# Moving Entra Connect Off a Domain Controller You Are Retiring: Staging Mode, Password Hash Sync and Writeback, Cutover and Rollback

> Move Entra Connect off a retiring domain controller: staging mode, the export comparison, Password Hash Sync and writeback checks, cutover and rollback.

Canonical: https://o365hq.com/blog/moving-entra-connect-off-a-domain-controller-you-are-retiring
Provider: IT Partner LLC — US Microsoft partner since 2006. Book: https://o365hq.com/book

Published: 2026-10-18 · IT Partner

Entra Connect is running on a domain controller due to be demoted before Windows Server 2016 leaves extended support on 12 January 2027. The sync server leaves first: a second server in staging mode, a compared export, a swap that takes minutes, and the old server kept as the rollback for a week.

## The move in one paragraph, then the eight steps

You do not migrate an Entra Connect server; you build a second one and swap. Two servers can run at once only if one is in staging mode: one exports to Microsoft Entra ID, the other imports and synchronizes but writes nothing. With Password Hash Sync, Microsoft Entra ID authenticates against the hashes it already holds, so users keep signing in through the swap and only new objects, attribute changes and password changes wait for the next cycle. Install the current release (2.6.92.0, released 23 September 2026) from the Microsoft Entra admin center; from 7 April 2027 any server below 2.6.84.0 without application-based authentication stops synchronizing.

1. **Inventory the current server:** version, operating system, sign-in method, features, filtering, custom rules, the exported settings file.
2. **Build a member server** on Windows Server 2025 or 2022, domain-joined, full desktop, Tier 0 hardened. Not a domain controller.
3. **Install the current version in staging mode**, importing the settings file.
4. **Compare the export** and explain every change the new server would make.
5. **Swap:** old server into staging mode first, then the new server out of it.
6. **Verify** Password Hash Sync, writeback and hybrid join with real tests.
7. **Retire the old server:** staged for the rollback window, then fully uninstalled.
8. **Demote the domain controller last.**

## Why Entra Connect on a domain controller is a problem now

Microsoft's prerequisites page asks for a domain-joined Tier 0 server, Windows Server Standard or better with the full desktop experience, and recommends Windows Server 2025 or 2022; older versions still in extended support may need a paid support program. Its disaster-recovery guidance mentions a domain controller only as a temporary host; one about to be demoted is the opposite of temporary.

The version clock runs separately. Our [deadlines page](/deadlines) records 30 September 2026 as the date Microsoft set for enforcing a minimum Entra Connect Sync version (2.5.79.0), and that version itself retires on 23 October 2026. Microsoft's hardening page, updated 30 September 2026, sets the next bar: 2.6.84.0 or later with application-based authentication by 7 April 2027, after which synchronization stops until the server is upgraded. The new build needs .NET Framework 4.7.2 and TLS 1.2, so the move and the upgrade are one job.

The third clock is the domain controller's own: Windows Server 2016 leaves extended support on 12 January 2027, and the [order of operations for replacing 2016 domain controllers](/blog/replacing-windows-server-2016-domain-controllers-with-windows-server-2025-order-of-operations) demotes each old server after its replacement is promoted. Entra Connect must be gone first.

## Staging mode, and how you compare the two servers

A server in staging mode runs the same import and synchronization cycle as the active server, keeps its own database, and suppresses exports. Password Hash Sync and password writeback stay off while it is staged and switch on the moment staging mode is disabled.

Entra Connect writes a JSON snapshot of its settings to its ProgramData\AADConnect folder, and the wizard's **Customize** path has an **Import synchronization settings** option that reads it; a server installed this way lands in staging mode by default. Four things do not travel: restrictions on synchronized object types, a trimmed attribute list, custom run profiles and the provisioning hierarchy. Custom rules travel if their precedence sits in the reserved 0 to 99 range; older servers export each rule as PowerShell, with the connector GUID replaced.

