# Domain Services and Active Directory Roles Migration > Domain Services and Active Directory Roles Migration transfers the typical functions of a domain controller, including DNS and DHCP, to a new server. This service may be necessary when migrating from an SBS server to a new server, or from an On-Premises solution to Microsoft 365 when you want to keep the Domain Controller in your network but need a new operating system or hardware. This is the single-server page: one domain controller replaced by one new server at a fixed $900. An estate with several sites and many domain controllers — a forest-wide schema update, an Entra Connect move off a retiring domain controller, per-site cutover windows — is the Multi-Site Domain Controller Migration to Windows Server 2025, from $12,500. Canonical: https://o365hq.com/services/active-directory-domain-controller-migration Provider: IT Partner LLC — US Microsoft partner since 2006. Book: https://o365hq.com/book **Price:** $900 per project · **Duration:** 3 days · Fixed price, pay after approval. ## Overview This service helps transfer typical Domain Controller functions, including DNS and DHCP, to a new server. IT Partner responsibilities include Domain Controller preparation and promotion, transfer of Domain Controller roles, transfer of group policy, groups, and users, DNS server transfer, and DHCP server transfer. The plan may include verification of work and demotion of the old DC. ## Success criteria - The new Domain Controller is available to users and can perform all necessary functions - Users can log in to their PCs - All GPO settings are saved - The DHCP server is working and all its settings are saved - The old DC is demoted and can be turned off ## Deliverables - Domain Controller preparation and promotion - Transfer of Domain Controller roles - Transfer of group policy, groups, and users - DNS server transfer - DHCP server transfer - Entra Connect staging-mode relocation when the sync server sits on the retiring domain controller: the current release installed in staging mode on a member server from the exported settings, the pending export compared with the production server, the swap, and Password Hash Sync and password writeback verified on the new server afterwards — the procedure in [Moving Entra Connect off a domain controller you are retiring](/blog/moving-entra-connect-off-a-domain-controller-you-are-retiring). - Switch to application-based authentication for Entra Connect Sync, verified (Get-ADSyncEntraConnectorCredential returns Application) ahead of Microsoft's 7 April 2027 bar, after which a server below version 2.6.84.0 or still on the legacy service account stops synchronizing — what changes and how the switch is made is in [Entra Connect application-based authentication by 7 April 2027](/blog/entra-connect-application-based-authentication-by-7-april-2027-what-changes-and-how-to-switch). - Host-name and IP carry-over variant, where the replacement takes the retired domain controller's name: metadata cleanup, a stale SPN check, DNS and SRV re-registration and certificate re-enrollment in the order set out in [Reusing an old domain controller's host name on its replacement](/blog/reusing-an-old-domain-controllers-host-name-on-its-replacement-metadata-cleanup-spns-and-certificates); name reuse adds a replication wait and a certificate step inside the same fixed fee. ## Implementation plan 1. **Kickoff meeting** — Confirm the environment details, roles to transfer, schedule, access, and points of contact. 2. **The new server preparation** — Prepare the new server and promote it to a Domain Controller in the existing domain. 3. **Staged transfer of roles and data** — Transfer Domain Controller roles, group policy, groups and users, DNS, and DHCP to the new server in stages. 4. **Verification of work** — Verify that the new Domain Controller performs all required functions, including authentication, GPO application, DNS, and DHCP. 5. **Demotion of the old DC** — Demote the old Domain Controller once the new server is verified, so it can be safely turned off. 6. **Verification and fixing issues, if any** — Perform final verification across users and services and fix issues found within scope. ## Prerequisites - The operating system for the new DC is installed - All devices are configured to use a DHCP server - A verified, restorable backup of an existing domain controller taken before the forest schema is raised to the Windows Server 2025 level. Microsoft's schema table puts Windows Server 2025 at objectVersion 91 at the time of writing (Windows Server 2019 and 2022 forests sit at 88, 2016 at 87), and the forest must be there — with the forest and domain functional level at Windows Server 2016 or higher — before the first Windows Server 2025 domain controller is promoted. Promoting the new server through Server Manager or PowerShell runs adprep /forestprep and /domainprep for you; the schema extension is one-way and forest-wide, so it is treated as a gated production change — verified backup, dedicated window, replication confirmed to every domain controller — rather than a side effect of clicking Next. The order of operations is in [Replacing Windows Server 2016 domain controllers with Windows Server 2025](/blog/replacing-windows-server-2016-domain-controllers-with-windows-server-2025-order-of-operations). ## Responsibilities **IT Partner:** - Domain Controller preparation and