# Multi-Site Domain Controller Migration to Windows Server 2025 > Multi-Site Domain Controller Migration to Windows Server 2025 replaces the Windows Server 2016 or 2019 domain controllers of one forest and one domain — up to six Active Directory sites and fourteen domain controllers — with Windows Server 2025 domain controllers, in the order that keeps sign-in, Group Policy, DNS and the equipment that authenticates against Active Directory working at every site. IT Partner validates readiness first (AD health, replication, DNS, SYSVOL on DFS-R, FSMO roles, functional levels, schema version, time source, Group Policy count, and a verified backup with forest-recovery readiness as the precondition), raises the schema to the Windows Server 2025 level with adprep /forestprep and /domainprep as a gated change, moves Entra Connect off a retiring domain controller through a staging-mode swap with Password Hash Sync and password writeback verified afterwards, tests up to 25 named dependencies — LDAP and LDAPS applications, NAS, scan-to-folder printers, Linux hosts on SSSD or Winbind, production equipment — against the Windows Server 2025 defaults (SMB signing required, NTLMv1 removed, no RC4 ticket-granting tickets, strong certificate mapping enforced), then promotes, demotes and re-IPs site by site in overnight windows across your time zones so retired domain controller addresses keep answering, splits the FSMO roles across two new domain controllers and sets the time source, validates DNS and SYSVOL, rebuilds AD Sites and Services for the target topology, decommissions the old domain controllers with metadata cleanup, and hands over the migration runbook, per-step rollback, acceptance criteria per site and the closeout documentation. Remote delivery with named engineers per region for the overnight windows, over about eight weeks. From $12,500 for the standard scope, fixed in a written quote once the domain controller and dependency counts are agreed; a second domain, more sites or domain controllers, or more than 25 dependencies are quoted in writing. You provide the hardware or virtual machines, the base operating system, networking and firewall changes, licenses, and hands-on help at the regional sites. Not included: remediation of applications that fail on NTLMv1, SMB1 or RC4-only Kerberos (identified and reported; fixed by the application owner or by change order), PKI redesign, WAN and firewall work, hardware, and Windows Server licenses, CALs and Microsoft's Azure charges, which are always yours. One domain controller at one site is the $900 Domain Services and Active Directory Roles Migration, not this page. Windows Server 2016 leaves extended support on 12 January 2027 per Microsoft's product lifecycle. Canonical: https://o365hq.com/services/multi-site-domain-controller-migration-windows-server-2025 Provider: IT Partner LLC — US Microsoft partner since 2006. Book: https://o365hq.com/book **Price:** From $12,500 · **Duration:** 8 weeks · Fixed price, pay after approval. ## Overview Replacing one domain controller is a three-day job with a known shape. Replacing ten to fourteen of them across six sites on three continents is a different job, and the difference is not the number of servers — it is the order of operations and the things that break when the order is wrong. The forest schema has to be raised before the first Windows Server 2025 domain controller can be promoted, and that change cannot be undone except by a forest recovery. Entra Connect is often found running on one of the domain controllers being retired, so the identity bridge to Microsoft 365 has to move before that server is demoted. Retired domain controller addresses live on quietly in DHCP option 006, in the static DNS settings of printers and appliances, in the configuration of factory and lab equipment and in LDAP connection strings nobody has opened in years. And a Windows Server 2025 domain controller arrives with defaults — SMB signing required, NTLMv1 gone, no RC4 ticket-granting tickets, strong certificate mapping enforced — that older NAS units, scan-to-folder printers, Linux hosts on SSSD or Winbind and some production equipment were never tested against. This service exists to run that sequence as one plan, site by site, inside the standard scope printed above: one forest, one domain, up to six sites and fourteen domain controllers, with compatibility testing of up to 25 named dependencies. The engagement is built as six gated steps. Readiness first: the discovery questionnaire and a read-only validation of AD health, replication, DNS, SYSVOL on DFS-R, FSMO placement, functional levels, the schema version, the time source and the Group Policy estate, plus the gate that matters most — a verified, restorable backup and a documented forest-recovery path, because the schema change is one-way. Then the schema: Windows Server 2025 domain controllers need the forest schema at objectVersion 91 (a Windows Server 2016 forest sits at 87, a 2019 or 2022 forest at 88, per Microsoft's schema-version table at the time of writing), so adprep /forestprep and /domainprep run against the schema master in a dedicated window, from the Windows Server 2025 media, under an account in Schema Admins and Enterprise Admins, with replication of the change confirmed on every domain controller before anything else proceeds. Then Entra Connect: a new sync server on a member server (Microsoft requires a domain-joined Windows Server with the full desktop experience and recommends Windows Server 2025 or 2022) is built in staging mode with the exported configuration, its pending exports are compared with the production server, and the swap