Prepare Active Directory Windows Server 2016 DC Adprep

8

With the RTM release of Windows Server 2016, many will be thinking about and looking to introduce a Windows Server 2016 domain controller into their existing Active Directory environments.  Let’s take a look at how to prepare Active Directory Windows Server 2016 DC Adprep and what steps are involved to introduce the first Windows Server 2016 into an existing environment.

If you are interested in an in place upgrade of Windows Server 2016 R2, check our post here.

Prepare Active Directory Windows Server 2016 DC Adprep

In my lab setup, I have an existing Windows Server 2012 R2 domain controller running a domain called TESTLAB.LOCAL.  This is a single forest, single domain environment for testing purposes.  The one Windows Server 2012 R2 DC holds all the FSMO roles.

adds2016_19 Prepare Active Directory Windows Server 2016 DC Adprep

The DCPromo Process

The DCPromo of a Windows Server 2016 server isn’t really DCpromo any longer as it wasn’t in 2012, but it seems like we all still affectionately call it that for a point of reference.  Active Directory Domain Services is installed the exact same way in Windows Server 2016 through the Server Manager Add Roles wizard.

Select the Active Directory Domain Services role.

adds2016_01 Prepare Active Directory Windows Server 2016 DC Adprep

It brings up the features informational box letting you know the additional features that will be installed with the role selected.
adds2016_02 Prepare Active Directory Windows Server 2016 DC Adprep
adds2016_03 Prepare Active Directory Windows Server 2016 DC Adprep

You can select for the server to be automatically restarted or not after installation completes if it needs to restart.

adds2016_05 Prepare Active Directory Windows Server 2016 DC Adprep
adds2016_06 Prepare Active Directory Windows Server 2016 DC Adprep

After the role complets, the wizard will tell you that additional configuration is needed to complete the promotion of the server to be a domain controller.


adds2016_07 Prepare Active Directory Windows Server 2016 DC Adprep

If you click the little flag in server manager with the yellow bang, you can then click the link to Promote this server to a domain controller.

 


adds2016_08 Prepare Active Directory Windows Server 2016 DC Adprep

Here we want to choose to Add a domain controller to an existing domain.

adds2016_09 Prepare Active Directory Windows Server 2016 DC Adprep

It is easy to miss the DSRM password field so be sure to enter and confirm.  The wizard won’t let you move forward without it however.

adds2016_10 Prepare Active Directory Windows Server 2016 DC Adprep

Below are the DNS options.  Notice the warning that “A delegation for this DNS server cannot be created because the authoritative parent zone cannot be found…”.  If you are installing a forest root domain controller that is using Active Directory-integrated DNS, you typically do not need to be concerned about this warning message.

adds2016_11 Prepare Active Directory Windows Server 2016 DC Adprep

I ran into this error on the next screen –  “Could not retrieve domain controllers.  External component has thrown an exception”.  As it turns out, the issue for me was that I was logged in as a local administrator and not a enterprise administrator from the domain. I had quickly logged in after a reboot previous to launching the promotion wizard.

***Update***  As mentioned in the comments below, this error also could have been avoided by entering in the “Supply the credentials to perform this operation” domain credentials on the Deployment Configuration screen.

adds2016_12 Prepare Active Directory Windows Server 2016 DC Adprep

After logging back in as an enterprise administrator on the domain, the replicate from domain controller part of the wizard was error free.

adds2016_13 Prepare Active Directory Windows Server 2016 DC Adprep

You can verify that you can indeed “talk” to the domain by pulling down the Replicate from combo box…you should see your domain controllers available.


adds2016_14 Prepare Active Directory Windows Server 2016 DC Adprep
adds2016_15 Prepare Active Directory Windows Server 2016 DC Adprep

Now for the forestprep and adprep wizards that we have all come to love and hateas in Windows Server 2012 and higher, this is done for you in the Active Directory Domain Services Configuration Wizard.  This is listed under the Preparation Options page of the wizard.  As noted it will perform:

  • Forest and schema preparation
  • Domain preparation

As mentioned above, make sure you are logged in as an enterprise administrator to perform these operations at a forest level.

adds2016_16 Prepare Active Directory Windows Server 2016 DC Adprep

As in Windows Server 2012 and higher, you can click the View script button to see the code in Powershell for the configuration process you have defined in the wizard.


adds2016_17 Prepare Active Directory Windows Server 2016 DC Adprep

The contents of my View Script are below.