promotion - Transfer of Domain Controller roles - Transfer of group policy, groups, and users - DNS server transfer - DHCP server transfer - Entra Connect relocation with the application-based authentication switch, and the host-name carry-over variant, where the kickoff plan calls for them **Client:** - Coordinate Client resources and staff schedules - Provide a dedicated point of contact responsible for working with IT Partner - Coordinate any outside vendor resources and schedules - Provide administrative access to the Active Directory domain and servers - Configure all network equipment, such as load balancers, routers, firewalls, and switches - Review and approve engagement deliverables in a timely manner ## Not included - Migration to Entra ID - Email and/or documents transfer to Microsoft 365 - Support of the devices with static network settings - Remote installation of the Microsoft Windows OS on the server, if necessary, for example, when using a virtual machine or remote server management technologies -- iLO and others ## Limitations & technical notes - The plan may vary depending on your needs. - Scope note: this page covers one domain controller replaced by one new server. An estate with several sites and many domain controllers — a forest-wide schema update, an Entra Connect move off a retiring domain controller, FSMO roles split across new servers and per-site overnight cutover windows — is the [Multi-Site Domain Controller Migration to Windows Server 2025](/services/multi-site-domain-controller-migration-windows-server-2025), from $12,500, with the domain controller count turning the estimate into a fixed quote. - Windows Server 2025 requires SMB signing by default and has removed NTLMv1, and a domain controller is where both bite: a NAS, a scan-to-folder printer, a Linux host on SSSD or Winbind, lab or factory equipment, or an application that still authenticates with NTLMv1 or cannot sign SMB stops working against the new domain controller. Dependencies that rely on either are identified in the readiness check at kickoff and remediated by the application or device owner, not under this fee. What breaks and how to test for it before the cutover is in [What breaks when domain controllers move to Windows Server 2025](/blog/what-breaks-when-domain-controllers-move-to-windows-server-2025-smb-signing-ntlm-kerberos-equipment). ## FAQ ### What is included in the Domain Services and Active Directory Roles Migration service? The Domain Services and Active Directory Roles Migration service includes preparing and promoting a new Domain Controller, transferring Domain Controller roles, transferring group policy, groups, and users, and transferring DNS and DHCP services. The engagement is designed to move the typical functions of an existing domain controller to a new server while preserving the required Active Directory, DNS, DHCP, and GPO functionality. ### When would a business need this Active Directory domain controller migration service? This service is typically needed when replacing an older domain controller, moving away from an SBS server, or keeping an on-premises Domain Controller while moving other services to Microsoft 365. It is also appropriate when the organization needs new server hardware or a newer operating system for its Domain Controller. ### How long does the Domain Services and Active Directory Roles Migration take? The listed service duration is 3 days. Actual timing depends on your environment and is confirmed with IT Partner during the kickoff meeting. ### How is the service priced? The service is priced at a fixed $900 per project, quoted in writing before work begins — you pay after you approve delivery. Work outside the stated scope — such as operating system installation on the new server or migration to Entra ID — is quoted separately. ### What are the prerequisites before the migration can start? Before the engagement starts, the operating system for the new Domain Controller must already be installed, and all devices should be configured to use a DHCP server. These prerequisites matter because the service scope does not include remote Windows OS installation on the server or support for devices with static network settings. ### Does this service include installing Windows Server on the new domain controller? No, remote installation of the Microsoft Windows operating system on the server is not included in this service. This exclusion applies, for example, when using a virtual machine or remote server management technologies such as iLO, so the new server OS should be installed before the migration begins. ### Does this service include migration to Microsoft Entra ID? No, migration to Microsoft Entra ID is not included in the Domain Services and Active Directory Roles Migration service. The service is focused on transferring on-premises Domain Controller functions, including DNS and DHCP, to a new server. ### What happens during the Active Directory migration engagement? The engagement typically starts with a kickoff meeting, followed by preparation of the new server, staged transfer of roles and data, verification of work, demotion of the old Domain Controller, and final verification with issue fixing if needed. This staged approach helps confirm that the new Domain Controller can perform the required functions before the old one is turned off. ### Will Group Policy settings be preserved during the