is made in one short window; Password Hash Sync and password writeback are inactive while a server is in staging mode, so both are verified on the new server after the swap, not before. Then the compatibility stage: each of the up to 25 named dependencies is tested against the first new domain controller in a pilot site, and anything that fails on NTLMv1, SMB1 or RC4-only Kerberos is written up with the failing default, the owner and the fix — remediation is the application owner's or a change order, not a surprise on cutover night. Then the per-site windows, typically three overnight windows across time zones: promote the new domain controller, confirm replication, move any roles it will hold, demote the old one, and move the retired address and DNS registration onto the replacement where the inventory shows it is still referenced, so whatever still points at the old address keeps working. Last, the forest-level finish: FSMO roles split across two new domain controllers with the PDC emulator as the authoritative time source, AD Sites and Services rebuilt for the target topology, DNS and SYSVOL validated, old domain controllers powered off for a soak and then cleaned out of the directory metadata. What the Windows Server 2025 defaults change, in plain terms. SMB signing is required by default for all outbound SMB connections, so a Windows Server 2025 host cannot reach a share on a device that cannot sign. NTLMv1 is removed, so a device or application that still authenticates with it fails. The Kerberos key distribution center no longer issues ticket-granting tickets with RC4, so an account or keytab restricted to RC4 — common on older Linux hosts and appliances — stops getting tickets. LDAP over TLS supports TLS 1.3 and new forests require LDAP signing by default; an existing forest keeps its LDAP signing policy, which we read and report rather than change. And strong certificate mapping for certificate-based sign-in has been fully enforced on every patched domain controller since Microsoft's February 2025 change (KB5014754), with the compatibility override retired in September 2025 — not a Windows Server 2025 difference, but the thing that bites when a smart-card or device certificate was issued without a strong mapping and nobody noticed because the old domain controllers were behind on updates. The compatibility report tells you which of your 25 dependencies each of these touches. Deeper hardening of the directory after the migration — tiering, legacy protocol removal, privileged access — is the [Active Directory Security Assessment and Hardening](/services/active-directory-security-assessment), not this page. Three things this page sends elsewhere so you see them coming. Licensing: twelve to fourteen new domain controllers mean twelve to fourteen Windows Server 2025 licenses at the 16-core minimum per server, and Windows Server CALs must be the same version as the server software or later, so 2016-era CALs without Software Assurance mean a CAL refresh for every user or device — a bill that can be larger than the services fee. We hand you the count; the [Windows Server and SQL Server Licensing and True-Up Advisory](/services/windows-server-sql-server-licensing-true-up-advisory) turns it into a defensible position, and the [Windows Server calculator](/tools/windows-server-calculator) and [CAL calculator](/tools/cal-calculator) price it at Microsoft's list price. Hotpatching: if security updates without a monthly reboot are the reason you chose Windows Server 2025, the new domain controllers need an Azure Arc connection, virtualization-based security enabled and the hotpatch enrollment, and Microsoft removed the hotpatch charge for Arc-connected Windows Server 2025 machines on 19 May 2026; that enrollment is cleanest at build time and is a priced option through [Azure Arc Hybrid Server Management](/services/azure-arc-hybrid-server-management), or, when a parent company or auditor needs the servers under central management as evidence, through the Azure Arc Onboarding with Azure Update Manager for an Audited Estate at /services/azure-arc-update-manager-onboarding-audited-estate. The date: if the Windows Server 2016 domain controllers cannot all be replaced before 12 January 2027, the plan becomes two phases — the 2016 domain controllers first, the new sites and the site-link redesign after — with Windows Server 2016 Extended Security Updates through Azure Arc as the paid safety valve for the months in between, priced from the [ESU calculator](/tools/esu-calculator) and enrolled through [Windows Server ESU Enrollment through Azure Arc](/services/windows-server-esu-enrollment-azure-arc). ESU is the safety valve, not the plan. ## Success criteria - Every in-scope Windows Server 2016 or 2019 domain controller is replaced by a Windows Server 2025 domain controller, and repadmin /replsummary and dcdiag run clean from every domain controller in every site. - The forest schema reads objectVersion 91 on every domain controller, the schema change was taken from a verified backup state, and the forest and domain functional levels are at the agreed level — Windows Server 2016 or later as the promotion requirement, raised to the Windows Server 2025 level only on your written decision. - Users sign in, Group Policy applies and DNS resolves at every site from clients on each site's subnets, confirmed by the per-site acceptance tests you signed before cutover. - Entra Connect runs on a server that is not being retired, on the current release with application-based authentication, and a password change on-premises reaches Microsoft Entra ID while a self-service reset in Entra ID reaches Active