Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016

0

For those who may be considering upgrading Windows Server 2012 R2 Domain Controller to Windows Server 2016, there are a few things to consider first. I have never liked the idea of upgrading OS’es. It just seems like taking contaminated blood and infusing it into a potentially healthy person. However, there sometimes are good reasons to do this. Let’s take a look at the process of how to Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016.

There are some really nice new features that come with Active Directory Domain Services in Windows Server 2016. Just to name a few:

Privileged Access Management – A feature that helps to mitigate potential credentials breaches. It does this by utilizing a new bastion forest provisioned by Microsoft Identity Manager. This new forest has a special PAM trust with your existing AD forest. Also a cool feature of this provision is an expiring links feature which enables time-bound membership in a shadow group. Users can be added for specified periods of time. New KDC enhancements are in place as well restricting ticket time to the lowest possible TTL value. New monitoring capabilities. This requires a forest functional level of 2012 R2 or higher.

Azure AD join – Benefits include Single Sign On, BYOD access support, MDM integration, Accessing organization resources, etc

Microsoft Passport – This is a new key based authentication approach that utilizes OTP (one time password), phonefactor or different notification mechanism. Users log on with a biometric or PIN that is linked to a key pair.

FRS deprecation – Goodbye to FRS (file replication service). The old replication service with Windows Server 2003 is finally deprecated.  However, see our post on preparing a domain for Server 2016 – this is not entirely true.

Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016

To set up the test lab, I simply have a VM that is running Windows Server 2012 R2 and has the Active Directory Domain Services role installed.  It holds all the roles, so a basic single domain controller (you wouldn’t have this in production but for simplicity sake this is the way I setup the lab to test the upgrade).

***Note*** Always make sure to test in a lab environment the outcome of upgrades, etc, before performing any major changes in your production infrastructure.

Just a quick sanity check.  As you can see below, we show to be at the highest domain level:

w2012dc16up19-1 Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016

***Note*** I wanted to see how the upgrade handled the forestprep and domainprep since I hadn’t already ran this prior to starting the upgrade.  Let’s see.  First thing we are prompted to do is get updates.

w2012dc16up01 Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016
w2012dc16up02 Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016
w2012dc16up03 Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016

Prompted for product key…

w2012dc16up04 Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016

You can choose between the (Desktop Experience) which I opted for, or sans desktop experience.

w2012dc16up05 Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016

w2012dc16up06 Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016

w2012dc16up08 Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016

So first thing that is interesting is the warning we have here about the VMware SVGA 3D adapter.  The upgrade has you Confirm that you want to proceed and then has you do that again as you will see below.

w2012dc16up10 Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016

We are warned here that the best path may be to perform a clean install.

w2012dc16up11 Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016

Forest and Domain Prep

As the upgrade installer moves along, it recognizes that we are running this on a domain controller.  We are prompted that we have not ran the forestprep or domainprep commands and points us to the KB articles detailing these processes.

We are prompted that “Active Directory on this domain controller does not contain Windows Server 2016 ADPREP/ FORESTPREP.  The relevant KB article is found here:  http://go.microsoft.com/fwlink/?LinkId=113955

w2012dc16up11b Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016

So we leave the upgrade screen open and just open an administrator command prompt and execute the command.

***Note*** I have the ISO for Windows Server 2016 mounted on my VM.  It is mounted to the D: drive.

You need to be logged onto the schema master as a member of the Enterprise Admins, Schema Admins, and Domain Admins groups.

w2012dc16up11c Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016

Confirm the forestprep operation by typing a ‘C‘ and then pressing ENTER.

w2012dc16up11d Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016

Forestprep completes successfully.

w2012dc16up11e Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016

Now, we hit the Refresh on the upgrade screen and we have made progress.  We now are prompted to run the /DOMAINPREP command.  It points us to the same KB article.

w2012dc16up11f Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016

So, again, we open our administrator command prompt and run the domainprep command.

w2012dc16up11g Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016

Domainprep executes speedily.

w2012dc16up11h Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016

When you hit Refresh this time, it simply moves on to the applications compatibility check, so we know that we have successfully prepared the domain controller for 2016 compatibility.

w2012dc16up12 Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016

Space check is initiated…

w2012dc16up13 Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016

Ready to begin…

w2012dc16up14 Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016

I have to say this section took quite a while.  If you choose to download and install updates, those are installed during the process as well, adding to the total time.

w2012dc16up16 Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016
w2012dc16up17 Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016

Alas, we make it to the login screen:

w2012dc16up18 Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016

The first check – Can we open Active Directory?  A quick launch of Active Directory Users and Computers shows AD is alive and well after the upgrade.  The “Test User”  account I had created beforehand was brought across as we would expect, but a good check of objects coming across with the upgrade.

w2012dc16up20 Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016

Now, as we can see, when looking at both the forest and domain functional levels, we have the Windows Server 2016 level available to us.

w2012dc16up21 Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016
w2012dc16up22 Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016

Thoughts

An in place upgrade of a domain controller may not be something you want to do.  Especially if you are looking at upgrading physical hardware as older hardware may not be supported with Windows Server 2016.  Be sure to check your OEM to make sure of compatibility.  As we have shown, however, if you want to Upgrade Windows Server 2012 R2 Domain Controller to Windows Server 2016, this is definitely doable.  It is great to see the upgrade installer recognize that we had not ran forest or domainprep as of yet and wouldn’t allow the installer to move forward until we did.

My personal preference is not to upgrade as upgrades can be messy and bring across problems.  It feels much better to start with a clean slate and move forward.  Bringing a new Windows Server 2016 domain controller online into the mix would be my preference here, then demoting the old domain controllers.  Your mileage may vary though and there may be specific reasons to perform an in place upgrade.