On the staging server, run a full import on each connector and a delta synchronization, then `csexport` against the Microsoft Entra ID connector and `CSExportAnalyzer` on the result: a CSV of every add, update and delete the new server would push if it were active. Expect a short, explainable list; a long one, or any deletes, means a configuration difference to fix before trying again. Leave the prevent-accidental-deletes threshold on.

## The features that need their own check

Each feature below gets its own post-swap test.

| Feature | What the move changes | Check after the swap |
|---|---|---|
| Password Hash Sync | Off while staged; resumes from its watermark, then runs every two minutes | Change a test password on-premises; sign in within minutes |
| Password writeback | Off while staged; needs Microsoft Entra ID P1 and Reset password, lockoutTime, pwdLastSet and Unexpire Password rights | Self-service reset on a test account; pwdLastSet changes on-premises |
| Group writeback | V2 deprecated; V1 still works for Microsoft 365 groups until Cloud Sync group provisioning replaces it | A new Microsoft 365 group appears on-premises |
| Device writeback | Fills the RegisteredDevices container for Windows Hello for Business certificate trust and AD FS device-based Conditional Access | A newly registered device appears there |
| Seamless single sign-on | The AZUREADSSOACC computer account lives in Active Directory, not on the server; roll its Kerberos key at least every 30 days | Run Update-AzureADSSOForest once per forest |
| Exchange hybrid | Writes a fixed attribute set back to Active Directory; tick it on the new server | Its attributes appear as updates, not adds, in the comparison |

Pass-through authentication's first agent lives on the Entra Connect server; install standalone agents elsewhere first (Microsoft suggests three). Federation through AD FS is its own project: [AD FS to Microsoft Entra ID Migration](/services/ad-fs-to-microsoft-entra-id-migration).

## Cutover and rollback, with timings

The scheduler runs a delta cycle every 30 minutes by default; Password Hash Sync runs every two minutes on the active server. A change made during a ten-minute swap therefore waits at most about 30 minutes; users keep signing in throughout.

The order matters. On the old server, open the wizard, choose **Configure staging mode**, tick the box and leave synchronization running; `Get-ADSyncScheduler` then shows StagingModeEnabled as True. Only now untick the same box on the new server: Microsoft warns that a second active server using password writeback disrupts the first one's service bus channel. Confirm Export steps appear in Synchronization Service Manager, then run the checks above.

Expect a catch-up: Password Hash Sync resumes from the watermark recorded while staged, a long stay in staging means hours of backlog during which newly changed passwords do not work in the cloud, and Microsoft says not to restart the sync services meanwhile.

Rollback is the same procedure in reverse: new server back to staging, old server active, two wizard runs, no reinstall. That is why the old server stays staged, not switched off. Afterwards, uninstall Entra Connect completely: a forgotten server that can still reach Microsoft Entra ID reverts attributes to its stale copy every 30 minutes.

## Worked example: the sync server on one of ten domain controllers

A hardware manufacturer with six sites on three continents runs one forest and one domain on about ten Windows Server 2016 domain controllers; Entra Connect with Password Hash Sync and password writeback runs on one of them. The move is added to scope as its own item, sequenced after the schema update and before that server's promote-demote-reIP step.

The plan in progress: a Windows Server 2025 member server built as a generation 2 virtual machine, so a virtual TPM backs the application-based authentication certificate; settings exported from the domain controller and imported in staging mode; the comparison export reviewed by the identity owner. The swap takes a daytime window separate from the three overnight domain controller windows, because a swap reverses in minutes. Then the test password change, self-service reset and per-site device check. The old domain controller stays staged for one week, then Entra Connect is uninstalled, then it is demoted and its address moves to the replacement.

In the second pattern, a medical practice of about 200 users being acquired by a hospital group keeps its Entra Connect server: the operating system is upgraded in place to Windows Server 2025, Entra Connect is upgraded to the current release, and the server joins the rest of the dozen on Azure Arc for the acquirer's audit row.