Directory. - Each of the up to 25 named dependencies either authenticates against a Windows Server 2025 domain controller or appears in the compatibility report with the failing default, the owner and the fix. - The FSMO roles are held by two new domain controllers as designed, no role remains on a retiring server, and the PDC emulator is the authoritative time source synchronized to an external source with hypervisor time synchronization disabled on virtual domain controllers. - Every retired domain controller address either answers from its replacement or was confirmed unreferenced in the inventory, and DNS carries no host, name-server or service record of a demoted domain controller. - AD Sites and Services reflects the target topology — every subnet mapped to a site, site links and replication schedules as designed — and the Netlogon log shows no unmapped-subnet events after cutover. - The old domain controllers are demoted, their metadata is removed from the directory and DNS, and they are powered off after the agreed soak period. - The migration runbook with per-step rollback, the per-site acceptance records, the compatibility report, the licensing count and the closeout documentation are delivered and accepted. ## Deliverables - Discovery questionnaire and readiness validation report: AD health, replication, DNS, SYSVOL on DFS-R, FSMO placement, functional levels, schema version, time source, Group Policy count, backup verification and forest-recovery readiness, with every blocker named before the schema step. - Migration design: site order, naming and IP plan per domain controller, FSMO split and time-source design, DNS and SYSVOL validation plan, target AD Sites and Services topology (subnets, site links, replication schedules), the Entra Connect move plan and the build standard for the new servers you provide. - Schema preparation change record: adprep /forestprep and /domainprep run as a gated change — objectVersion before and after, the verified backup it was taken from, the window, and replication of the change confirmed on every domain controller. - Entra Connect relocation: new sync server built on the current release in staging mode from the exported configuration, pending-export comparison, the swap, the switch to application-based authentication made as part of the move and confirmed (Get-ADSyncEntraConnectorCredential returns Application) ahead of Microsoft's 7 April 2027 bar, and the verification record for Password Hash Sync and password writeback on the new server — the switch itself is in [Entra Connect application-based authentication by 7 April 2027](/blog/entra-connect-application-based-authentication-by-7-april-2027-what-changes-and-how-to-switch). - Compatibility test plan and report for up to 25 named dependencies tested against the pilot domain controller in the test site, each category with its pass condition written before the test, and each dependency marked pass, pass with a change, or fail with the failing default, the owner and the fix. - Per-site cutover runbooks with acceptance criteria and per-step rollback: promote, verify replication, move roles, demote, re-IP, validate — one runbook per site, signed before its window. - Per-site promote, demote and re-IP executed in the agreed overnight windows by named engineers per region, with the retired address and DNS registration moved onto the replacement where the inventory shows it is still referenced. - FSMO split across two new domain controllers, the time-source configuration, DNS and SYSVOL validation reports, and AD Sites and Services rebuilt for the target topology. - Decommission records: each old domain controller demoted, metadata cleanup confirmed in the directory and DNS, soak period observed, power-off authorized by you. - Licensing count handed over: Windows Server 2025 licenses at the 16-core minimum per new domain controller and the CAL position (version and Software Assurance status), for you to price with us or with anyone else. - Closeout documentation: as-built topology, the acceptance record per site, the compatibility report, open items with owners, and a handover session for your administrators. ## Implementation plan 1. **1. Kickoff, questionnaire and readiness validation (week 1)** — Confirm the scope counts, the site list with time zones, the date that is driving you and the decision-makers. Take read-only access, run the validation, verify the backup and the forest-recovery path. The schema step does not start until this gate is passed in writing. 2. **2. Design and the dependency list (week 2)** — Agree the site order, the per-domain-controller naming and IP plan, the FSMO split, the target Sites and Services topology, the Entra Connect move and the build standard for your new servers. You name the up to 25 dependencies and their owners; we write the test for each. The licensing count goes to you now, so the CAL question is answered before the first server is built. 3. **3. Schema preparation (end of week 2 or week 3)** — adprep /forestprep and /domainprep against the schema master in a dedicated window, under an account in Schema Admins and Enterprise Admins, from a verified backup state, with replication confirmed on every domain controller. A one-way change, so it has its own window and its own sign-off. 4. **4. Pilot site, compatibility testing and the Entra Connect move (week 3)** — Promote the first Windows Server 2025 domain controller as the pilot — in the test site with the most old equipment, holding no operations master roles, with the site's existing domain controllers left running — point each named dependency at it, and test every category against a pass condition written before the test and a rollback that fits the step (revert the device; demote the pilot, clean while it holds no roles; point the test site back at its old domain controllers), then issue the compatibility report. The categories and their pass conditions are in [What breaks when domain controllers move to Windows Server 2025](/blog/what-breaks-when-domain-controllers-move-to-windows-server-2025-smb-signing-ntlm-kerberos-equipment). Build the new Entra Connect server in staging mode, compare exports, swap in a short window, and verify Password Hash Sync and writeback on the new server. 