Complete guide to "In-Place" Migration of a Domain Controller from Windows 2008 R2 to Windows 2012 R2

This little thing is a thanks to a friend who finaly convinced to bring online some of my work.

After an extended period of search and documenting I decided I was ready to undergo a migration of a Server holding the role of Domain Controller from Windows 2008 R2 to Windows 2012 R2.

The initial server was used in productin for over 4 years, since I managed to raise it from Windows 2003 level to 2008 R2.

Server roles: 

• AD DS (+NTP)
• DNS (integrated) + WINS (for older clients)
• DHCP
• File Server + DFS (unsuitable rolefor a domain controller, I know, but that's the way I inherited it, issue soon to be addressed)
• Antivirus McAfee ePO -(obsolete role, already moved on other server, so not important)

Upgrade "in-place" just to grasp the concept, means to upgrade the operating system, preserving the initial file system, installed programs and configured roles of the initial server.
There are a lot of contradicting theories over the internet. Lots of people say that a proper upgrade from 2008 to 2012 must be done by installing a new server and configuring the roles all over again. There are others that say an "in-place upgrade" should be possible, with some brief info from Microsoft itself (details here). There are a few others who tried and succeeded this kind of upgrade and also briefly described . But no one so far (as of janury 2014 when the original text in romanian was published) documented such kind of process with plenty of information and pictures so I considered useful to share my experience with those who will face this kind of challenge.

Why "upgrade in-place" ?
Configuring a Domain Controller from scrap and also preserving all the initial functionality, serving the clients like no change happened, not to mention a need for a rather short window of downtime available, I think are enough reasons to avoid the alternative. And I experimented it the hard way a few years ago when I chose to do a clean install and importing/reconfiguring when I upgraded the domain from 2003 verson up to 2008. Maybe in the near future I will commit to a clean install and promote a brand new server, followed by decomissioning the current one. Given the "temporary" lack of available hardware I chose the "in-place upgrade" as the most convenient way.

How do we prepare.
First of all we make sure that any existing role on the server can be held by another server (and as alternative it's recommended to be prepared for a full restore from a fresh system or even bare-metal backup).
For holding the vital roles of AD DS and DNS I am relying on a freshly installed and promoted Secondary DC.
For the DFS role I have another two servers configured for read/only replication.
McAfee ePO role is already obsolete and planned to be removed(as I already told), all clients being migrated on another server, so it is not impacting any functionality.
So the single vulnerable role id DHCP. There is a /22 scope that has reservations and exclusions that we have to keep in mind. In case of emergency this role could be reconfigured from scrap without any trouble (keeping a last moment backup file in case the reservations/exclusions list is exhaustive would be advised).

A second mandatory step is being sure we have a full backup. There is ana alternative way that recommends a separate backup for AD database, for DHCP and so on, it never hurts having that. But, to be absolutely sure we have to be sure we have a "bare-metal" backup stored on a server with a static IP so we can reach it without an DHCP service operational. An average time for such a backup is about 20 minutes so restoring the server in case of failure would be pretty quick, having the operating system and vital roles restored very easy.( this can be the subject of another post for those interested).
The File Server role can be held by any of the read/only servers mentioned before, even if this role should not be vulnerable since the futher works will affect only the system partition and not the storage ones.

Now that we passed the prerequsites we can move to the core subject.

Steps to follow:

• first we make sure we use credentials with administrative rights (at least domain-wide or even forrest-wide if needed)
• apply all windows updates for bringing the system up to date (will be useful later)
• check the AD schema to be at least at 2008 level for all servers holding the AD role. This can be done by checking a certain registry key (HKLM\System\CurrentControlSet\Services\NTDS\Parameters\), htis key can hold different values: for Windows 2008 versions the right value is 47 (during migration its value will change to 56 for  Windows 2012 or 69 for 2012 R2)
• make sure production can be stopped and all the services described before are offline
• run the "bare-metal" with a destination folder/server different from scheduled backups backup, exactly before proceeding
• Inserting a DVD containing a Windows 2012 Standard kit (or other desired operating system version) making sure that the initial version supports an "in-place upgrade" (same Microsoft page as refference); be aware we suppose to have an initial operating system that has a GUI (Graphic User Interface) and we plan to migrate to one of the same kind
• AD DS Functional Level must be at least at 2003 level to be compatible ( be aware that a domain upgraded from 2000 to 2003 and then 2008 can still have a Functional Level of 2000 !!!). For a better understanding I sugest looking at this page Understanding AD Functional levels. For raising the Functional Level in case it is needed you may also check here
• we run X:\support\adprep\adprep /forestprep from the DVD, whare X is the drive letter of your DVD drive: 

• Press "C" as required and then :

 then:

     Now we are sure that schema went up to 2012 level so we can start the upgrade process.

• We are ready to run the install process directly from the existing operating system's graphic interface, right from the root of the DVD. First step will look like this:
  
  then we choose not to apply any updates (already done in the prep phase):
  
• Then we choose the Windows version being aware of the GUI choice:
  
• after that we choose to keep the file system, installed programs and already configured roles as they were ( remember the "in-place" concept), this choice assure no partitions will be altered so we keep the data on storage disks intact, including File Server and DFS roles:
  
• Right now the Windows install process makes sure the initial system is compatible with the new one:
  
• in my case there was a particular compatibility problem consisting in some roles or features that cannot be ported on the new operating system:
  
• Stopping the install process and removing the said roles (asking for a restarting also):
  
• starting the install process again and following the same procedure we got a positive result (still having a little attention mark regarding vendors support):
  
• From now on the install job does its thing by copying the new files needed from the DVD disk:
  
• Right now I eocountered a problem which needed further documentation:
  
• This was a little setback but after a quick search I found the McAfee antivirus client as being the cause. Beware, other antivirus, firewall or third party security tools may bring the same results. Disabling the antivirus client was the solution so... 
• I remember thinking "third time's a charm" and restarting the install process again
• From now on all went smooth. At some moment the RDP connection went down so I used the KVM console instead, just to be sure I got no more unexpected flukes.
  
• There were a siries of restarts, no human intervention required. Still no RDP connectivity, all lasted about 30 minutes. I was still not sure of a positive outcome:
  
  
  
• Finally I got RDP control over a new server that looked like a normal, stable and reliable one.
• At this point I was sure the operation was a successeven if some aspects still needed to be addressed !
• Post-upgrade: identifying some issues at a first glance:

• that needed attention...:

...some services that do not start and a presumed DHCP reconfiguration needed (remember it was the only sensitive, non-redundant and vital role) so I followed the steps given by the operating system itself:

Once the DHCP problem was solved it all came back to normal. The other non working services were in fact set to start with delay:

All the process lasted for about 3 hours and in the end it was all fully functional, all roles reinstated and replication with the secondary working like no change was made.

Operation was completed on 18.01.2014 between 6:00pm si 9:30pm (including preliminary phases) and after that we made thorough checks between 11:00am si 3:00am and the conclusion was the process was completely successful.

I hope this detailed documentation of my work would prove to be a real help for many fellow system administrators and I am pretty sure it was the first of its kind, at least at the time the original was issued in romanian language. Now I finally took the time to translate it so it can be of some help to non-romanian speaking people.

If some particular issues may appear or if you think any additions should be made please feel free to post your comments and I hope we can sole them together.