## When to go further: cloud-only, and Cloud Sync against Connect Sync

If the domain controller you are retiring is one of the last two, the better question is whether Active Directory stays at all. [Retiring on-premises Active Directory](/blog/retiring-on-premises-active-directory-going-cloud-only-with-entra-id-and-intune) walks through the readiness test; our [On-premises Active Directory to Microsoft Entra ID Transition](/services/on-prem-active-directory-to-microsoft-entra-id-transition) is $4,950 per project over three weeks, and on that path the sync server is decommissioned rather than moved.

Cloud Sync against Connect Sync, in two sentences. Microsoft Entra Cloud Sync is a lightweight agent managed from the Microsoft Entra admin center, runs multiple active agents, and covers Password Hash Sync, password writeback, Exchange hybrid and device sync for hybrid join within 150,000 objects per domain and 50,000 members per group; Microsoft recommends it where eligible. Connect Sync remains the tool for pass-through authentication setup, device writeback, advanced synchronization rules, attribute-based filtering or larger domains.

## What it costs

Entra Connect carries no Microsoft charge; the licenses its features need (Microsoft Entra ID P1 for password writeback, Windows Server 2025 for the new member server) and Microsoft's meters for Azure services such as the Arc add-ons in the second pattern are yours.

For one domain controller, the move sits inside [Domain Services and Active Directory Roles Migration](/services/active-directory-domain-controller-migration), $900 per project over three days: the retiring domain controller's roles, DNS and DHCP included, moved to a new server, Entra Connect staging build and swap included. For an estate, it is a line item in [Multi-Site Domain Controller Migration to Windows Server 2025](/services/multi-site-domain-controller-migration-windows-server-2025), from $12,500 over eight weeks for one forest, up to six sites and fourteen domain controllers. If the sync server stays and only its operating system changes, the [Windows Server 2016 to 2025 Upgrade Service](/services/windows-server-2016-to-2025-upgrade) is $650 per server plus a $1,950 tenant fee.

## Frequently asked questions

### Can two Entra Connect servers run at once?

Yes, as active and staging: one server exports to the tenant, any number of staging servers import beside it. Two active servers are unsupported even with mutually exclusive scopes.

### What is staging mode?

A wizard setting under which the server imports from Active Directory and Microsoft Entra ID and synchronizes but exports nothing, with Password Hash Sync and password writeback off. Disable it and all three switch on.

### Which Entra Connect version do we need?

The current release, 2.6.92.0, released 23 September 2026, from the Microsoft Entra admin center. Each 2.x version retires twelve months after the next ships; 2.5.79.0 retires on 23 October 2026; from 7 April 2027 any server below 2.6.84.0 without application-based authentication stops synchronizing.

### Does the move break sign-in?

With Password Hash Sync, no: Microsoft Entra ID authenticates against the hashes it holds, and the swap only delays new changes until the next cycle. With pass-through authentication, install standalone agents elsewhere first.

### Can we put Entra Connect on the new domain controller instead?

You can, and the next domain controller retirement forces this move again; Microsoft's prerequisites call for a Tier 0 member server and mention a domain controller only as a temporary host.

## Where Entra Connect goes next

| Option | When it fits | What you keep | Watch for |
|---|---|---|---|
| New member server, staging swap | Host is a domain controller or unsupported OS; Active Directory stays | Every Connect Sync feature, same configuration | Settings that do not import; password sync catch-up; old server fully uninstalled |
| Upgrade the operating system in place | A member server on a listed path (2016, 2019 or 2022 to 2025) | Server, database, address | No rollback if the upgrade fails; Microsoft prefers the swing migration |
| Microsoft Entra Cloud Sync | Under 150,000 objects per domain and 50,000 members per group; no device writeback, pass-through setup or advanced rules | Password Hash Sync, password writeback, Exchange hybrid, hybrid join; multiple agents | Limited attribute filtering; a migration of its own |
| Cloud-only, retire Active Directory | Few remaining domain controller dependencies; devices can be re-provisioned | Nothing on-premises to patch | The readiness test in the retiring-AD article |