5. **5. Per-site overnight windows (weeks 4 to 6)** — Typically three overnight windows across time zones, each covering the sites in that region: promote, confirm replication, move roles, demote, re-IP and validate against the signed acceptance criteria. Each site is accepted before the next window opens, and the rollback step for every action is in the runbook. 6. **6. FSMO split, time source, DNS, SYSVOL and Sites and Services (weeks 6 to 7)** — Place the roles on the two designated new domain controllers, set the PDC emulator as the authoritative time source, validate DNS and SYSVOL across the forest, and rebuild subnets, site links and replication schedules for the target topology. 7. **7. Decommission, closeout and handover (weeks 7 to 8)** — Power off the old domain controllers for the agreed soak, clean up metadata in the directory and DNS, deliver the closeout documentation and the licensing count, and hold the handover session. Hotpatch and Azure Arc enrollment of the new domain controllers, if you took the option, is scheduled here. ## Prerequisites - One forest and one domain, with the forest and domain functional levels at Windows Server 2016 or later — Microsoft's requirement for promoting a Windows Server 2025 domain controller — and SYSVOL replicated by DFS-R. A forest still on FRS or at a lower functional level is corrected first, quoted as a small change order. - A verified, restorable backup of at least two domain controllers including system state, and a documented forest-recovery path. The schema change is one-way, so this is the gate for everything after it — we verify it in week 1 and do not proceed on an assumption. - The new servers, built by you to the build standard we provide: Windows Server 2025 Standard or Datacenter with the current cumulative update, generation 2 virtual machines or UEFI hosts with Secure Boot, virtualization-based security enabled where hotpatching is intended, static addresses from the agreed plan, and at least one domain controller per site on a host or cluster that does not need Active Directory to boot. - Windows Server 2025 licenses for the new domain controllers (per core, 16-core minimum per server) and Windows Server CALs of the same version or later, or Software Assurance that carries them. We hand you the count in week 2; you may buy from us or from anyone. - Documented site subnets and the firewall rules between sites for Active Directory replication and authentication, with your network team reachable during each overnight window. We design the topology; you apply network and firewall changes. - Named, time-bound administrative accounts for our engineers — Schema Admins and Enterprise Admins for the schema window only, Domain Admins for the migration — plus a remote access path (VPN, jump host or Bastion) with multifactor authentication, all disabled at closeout. - The dependency list: up to 25 named systems that authenticate against Active Directory from outside Windows or through LDAP, each with an owner, a test account and a way to test, and the owners reachable during the pilot week. - For the Entra Connect move: the current sync server's configuration exportable, a member server on Windows Server 2025 or 2022 with the full desktop experience for the new installation, and a Hybrid Identity Administrator account for the swap. - Hands-on help at each regional site during its window — someone who can reach the console, power a server on or off and use out-of-band management — and a change freeze on other Active Directory changes during the cutover weeks. - Three overnight windows approved through your change process, with the acceptance criteria for each site signed before its window. ## Responsibilities **IT Partner:** - Run the readiness validation, verify the backup gate and write the migration design, the compatibility test plan and the per-site runbooks with rollback. - Execute the schema preparation, the Entra Connect staging build and swap, the compatibility testing, and the per-site promote, demote and re-IP in the agreed windows with named engineers per region. - Place the FSMO roles and the time source, validate DNS and SYSVOL, rebuild AD Sites and Services for the target topology, and decommission the old domain controllers with metadata cleanup. - Report every dependency that fails on a Windows Server 2025 default with the failing default, the owner and the fix, and every site's acceptance result, in writing. - Hand over the licensing count, the closeout documentation and a handover session, and name anything left open with an owner. **Client:** - Provide the hardware or virtual machines, install the base operating system to the build standard, and apply the network and firewall changes the design calls for. - Buy the Windows Server 2025 licenses and the CALs the count requires, from us or from anyone, before the servers go into production. - Name the dependencies and their owners, provide test accounts, and have the owners available during the pilot week; own the remediation of anything that fails. - Provide the