The wizard will perform one final prerequisites check.

adds2016_18 Prepare Active Directory Windows Server 2016 DC Adprep

After installing, you will have a functional Windows Server 2016 domain controller, functioning at the lowest functional level required for your legacy DCs (lowest being Windows 2008 level).  This is mainly due to FRS being completely deprecated which is the replication service used to replicate SYSVOL contents.  Windows Server 2016 only supports domain controllers that use DFS for replication.

***UPDATE***  See the notes from Stuart Rowe below on his comments about Windows Server 2016 actually supporting FRS.  This may prove useful in a handful of use cases.

Final Thoughts

Windows Server 2016 is an exciting operating system that is certainly next generation and allows so many cloud capabilities that they are almost too numerous to mention.  If you are looking to Prepare Active Directory Windows Server 2016 DC Adprep then hopefully this quick post will show how easy the process really is to introduce your first Windows Server 2016 domain controller.

  • Chris Blackburn

    The reason you hit you “Could not retrieve domain controllers” is because in your “Add a domain controller to an existing domain” step for the Specify Credentials piece you left your locally signed in account specified. You could have easily clicked “Change” and entered your testlab.local Enterprise Admin account and credentials.
    The reason I say this is because I NEVER need to domain join a DC before promoting it. All you need to set the computer name and then run the Configuration wizard.

    • Chris, good catch…noted….will update the post to reflect.

  • Stuart Rowe

    A word about FRS. Windows 2016 will join a Windows 2003 domain. While the check box is not present under Roles, the Promo process will install the binaries. Took a support case and couldn’t believe my eyes that MS has done this. So, another 3 or so years of new technology allowing dead skin to hang off it. I was SO ready to flip the bird at FRS as the calls of “I can’t promote 2016 to a DC!” started coming in.

    So what I’m saying is: Your statement about 2016 only supporting DFS as the mechanism to replicate SYSVOL is incorrect, sadly.

    BAH.

    • Stuart, Thanks so much for the note about FRS and 2003. I didn’t run any tests myself with 2003 and was simply going from the documentation. That is what makes the tech community of engineers great…someone out there has experienced or tried just about everything. While it does maybe make life a bit easier for someone in that special use case scenario that must integrate with 2003, sadly as you mention, it kicks the rock further down the road. I will update the post to reflect your notes on this. Thanks again.

  • Giorgio Busoni

    If I want to upgrade an existing DC from Windows 2012R2 to Windows 2016, can I try directly or should i demote it, upgrade and promote it back?

    • George,

      I just posted a new post on an in place upgrade from 2012 R2 to 2016: http://www.virtualizationhowto.com/2016/11/upgrade-windows-server-2012-r2-domain-controller-to-windows-server-2016/

      The process seems to work pretty well at least on a VM. If you are talking about physical hardware, make sure you have checked drivers, etc, before running the upgrade. Also, as always if possible test everything in a lab first.

      • Giorgio Busoni

        Thanks! I run into a problem upgrading a physical machine, an hyperv host, however it doesn’t look like it is driver related. If I try to run gpupdate /force when logged as domain admin, I get computer polices updated succesfully, but I get an error while updating the user polices. Should I remove the machine and join it back to the domain? Or what?

  • Hi ALL.
    I tried ADD new Windows 2016 as secondary DC in 2012 r2 domain/forest.
    Wizard has error:
    Verification of prerequisites for Active Directory preparation failed. Unable to perform Exchange schema conflict check for domain.com
    Exception: Class not registered.
    Adprep could not retrieve data from the server PDC through Windows Managment Instrumentation (WMI).
    [User Action]
    Check the log file ADPrep.log in the C:Windowsdebugadpreplogs20170113104318-test directory for possible cause of failure.

    Logs says:
    [2017/01/13:10:43:18.808]
    Adprep failed while performing Exchange schema check.
    [Status/Consequence]
    The Active Directory Domain Services schema is not upgraded.
    [User Action]
    Check the log file ADPrep.log in the C:Windowsdebugadpreplogs20170113104318-test directory for possible cause of failure.
    [2017/01/13:10:43:18.809]
    Adprep encountered an error.
    Error code: 0x80040154 Error message: Class not registered

    Help me pls