Finding Everything That Still Points at an Old Domain Controller Before You Demote It: DHCP Option 006, Static DNS on Appliances, Printers, Factory Equipment and Application Configs

Before a Windows Server 2016 domain controller is demoted, and all of them leave extended support on January 12, 2027, list everything that reaches it by IP address or host name rather than through the domain controller locator. Nine places: DHCP scopes, where option 006 hands out DNS server addresses and option 015 the DNS suffix; static DNS client settings on servers and appliances; printers and multifunction devices with their own DNS and address-book settings; NAS and backup appliances joined to the domain; firewalls and VPN concentrators using LDAP or RADIUS; NPS and its RADIUS clients; application configuration files and connection strings that name a DC; agents installed on the DC itself; and certificates and service principal names tied to the old host name.

The decision that shortens the list: promote the replacement, demote the old DC, then move the retired DC's IP address and DNS registration onto the replacement, site by site. Everything that points at the address carries on. The inventory is still needed for host-name, certificate and SPN references, and DHCP must move before the demotion, because a DHCP server that leaves with its DC takes every lease with it.

Each is a query or a bounded log; none changes anything clients depend on.

1. DNS query logging. Analytic events are off by default; Set-DnsServerDiagnostics turns them on. Leave it through a full lease cycle and a month-end. Each query event carries the client address: the devices whose DNS settings name this server.

2. The Netlogon log. The netlogon.log file in the Windows debug folder records a NO_CLIENT_SITE line, with client name and address, for every client whose IP maps to no Active Directory subnet; event 5807 summarizes them.

3. LDAP interface events. Setting the "16 LDAP Interface Events" diagnostic value to 2 logs event 2889 for every unsigned or cleartext simple bind, with client address and account; event 2887 is the daily count. Set it back to 0 afterward; it costs performance.

4. The DHCP export. Get-DhcpServerInDC lists every authorized DHCP server. Export-DhcpServer writes configuration, scopes, options and leases to a file, changing nothing; read options 006 and 015 at server and scope level, reservations and the failover relationships from Get-DhcpServerv4Failover.

5. NPS logs. Get-NpsRadiusClient lists the controllers, switches, firewalls and VPN gateways pointed at this server; Security log events 6272 and 6273 show which actually send requests.

6. Last logon per DC. The lastLogon attribute is not replicated. Query it on the old DC with Get-ADComputer and its -Server parameter, then on a healthy DC; recent logons only on the old DC mean it is reached by address or name. The replicated lastLogonTimestamp, refreshed only when about fourteen days old at the time of writing, shows liveness, not which DC.

One row per dependency, one page per site, owned by whoever can test the fix; the "names it by" column decides it, since the swap covers addresses but not names, certificates or SPNs.

An empty Tested column holds the demotion.

Per site: build the Windows Server 2025 server under a new name and temporary address, promote it, let replication settle, move FSMO, DHCP and NPS roles off the old DC, demote it cleanly so its SRV records, computer object and SPNs are removed, then give the replacement the old address, re-register DNS and restart Netlogon so the locator records carry it. Every device holding the old address, in a DNS field, a DHCP option, an LDAP setting or a RADIUS client entry, carries on. The full order of operations is in Replacing Windows Server 2016 domain controllers with Windows Server 2025.

Three things the swap does not cover. Host-name references: an application, printer address book or backup job that binds to the old DC by name stops resolving once its records are gone; a DNS alias keeps simple LDAP binds alive but not Kerberos. Certificates: the old DC's certificate was issued to its name and goes with it; LDAPS clients that validate the name or pin the thumbprint need the replacement's certificate. SPNs: the old DC's HOST, ldap and GC names are removed at demotion, and reusing its host name on the replacement needs the old computer object gone first, a second cutover, not a shortcut.

The Windows Server 2025 defaults, SMB signing required for outbound connections and NTLMv1 removed among them, are a separate list: What breaks when domain controllers move to Windows Server 2025.

DHCP on a domain controller is the usual reason the questionnaire comes back blank: installed with the DC, never opened since. Three facts set the plan.