administrative accounts and remote access, the hands-on contact at each site, the change approvals and the overnight windows, and sign the per-site acceptance criteria before each window. - Own Microsoft's charges — Azure Arc add-ons, Azure Update Manager where Microsoft charges for it, Extended Security Updates — and all licensing decisions the engagement surfaces. - Operate the directory after handover, or engage ongoing support separately. ## Not included - One domain controller at one site, with its DNS and DHCP — that is the [Domain Services and Active Directory Roles Migration](/services/active-directory-domain-controller-migration) at $900, and you should book that instead. - Remediation of applications and devices that fail on NTLMv1, SMB1 or RC4-only Kerberos. The compatibility report identifies each one with the failing default, the owner and the fix; the fix is made by the application owner or quoted as a change order. - DHCP scope moves off retiring domain controllers, and DNS or NPS role moves beyond the domain controller's own DNS — a priced option through [DHCP, DNS and NPS Role Migration to Windows Server 2025](/services/dhcp-dns-nps-migration-windows-server-2025). - On-site presence for the core cutover — a priced option, quoted per site with travel at cost. The standard scope is remote delivery with named engineers per region. - Azure Arc onboarding and hotpatch enrollment of the new domain controllers — a priced option through [Azure Arc Hybrid Server Management](/services/azure-arc-hybrid-server-management), or through the Azure Arc Onboarding with Azure Update Manager for an Audited Estate at /services/azure-arc-update-manager-onboarding-audited-estate when a parent company or auditor needs the evidence. - Active Directory Certificate Services migration and any PKI redesign — [Active Directory Certificate Services (AD CS) Migration](/services/active-directory-certificate-services-migration) is its own engagement; certificate-mapping failures the compatibility report finds are routed there. - A CAL and Windows Server licensing quote. We hand you the count; the [Windows Server and SQL Server Licensing and True-Up Advisory](/services/windows-server-sql-server-licensing-true-up-advisory) turns it into a position you can defend, and the licenses themselves are bought by you from us or from anyone. - WAN, firewall, VLAN and routing work, hardware, hypervisor changes and base operating system installation — yours, or quoted separately where you ask us to. - A second domain, a second forest, trusts, domain rename, or more than six sites, fourteen domain controllers or 25 dependencies — quoted in writing per estate. - Raising the forest and domain functional levels to Windows Server 2025 and moving the database to the 32k page format — forest-wide, irreversible changes made only on your written decision after every domain controller runs Windows Server 2025, as a separate short engagement. - Retiring Active Directory in favor of Microsoft Entra ID — the [On-premises Active Directory to Microsoft Entra ID Transition](/services/on-prem-active-directory-to-microsoft-entra-id-transition) is that project; this page keeps the directory and modernizes it. - Extended Security Updates enrollment for the Windows Server 2016 domain controllers you cannot replace in time — [Windows Server ESU Enrollment through Azure Arc](/services/windows-server-esu-enrollment-azure-arc). - Windows Server licenses, CALs and Microsoft's Azure charges — Azure Arc add-ons, Azure Update Manager where Microsoft charges for it, Extended Security Updates — are billed to you by Microsoft or by your reseller and are not part of this fee. - Ongoing Active Directory operations and security hardening after handover — [Active Directory Security Assessment and Hardening](/services/active-directory-security-assessment) for the hardening, and a support agreement for the operations. ## Limitations & technical notes - From $12,500 is the base for the standard scope: one forest, one domain, up to six Active Directory sites and fourteen domain controllers, compatibility testing of up to 25 named dependencies, remote delivery. The written quote adds a per-domain-controller fee for the count in your inventory and is fixed before the schema step; a second domain, more sites or domain controllers, more dependencies, on-site presence and the priced options are quoted in writing on top. - Eight weeks is the shape for that scope when the servers are built on time, the dependency owners are reachable in the pilot week and the three overnight windows are approved. Client-side delays — servers not built, licenses not bought, windows not approved, owners unavailable — move the completion date, not the scope. The 12 January 2027 date is Microsoft's, and we say in week 1 whether it is reachable with the scope as written. - The schema change is one-way. There is no adprep rollback; the recovery from a failed schema update is a forest recovery from backup, which is why a verified backup and a documented recovery path are the gate for the step and why it has its own window. Windows Server 2025 domain controllers require the forest schema at objectVersion 91 per Microsoft's schema-version table at the time of writing; adprep is run from the Windows Server 2025 media against the schema master by an account in Schema Admins and Enterprise Admins. - Promotion needs the domain and forest at the Windows Server 2016 functional level or later. The Windows Server 2025 functional level and the 32k database page format are not part of the standard scope: both are forest-wide, both require every domain controller to run Windows Server 2025 first, and