4. Audit static references: firewalls, NAS devices, printers, hypervisors, VPN appliances, and line-of-business servers often hold a hard-coded DC IP that no DHCP change will fix.
5. If the old DC held DHCP, migrate the scopes to the new server before demotion.

Test from a client: run gpupdate /force, change a test user's password, and confirm name resolution works. Then run nltest /dsgetdc:yourdomain.local to confirm which DC the client is using.

How do you safely demote the old domain controller?

Demote the old server through Server Manager by removing the Active Directory Domain Services role, which launches the demotion wizard. Never simply power the old DC off or delete its computer object — that leaves orphaned metadata in the directory that must be cleaned up manually afterwards.

1. Confirm the old DC no longer holds any FSMO role (netdom query fsmo).
2. Leave the new DC running for several days first so any overlooked dependency surfaces while the old server is still available to fall back on.
3. On the old DC: Server Manager → Manage → Remove Roles and Features → clear Active Directory Domain Services.
4. The demotion wizard launches. Do not tick "Force the removal of this domain controller" unless the server genuinely cannot contact the domain.
5. Set a local Administrator password and complete the wizard. The server restarts as a member server.
6. Once demoted, unjoin it from the domain or decommission it entirely.

Clean up the leftovers

After demotion, check that the old server is gone from Active Directory Sites and Services (expand the site → Servers) and remove any stale DNS records — host (A), name server (NS), and the service (SRV) records under _msdcs. Stale NS records are a frequent cause of intermittent slow logons after an otherwise clean migration, because clients periodically attempt to reach a DC that no longer exists.

When should you raise the functional level?

Raise the domain and forest functional level only after every domain controller in the environment is running Windows Server 2025 and the old DCs have been demoted. The Windows Server 2025 functional level unlocks features such as the larger 32K database page size, but the change cannot be reversed.

Set-ADDomainMode -Identity "yourdomain.local" -DomainMode WinThreshold
Set-ADForestMode -Identity "yourdomain.local" -ForestMode WinThreshold

Confirm no legacy DCs remain before running these, and take a fresh system state backup first. If you plan to add any older DC in future — for example a 2019 server at a branch site — hold off on raising the level, because doing so will block that server from being promoted.

Common migration problems and how to fix them

Frequently Asked Questions

Can you migrate a domain controller without downtime?

Yes. Because the new DC replicates Active Directory from the existing one while both are online, the domain continues authenticating users throughout. The only brief interruption is a reboot of each individual server, which other DCs cover. Single-DC environments should schedule a maintenance window for the demotion step.

Do you still need to run adprep manually?

No. Promoting the first Windows Server 2025 domain controller through Server Manager prepares the forest and domain schema automatically, as long as the account performing the promotion belongs to Schema Admins, Enterprise Admins, and Domain Admins. Manual adprep remains available for administrators who prefer to run schema preparation as a separate, controlled step.

How long does a domain controller migration take?

For a single-domain environment with one or two DCs, the technical work typically takes two to four hours, most of it waiting for replication and reboots. The realistic timeline is longer: allow several days between promoting the new DC and demoting the old one so that overlooked dependencies surface while rollback is still easy.

Can you run different Windows Server versions as domain controllers at the same time?

Yes, and this is exactly what makes the migration safe. A Windows Server 2025 DC coexists with 2016, 2019, and 2022 DCs provided the functional level supports them. Mixed versions are intended as a transitional state, though — not a permanent arrangement, since the domain stays limited to the capabilities of the oldest functional level.

What happens if the old domain controller fails before you transfer the FSMO roles?

You would need to seize the roles onto the new DC rather than transfer them, using Move-ADDirectoryServerOperationMasterRole with the -Force parameter. The failed server must then never rejoin the network, and its metadata must be cleaned up with ntdsutil. This is why a verified system state backup before starting is not optional.

Which Windows Server edition do you need for a domain controller?

Standard edition is sufficient for Active Directory Domain Services in most environments. Datacenter edition is worth the difference only if you need unlimited virtual machine licensing on the same host. Both editions run identical AD DS functionality.

Licence the new server

Every domain controller needs its own Windows Server licence, plus Client Access Licences for the users or devices connecting to it. LicenceHouse supplies genuine keys with instant email delivery:

• Windows Server 2025 Standard — the usual choice for a new domain controller
• Windows Server 2025 Datacenter — for unlimited virtualisation rights
• Windows Server 2022 Standard — if you are standardising on 2022 instead
• Windows Server CALs — user and device Client Access Licences
• Browse all Windows Server licences

Related guides: Windows 11 Pro download and activation guide | All download and activation guides