migration? Yes, preserving Group Policy settings is part of the stated success criteria for this service. IT Partner’s responsibilities include transferring group policy, groups, and users, so GPO settings are included in the migration scope. ### What happens to the old Domain Controller after the migration? The implementation plan may include demotion of the old Domain Controller after the new Domain Controller is verified. A stated success criterion is that the old Domain Controller is demoted and can be turned off. ### Are devices with static IP or static network settings supported by this service? No, support of devices with static network settings is not included in this service. The prerequisites state that all devices should be configured to use a DHCP server, so any static-device remediation should be handled separately or discussed with IT Partner before the engagement. ### How is completion of the migration verified? Completion is verified against criteria such as the new Domain Controller being available to users, users being able to log in, GPO settings being saved, DHCP working with settings preserved, and the old Domain Controller being demoted and ready to turn off. The implementation plan also includes verification of work and fixing issues if any are found within the engagement scope. ### Is adprep safe to run on a production forest, and can it be rolled back? Safe when it is gated, and no, it is not rolled back. adprep /forestprep extends the schema of the whole forest to the Windows Server 2025 level — objectVersion 91 per Microsoft's schema table at the time of writing, where Windows Server 2019 and 2022 forests sit at 88 — and /domainprep updates each domain; promoting a Windows Server 2025 domain controller through Server Manager or PowerShell runs both automatically, so the question is when, not whether. A schema extension adds classes and attributes and cannot be undone by Microsoft's tooling; the only way back is a forest recovery from a backup taken before the change. That is why we treat it as a gated production change: a verified, restorable backup of a domain controller, a dedicated window, the schema master healthy, and replication confirmed to every domain controller before the first promotion. The step-by-step order is in [Replacing Windows Server 2016 domain controllers with Windows Server 2025: the order of operations](/blog/replacing-windows-server-2016-domain-controllers-with-windows-server-2025-order-of-operations), and the case where Entra Connect runs on the domain controller you are retiring is in [Moving Entra Connect off a domain controller you are retiring](/blog/moving-entra-connect-off-a-domain-controller-you-are-retiring). ### What still points at the old domain controller after it is demoted? More than the directory. DHCP option 006 handing out the old server's address as a DNS server, static DNS server settings on servers, printers, NAS devices and appliances, the LDAP or RADIUS server fields on firewalls and VPN gateways, application configuration files and connection strings that name the server, service principal names and certificates issued to its name, and scripts and scheduled tasks that map a share on it. Demotion cleans up the directory's own records and does nothing for any of those. This engagement transfers DNS and DHCP with the domain controller, and where the plan calls for it the new server can take over the retired server's IP address after demotion so anything still pointing at the old address keeps working — the choice is made at the kickoff meeting. The read-only commands and an inventory template are in [Finding everything that still points at an old domain controller](/blog/finding-everything-that-still-points-at-an-old-domain-controller-before-you-demote). Support of devices with static network settings stays outside this fee, as the scope says. ### Entra Connect runs on the domain controller we are replacing. Does the move also take care of Microsoft's 7 April 2027 requirement? Yes. On 7 April 2027 Microsoft retires the legacy service-account sign-in that Entra Connect Sync uses to reach the tenant; from that day a server below version 2.6.84.0, or still authenticating with the Directory Synchronization Accounts user, stops synchronizing — users keep signing in through Password Hash Sync, but new accounts, attribute changes and password changes stop reaching Microsoft Entra ID. When the sync server sits on the domain controller being retired, the relocation builds the replacement on the current release in staging mode, so application-based authentication is registered during setup rather than switched afterwards, and we confirm it with Get-ADSyncEntraConnectorCredential, which must return Application — the build alone is not enough, since a current build still on ServiceAccount stops like any other. Auto-upgrade does not do this for you: since version 2.6.84.0 the product never switches an existing server's identity in the background. The version ladder and the in-place switch for a server that is not moving are in [Entra Connect application-based authentication by 7 April 2027](/blog/entra-connect-application-based-authentication-by-7-april-2027-what-changes-and-how-to-switch). --- Fixed-price engagement by IT Partner LLC. To scope it for your tenant, book a call with Mike (https://o365hq.com/book) or request a quote via the site's /api (see https://o365hq.com/openapi.json).