neither can be reversed. - Compatibility testing finds; it does not fix. The Windows Server 2025 defaults we test against, per Microsoft's documentation at the time of writing: SMB signing required for all outbound SMB connections, an SMB authentication rate limiter on by default, NTLMv1 removed and NTLMv2 deprecated, the Kerberos key distribution center no longer issuing ticket-granting tickets with RC4, LDAP signing required by default in new forests and TLS 1.3 for LDAP over TLS, a 2,048-bit minimum RSA key for TLS server authentication, and strong certificate mapping fully enforced for certificate-based sign-in on every patched domain controller since February 2025 (KB5014754), with the compatibility override retired in September 2025. SMB1 is not installed on Windows Server 2025 by default and we do not add it; a device that only speaks SMB1 or NTLMv1 is reported, not accommodated. - Entra Connect behaves differently in staging mode: the staging server imports and synchronizes but does not export, and Password Hash Sync and password writeback are inactive until staging mode is disabled, so both are verified after the swap, not before. The new server is installed on the current release — Microsoft's mandatory-upgrade notice requires version 2.6.84.0 or later with application-based authentication by 7 April 2027 at the time of writing — on a domain-joined Windows Server with the full desktop experience, never Server Core, and patched past Microsoft's October 2025 fix for a synchronization issue on Windows Server 2025 before it goes active. - Re-IP is done once, after demotion and a DNS check, and only where the inventory shows the retired address is still referenced; we do not build multi-homed domain controllers or leave a retired address answering from a server that was never meant to hold it. Finding every reference — DHCP option 006, static DNS on appliances, printers, equipment and application configurations — is read-only inventory work inside this scope; moving DHCP scopes is the priced option named above. - Virtual domain controllers are fine; a site whose only domain controller sits on a cluster that needs Active Directory to boot is not. The design keeps at least one domain controller per site off that dependency, disables hypervisor time synchronization on every virtual domain controller, and names the placement decision as yours. - Hotpatching is an option, not standard scope, and it has Microsoft's prerequisites: Windows Server 2025 Standard or Datacenter at the current cumulative update from a baseline month (January, April, July or October), an Azure Arc connection, and virtualization-based security enabled, which needs UEFI with Secure Boot or a generation 2 virtual machine. Microsoft removed the hotpatch charge for Arc-connected Windows Server 2025 machines on 19 May 2026; Microsoft's hotpatch documentation does not state a domain-controller exclusion at the time of writing, and we enroll one domain controller and watch a full patch cycle before enrolling the rest. - Licensing is counted here and bought elsewhere. Windows Server 2025 is licensed per core with a 16-core minimum per server; Windows Server CALs must be the same version as the server software or later, so 2016-era CALs without Software Assurance mean a CAL refresh for every user or device when the first Windows Server 2025 domain controller goes into production. The count we hand you is a count, not a quote. - Extended Security Updates are the safety valve, not the plan. Windows Server 2016 leaves extended support on 12 January 2027; where the 2016 domain controllers cannot all be replaced before then, the plan becomes two phases and ESU through Azure Arc covers the gap, with Microsoft billing from 13 January 2027 for the servers you enroll. The cost is Microsoft's and is estimated from the ESU calculator before you decide. - After 12 January 2027 the Windows Server 2016 framing on this page becomes a past date; Windows Server 2019 domain controllers remain in extended support until 9 January 2029 per Microsoft's lifecycle, and the same engagement applies to them without the deadline. ## FAQ ### Windows Server 2016 support ends in January 2027 and we have about ten domain controllers across six sites. Where do we start, and what order do we do this in? Start with the two things that gate everything else: a verified backup with a forest-recovery path, and a read-only readiness check of replication, DNS, SYSVOL replication mode, FSMO placement, functional levels and the schema version. Then the order is fixed by dependencies, not preference: raise the schema to the Windows Server 2025 level (one-way, its own window), move Entra Connect off any domain controller you are retiring, test the systems that authenticate against Active Directory from outside Windows against the first new domain controller in a pilot site, and only then run the per-site windows — promote the new domain controller, confirm replication, move roles, demote the old one, move its address across where something still points at it. The forest-level finish (FSMO split, time source, Sites and Services, decommission) comes last. Everything on this page runs in that order for up to six sites and fourteen domain controllers, in about eight weeks; a single domain controller uses the $900 Domain Services and Active Directory Roles Migration instead. ### Is adprep safe to run on a production forest, and can it be rolled back? It is safe when it is treated as what it is — an irreversible, forest-wide schema change. There is no adprep undo; the only rollback is a forest recovery from backup. So we run it as a gated change: a verified, restorable