Replacing Windows Server 2016 Domain Controllers with Windows Server 2025: The Order of Operations for a Multi-Site Forest

Start with the forest, not the servers: inventory and health, backup and forest-recovery readiness, the schema, Entra Connect off any domain controller you will retire, compatibility testing. Then site by site: promote a Windows Server 2025 domain controller, demote the 2016 one, move the retired address onto the replacement. Roles, time, DNS, SYSVOL, DHCP and decommissioning follow; functional levels come last. A failed gate ends the window with the site on two domain controllers, never one.

1. Inventory and health. Gate: dcdiag and repadmin clean, SYSVOL on DFS Replication, sites and subnets documented, services on each domain controller listed.
2. Backup and forest-recovery check. Gate: system-state backups including the schema master, one restored in a lab, a recovery runbook with an owner.
3. Schema preparation. Gate: adprep complete, the new version visible everywhere.
4. Entra Connect relocation if it runs on a domain controller. Gate: sync healthy from a member server (how).
5. Compatibility testing of legacy dependencies. Gate: each named NAS, printer, Linux host, application and machine tested against the 2025 defaults, fixed or excepted in writing (what breaks).
6. Per site: promote, demote, re-IP. Gate: the new domain controller advertises and replicates everywhere before the old one is demoted.
7. FSMO split and time source. Gate: roles on two new domain controllers, PDC emulator on an external time source.
8. DNS and SYSVOL validation. Gate: SRV records correct, Group Policy applies from every site.
9. DHCP and what still points at the old domain controller. Gate: scope options updated, the inventory of static references cleared.
10. Decommission with metadata cleanup. Gate: no NTDS Settings object, stale record or site link left behind.
11. Raise functional levels last. Gate: every domain controller on Windows Server 2025, two weeks of clean replication, a fresh backup.

The schema is the one forest-wide change nobody can undo, so it gets its own window rather than riding on the first promotion.

The numbers, from Microsoft's schema-version table: Windows Server 2016 is objectVersion 87, Windows Server 2019 and 2022 are 88, Windows Server 2025 is 91 (Sch89.ldf through Sch91.ldf are introduced with Windows Server 2025). Read objectVersion before planning. Microsoft's functional-level interoperability matrix shows a Windows Server 2025 domain controller supported at the Windows Server 2016 and Windows Server 2025 forest and domain functional levels and not at Windows Server 2012 R2, so a forest or domain still below the 2016 level is raised before the first 2025 promotion.

Promotion runs adprep automatically. We run it deliberately anyway: /forestprep against the schema master with Schema Admins and Enterprise Admins, /domainprep against the infrastructure master with Domain Admins, in its own change window, then replication confirmed to every site.

Safe? The changes are additive: new classes and attributes, nothing existing altered. Reversible? No. Schema additions can be disabled but not removed; the only way back is a forest recovery from the pre-change backup, which is why step 2 is a gate, not advice.

In each site: promote the new Windows Server 2025 domain controller with a new name and a temporary address, let it replicate and advertise, demote the 2016 domain controller, then move the retired domain controller's IP address and DNS registration onto the replacement.

The reason is everything you have not found yet. A DHCP option nobody documented, a NAS with a hard-coded DNS server, a Linux resolver file, an application setting: all keep working because the address still answers, now from a supported domain controller. Hostname references are different: the old name stays retired, since a resurrected name invites stale metadata and Kerberos problems, and those come out of the inventory in step 9.

The cost is a short second change per site: the new domain controller is off the network for a few minutes as its address changes and its records re-register, while the site's other domain controller carries authentication. The gain is predictability: the sixth site goes the way the first did.

Two domain controllers per site is the rule: one is a single point of failure for every logon the moment it is patched; the second carries the site during the swap. Six sites make twelve. Two new sites with no subnet, bandwidth or latency data yet start with one each until the numbers exist, which makes fourteen.

Virtual domain controllers need two rules. At least one per site lives off the cluster it authenticates, so a cluster that needs Active Directory at boot can find it. And no domain controller is rolled back with a hypervisor snapshot; the rollback is a backup. If hotpatching is why you chose Windows Server 2025, do the Azure Arc connection, Virtualization-Based Security and the enrollment at build time; Microsoft has offered it for Arc-enabled Windows Server 2025 at no additional charge since 19 May 2026 (what each piece needs).