## Sources

- Microsoft Learn, "Microsoft Entra Connect: Staging server and disaster recovery" (entra/identity/hybrid/connect/how-to-connect-sync-staging-server), retrieved October 2026
- Microsoft Learn, "Microsoft Entra Connect: Prerequisites and hardware" (entra/identity/hybrid/connect/how-to-connect-install-prerequisites), updated 16 January 2026, retrieved October 2026
- Microsoft Learn, "Microsoft Entra Connect: Upgrade from a previous version" (entra/identity/hybrid/connect/how-to-upgrade-previous-version), retrieved October 2026
- Microsoft Learn, "Import and export Microsoft Entra Connect configuration settings" (entra/identity/hybrid/connect/how-to-connect-import-export-config), retrieved October 2026
- Microsoft Learn, "Microsoft Entra Connect Sync: Scheduler" (entra/identity/hybrid/connect/how-to-connect-sync-feature-scheduler), retrieved October 2026
- Microsoft Learn, "Implement password hash synchronization with Microsoft Entra Connect Sync" (entra/identity/hybrid/connect/how-to-connect-password-hash-synchronization), retrieved October 2026
- Microsoft Learn, "Enable Microsoft Entra Password Writeback" (entra/identity/authentication/tutorial-enable-sspr-writeback), updated 27 May 2026, retrieved October 2026
- Microsoft Learn, "Microsoft Entra Connect: Version release history" (entra/identity/hybrid/connect/reference-connect-version-history), updated 23 September 2026, retrieved October 2026
- Microsoft Learn, "Hardening update to Microsoft Entra Connect Sync" (entra/identity/hybrid/connect/harden-update-ad-fs-pingfederate), updated 30 September 2026, retrieved October 2026
- Microsoft Learn, "Authenticate to Microsoft Entra ID by using application identity" (entra/identity/hybrid/connect/authenticate-application-id), retrieved October 2026
- Microsoft Learn, "Quickstart: Microsoft Entra seamless single sign-on" and "Microsoft Entra seamless single sign-on: Frequently asked questions" (entra/identity/hybrid/connect/how-to-connect-sso-quick-start and how-to-connect-sso-faq), retrieved October 2026
- Microsoft Learn, "Microsoft Entra pass-through authentication: Quickstart" (entra/identity/hybrid/connect/how-to-connect-pta-quick-start), retrieved October 2026
- Microsoft Learn, "Microsoft Entra Connect: Enabling device writeback" and "Group Writeback for Microsoft 365 Groups" (entra/identity/hybrid/connect/how-to-connect-device-writeback and how-to-connect-group-writeback-enable), retrieved October 2026
- Microsoft Learn, "Microsoft Entra Connect: Supported topologies" (entra/identity/hybrid/connect/plan-connect-topologies), retrieved October 2026
- Microsoft Learn, "Microsoft Entra Cloud Sync migration decision guide" (entra/identity/hybrid/cloud-sync/connect-to-cloud-sync-decision-guide), updated 6 October 2026, retrieved October 2026
- IT Partner Microsoft deadlines page: Windows Server 2016 end of extended support, Entra Connect Sync minimum version enforcement

## Key takeaways

- Build a second server in staging mode and swap; one active server per tenant, any number staged.
- Staging mode imports and synchronizes but exports nothing; the csexport comparison is the gate before the swap.
- Old server to staging first, new server active second; rollback is the reverse, so the old server stays staged for a week.
- Install 2.6.92.0 (released 23 September 2026, the current release on Microsoft's version history page): 2.5.79.0 retires on 23 October 2026; 2.6.84.0 with application-based authentication is required by 7 April 2027.
- Password writeback, device and group writeback, seamless single sign-on, Exchange hybrid and pass-through authentication each need a post-swap test.

---

**Is Entra Connect sitting on a domain controller you are about to demote?** Across several sites, [Multi-Site Domain Controller Migration to Windows Server 2025](/services/multi-site-domain-controller-migration-windows-server-2025) sequences the move inside the replacement plan. For one server, [Domain Services and Active Directory Roles Migration](/services/active-directory-domain-controller-migration) moves the sync server, DNS and DHCP off the retiring domain controller for $900 per project in three days, quoted in writing before work starts.