backup and a documented recovery path first, a dedicated window, an account in Schema Admins and Enterprise Admins, adprep /forestprep from the Windows Server 2025 media against the schema master, then /domainprep, and replication of the change confirmed on every domain controller before anything else proceeds. Windows Server 2025 needs the schema at objectVersion 91; a Windows Server 2016 forest sits at 87 and a 2019 or 2022 forest at 88, per Microsoft's table at the time of writing. The schema step does not raise your functional level — that is a separate, also irreversible decision, and it is not in this scope. ### Entra Connect is installed on a domain controller we are retiring. How do we move it without breaking sign-in? By never having two active sync servers and never having none. We build a new Entra Connect server on a member server — Microsoft requires a domain-joined Windows Server with the full desktop experience and recommends Windows Server 2025 or 2022 — import the exported configuration, and leave it in staging mode, where it imports and synchronizes but exports nothing. We compare its pending exports with the production server, fix any difference, then swap in one short window: the old server goes into staging mode, the new one comes out of it. Password Hash Sync and password writeback are inactive on a staging server, so we verify both on the new server right after the swap with a password change in each direction. The retiring domain controller is demoted only after that. The new server runs the current release with application-based authentication — confirmed with Get-ADSyncEntraConnectorCredential returning Application — which Microsoft requires by 7 April 2027 at the time of writing, so you are not back here for that; what changes on that date and how a server that is not moving is switched in place is in [Entra Connect application-based authentication by 7 April 2027](/blog/entra-connect-application-based-authentication-by-7-april-2027-what-changes-and-how-to-switch). ### How do we find everything that still points at an old domain controller's IP address before we demote it? You look where the references actually live, and you plan for the ones you miss. The readiness stage inventories DHCP option 006 on every scope, the static DNS settings of printers, NAS units, appliances and production equipment, LDAP connection strings in application configurations, and the DNS client settings of servers with static addresses. The safety net for the ones no inventory catches is the re-IP step: after the old domain controller is demoted, its address and DNS registration move to the replacement where the inventory shows the address is still referenced, so a device that was never found keeps working while it is fixed properly. Moving the DHCP scopes themselves off the old domain controllers is the priced DHCP, DNS and NPS Role Migration option. ### After moving domain controllers to Windows Server 2025, what stops working — our NAS, scan-to-folder printers, Linux servers, lab equipment? The things that still depend on a default Windows Server 2025 turns off. SMB signing is required for every outbound SMB connection, so a Windows Server 2025 host cannot write to a NAS or a scan-to-folder destination that cannot sign. NTLMv1 is removed, so a device or application authenticating with it fails. The key distribution center no longer issues RC4 ticket-granting tickets, so a Linux host on SSSD or Winbind, or an appliance, with an account or keytab limited to RC4 stops getting Kerberos tickets. Strong certificate mapping is fully enforced for certificate-based sign-in. That is why the scope includes a compatibility stage: up to 25 named dependencies tested against the first new domain controller in a pilot site, each written up as pass, pass with a change, or fail with the failing default, the owner and the fix — before any production site is cut over. The fix itself — firmware, a configuration change, a keytab reissued with AES — is the owner's or a change order. ### How do you cut over domain controllers in several countries without taking production down? One site at a time, inside that site's own night, with a domain controller that already works before the old one is touched. Each region gets an overnight window — typically three windows across time zones for six sites — run by named engineers in that region. In the window: promote the new domain controller, confirm replication from every site, move any role it will hold, demote the old one, move the retired address where it is still referenced, and run the acceptance tests you signed beforehand. Users in that site authenticate against the new domain controller before the old one is demoted, and the other sites keep authenticating against their own domain controllers throughout. Every step has a rollback in the runbook, and a site is accepted before the next window opens. ### We are replacing twelve domain controllers with Windows Server 2025. What licenses and CALs do we need, and does the CAL version matter? Twelve Windows Server 2025 Standard licenses at the 16-core minimum per server, or Datacenter where a host licenses more virtual machines than Standard allows, and Windows Server CALs of the same version as the server software or later for every user or device that authenticates. The CAL version matters more than people expect: a 2016 CAL does not cover a 2025 server, so 2016-era CALs without Software Assurance mean a CAL refresh across the organization on the day the first Windows Server 2025 domain controller goes into production, and that bill can exceed the services fee. We hand you the count in week 2; the