The FSMO roles split across two new domain controllers at the main site: schema master and domain naming master on one, PDC emulator, RID master and infrastructure master on the other. The PDC emulator is the root of the Windows Time hierarchy, so it gets an external time source and the demoted holder's time configuration is reset.

A forest on three continents gets three overnight windows, one per region in that region's night, often the partner's afternoon. The main site goes first because the roles move there. Inside a window: promotion done the evening before and replicated, demotion, re-IP, validation of SRV records and Group Policy, the DHCP change, the record closed.

Roles are agreed before the first window. The partner does the promotions, the role transfers, the DNS and DHCP changes, the demotions, the validation and the metadata cleanup. The customer's team does the hardware and hypervisor, the operating system build, the networking (VLANs, the Arc allow-list) and the hands-on work at the regional sites.

Production stays up because authentication never depends on the domain controller being replaced, and a failed gate defers the swap rather than pushing it through.

Four paths exist; the first is not reasonable for domain controllers.

ESU is a safety valve, not a plan (what stops on 12 January 2027).

A hardware manufacturer with six sites on three continents runs one forest and one domain on about ten Windows Server 2016 domain controllers: SYSVOL on DFS Replication, Entra Connect with Password Hash Sync and password writeback on one of the domain controllers, and an ERP, factory and lab equipment authenticating against Active Directory. The schema reads 88.

Phase 1 replaces the ten 2016 domain controllers before 12 January 2027. The first gated production change is adprep against the schema master, gated as above. Entra Connect moves to a member server before its domain controller is touched, which also meets the Entra Connect Sync minimum version enforced since 30 September 2026. A compatibility-testing stage is added because Windows Server 2025 requires SMB signing for outbound connections by default, has removed NTLMv1 and enforces stricter certificate mapping; suspects: older NAS devices, scan-to-folder printers, Linux hosts on SSSD or Winbind, some production equipment. Each site then gets promote, demote and re-IP in one of three overnight windows. The FSMO roles land on two new domain controllers, and the new servers are built Arc-connected with hotpatch enrolled.

Phase 2, between January and March 2027, adds the two new sites once their subnet, bandwidth and latency data exists, redesigns the site links and raises the functional levels. DHCP is undocumented, so the per-site address swap covers whatever still points at a retired address. Windows Server 2016 ESU is priced as the paid safety valve for Phase 1, not as the plan.

Each new domain controller needs Windows Server 2025 Standard at the 16-core minimum, $1,176 per 16-core pack at Microsoft list price, October 2026 price list, so twelve to fourteen domain controllers is twelve to fourteen packs. Then the CAL rule: Microsoft's licensing guidance says Windows Server 2025 CALs permit access to Windows Server 2025 and prior versions, not the reverse, so 2016-era CALs without Software Assurance mean a Windows Server 2025 CAL for every user ($50) or device ($39), which can cost more than the migration services. The licensing article works the arithmetic.

For one domain controller, Domain Services and Active Directory Roles Migration is a single-server role transfer at $900 per project in three days. For several sites, Multi-Site Domain Controller Migration to Windows Server 2025 starts at $12,500 over eight weeks. If DHCP moves too, DHCP, DNS and NPS Role Migration is $450 per server plus a $950 tenant fee. The licenses, any ESU and any Azure Arc add-ons you switch on are Microsoft's charges, billed to you.

Windows Server 2016 end of support is in January 2027 and we have ten domain controllers across six sites. Where do we start?

With the forest: health checks and a backup restore, then the schema version, then what else runs on the domain controllers. Site work starts after the schema is at 91 and the compatibility list is tested.

Is adprep safe to run on a production forest, and can it be rolled back?

Safe when gated: a verified system-state backup of the schema master and replication confirmed afterward. It cannot be rolled back; the only way back is a forest recovery from the pre-change backup.

Should we keep the old domain controller's IP address?

Yes, on the replacement, after the old one is demoted: promote on a temporary address, demote, then move the retired address and its DNS registration across. The old name stays retired.

How do you cut over domain controllers in several countries without taking production down?

One site per overnight window, with two domain controllers per site so the site is never on one. The partner runs promotion, demotion, re-IP, DNS and DHCP; the customer's team handles hardware, operating system, networking and hands-on work. A failed gate defers the swap.

If we will not finish before 12 January 2027, what does Windows Server 2016 ESU cost and how fast can we enroll?

Year one covers January 2027 to January 2028, per core at Microsoft's price; the ESU calculator prices it beside the cost of replacing. Enrollment through Azure Arc takes about a week.