The role leaves with the DC. Demotion does not move the scopes; if the old DC is a site's only DHCP server, every lease there expires. So the role moves first; the IP swap helps only if the address holder also runs DHCP.

The lease sets the cutover window. A new scope defaults to an eight-day lease, at the time of writing, and a client renews halfway through it, so a changed option 006 reaches every client within four days. Shorten the lease to a few hours one lease-length before the change, confirm from real clients, then restore it.

Where the role goes. A Windows Server 2025 member server per site, or a failover pair, is cleaner than the replacement DC: DHCP on a DC registers DNS records under the DC's own account unless dedicated dynamic-update credentials are configured. Export-DhcpServer and Import-DhcpServer move configuration and leases; the dynamic-update credential and DnsUpdateProxy membership are re-entered by hand; the new server is authorized and the old unauthorized; relay agents are re-pointed if the address changes. A failover relationship is rebuilt through Microsoft's chained procedure, a temporary relationship between an old and a new partner replicating scopes and leases before the final pair is formed.

A hardware manufacturer with six sites on three continents is replacing about ten Windows Server 2016 domain controllers in one forest before January 12, 2027, with two more sites to add in the first quarter of 2027. The questionnaire comes back blank on DHCP: nobody can say which servers hand out leases or where option 006 points.

The proposal therefore carries DHCP as a placeholder: a line per site, priced once the scopes per site, the option 006 values and any failover relationships are known, which the DHCP export answers on day one. The retired DC addresses are where DHCP lives on quietly.

Per site, the team chooses the IP swap: promote, demote, move the address and DNS registration across. The ERP, factory controllers and lab instruments authenticate against Active Directory, several by a DC's address; the swap covers them without touching the line. The inventory runs in parallel for the rest: printer address books, the LDAP connection string in the ERP, the backup agent on each DC, the LDAPS certificates, each with an owner and a test. The new sites have no subnet data yet, so the Netlogon NO_CLIENT_SITE lines are read first. The cutovers are three overnight windows across time zones; Windows Server 2016 Extended Security Updates are priced as the safety valve if a site slips, not as the plan.

Service prices are from our own price list; Windows Server 2025 licenses and any Azure meter on the new hosts are Microsoft's charges, billed to you.

The role move on its own is DHCP, DNS and NPS Role Migration to Windows Server 2025 at $450 per server plus a $950 tenant fee, about one week: inventory, exports and imports, failover rebuild, NPS certificate and RADIUS clients, lease plan, network change list, decommission.

One small domain controller that also holds DNS and DHCP is the Domain Services and Active Directory Roles Migration, $900 per project in three days, the DHCP move inside the single-server transfer.

An estate like the one above, one forest, up to six sites and fourteen domain controllers, is the Multi-Site Domain Controller Migration to Windows Server 2025, from $12,500 over eight weeks. Which 2016 hosts to upgrade, rebuild or retire is the Windows Server 2016 End of Support Assessment and Roadmap, $2,950 per project in two weeks; printers that prompt retiring the print server are Print Server Migration to Universal Print, $45 per device plus a $1,450 tenant fee.

How do we find everything that still points at an old domain controller's IP before we decommission it?

Bounded DNS query logging and LDAP interface events, the Netlogon log, each DHCP server's export, the NPS client list and the non-replicated lastLogon attribute; then the nine places, an owner per row.

Which servers provide DHCP, and does option 006 hand out domain controller addresses?

Get-DhcpServerInDC lists the authorized DHCP servers; Export-DhcpServer on each, or Get-DhcpServerv4OptionValue per scope, shows option 006, which on most 2016-era estates names the local domain controllers.

What breaks the week after a domain controller is demoted?

Whatever holds the old address or name statically: printers that cannot scan to a folder, NAS or firewall LDAP lookups that time out, Wi-Fi or VPN with no RADIUS server, a site whose only DHCP server left with the DC.

Can the replacement domain controller keep the old one's IP address?

Yes, once the old DC is demoted and its records removed: change the address, re-register DNS, restart Netlogon. The host name, certificate and SPNs do not come with it.

Should DHCP stay on the domain controllers?

It works, but a Windows Server 2025 member server or failover pair avoids the dynamic-update credential issue and decouples DC refreshes from every lease.