Windows Server calculator and the CAL calculator price it at Microsoft's list price, and the Windows Server and SQL Server Licensing and True-Up Advisory turns it into a defensible position. You buy the licenses from us or from anyone. ### How do we enable hotpatching on Windows Server 2025 domain controllers, and what does Azure Arc cost for it? Hotpatching needs three things on each domain controller: Windows Server 2025 Standard or Datacenter at the current cumulative update from a baseline month, an Azure Arc connection through the Connected Machine agent, and virtualization-based security enabled, which needs UEFI with Secure Boot or a generation 2 virtual machine — so it is easiest to get right when the server is built, which is why the build standard asks for it. Azure Arc's control plane carries no charge, and Microsoft removed the hotpatch charge for Arc-connected Windows Server 2025 machines on 19 May 2026; the charges that do exist are for services you attach, such as Azure Update Manager where Microsoft charges for it. Microsoft's hotpatch documentation does not state a domain-controller exclusion at the time of writing, so we enroll one domain controller first and watch a full cycle. The enrollment itself is a priced option through the Azure Arc Hybrid Server Management page, and Microsoft's charges are always yours. ### What if we cannot finish before 12 January 2027? Then the plan becomes two phases and the calendar stops being the risk. Phase one replaces the Windows Server 2016 domain controllers — the ones that lose updates on 12 January 2027 — and phase two adds the new sites and the site-link redesign afterwards. For the months in between, Windows Server 2016 Extended Security Updates through Azure Arc keep the remaining 2016 domain controllers patched; Microsoft bills ESU from 13 January 2027 for the servers you enroll, the ESU calculator estimates the cost before you decide, and enrollment is the Windows Server ESU Enrollment through Azure Arc service. We say in week 1 whether the date is reachable with the scope as written, and ESU is the safety valve, not the plan. ### What exactly do I get for From $12,500, and what turns it into a fixed quote? The base covers the standard scope as printed: readiness validation, the schema preparation, the Entra Connect move, compatibility testing of up to 25 named dependencies, per-site promote, demote and re-IP across up to six sites, the FSMO split and time source, DNS and SYSVOL validation, Sites and Services for the target topology, decommission with metadata cleanup, and the runbook, rollback, acceptance and closeout documentation — for one forest and one domain with up to fourteen domain controllers, delivered remotely. The written quote adds a per-domain-controller fee for the count in your inventory and is fixed before the schema step; you pay after you approve delivery. On-site presence, DHCP scope moves, Arc and hotpatch enrollment, AD CS migration and a licensing quote are priced options, and anything beyond the caps is quoted in writing. ### Should we raise the forest functional level to Windows Server 2025 while we are at it? Not during the migration. Promoting a Windows Server 2025 domain controller only needs the domain and forest at the Windows Server 2016 level, and the schema update does not change the functional level. The Windows Server 2025 level — and the optional 32k database page format that comes with it — is forest-wide, requires every domain controller in the forest to run Windows Server 2025 first, and cannot be reversed without a forest recovery. It is a separate decision after the last old domain controller is gone, made in writing, with a fresh backup, as its own short engagement. ### Our domain controllers are virtual machines on a Hyper-V cluster. Does that change the plan? It changes where they go. A cluster or storage that needs Active Directory to boot cannot be the only home of the domain controllers it authenticates against, so the design keeps at least one domain controller per site on a host that does not depend on the cluster — a standalone host or a physical server — and disables hypervisor time synchronization on every virtual domain controller so the PDC emulator stays the time source. If the cluster itself is on Windows Server 2016, its upgrade is the separate Hyper-V Failover Cluster Upgrade to Windows Server 2025, sequenced after the domain controllers it depends on. ### Do you need to be on site? No. The standard scope is remote delivery with named engineers per region for the overnight windows, and hands-on help at each site from your side for console access and power. On-site presence for the core cutover is a priced option, quoted per site with travel at cost, for customers whose change process or whose site requires it. ### We have one domain controller, or one site. Is this the right page? No — and the other page is cheaper. One domain controller at one site, with its DNS and DHCP, is the Domain Services and Active Directory Roles Migration at $900 over three days. This page starts paying for itself when there are several sites, a schema change nobody wants to be first to run, Entra Connect on a domain controller, equipment that authenticates against Active Directory, and cutover windows that have to happen in different nights. If you are between the two, the Windows Server 2016 End of Support Assessment and Roadmap puts every host on one plan and tells you which page you need. --- Fixed-price engagement by IT Partner LLC. To scope it for your tenant, book a call with Mike (https://o365hq.com/book) or request a quote via the site's /api (see https://o365hq.com/openapi.json).