Domain Services and Active Directory Roles Migration transfers the typical functions of a domain controller, including DNS and DHCP, to a new server. This service may be necessary when migrating from an SBS server to a new server, or from an On-Premises solution to Microsoft 365 when you want to keep the Domain Controller in your network but need a new operating system or hardware. This is the single-server page: one domain controller replaced by one new server at a fixed $900. An estate with several sites and many domain controllers — a forest-wide schema update, an Entra Connect move off a retiring domain controller, per-site cutover windows — is the Multi-Site Domain Controller Migration to Windows Server 2025, from $12,500.
This service helps transfer typical Domain Controller functions, including DNS and DHCP, to a new server. IT Partner responsibilities include Domain Controller preparation and promotion, transfer of Domain Controller roles, transfer of group policy, groups, and users, DNS server transfer, and DHCP server transfer. The plan may include verification of work and demotion of the old DC.
Confirm the environment details, roles to transfer, schedule, access, and points of contact.
Prepare the new server and promote it to a Domain Controller in the existing domain.
Transfer Domain Controller roles, group policy, groups and users, DNS, and DHCP to the new server in stages.
Verify that the new Domain Controller performs all required functions, including authentication, GPO application, DNS, and DHCP.
Demote the old Domain Controller once the new server is verified, so it can be safely turned off.
Perform final verification across users and services and fix issues found within scope.
The Domain Services and Active Directory Roles Migration service includes preparing and promoting a new Domain Controller, transferring Domain Controller roles, transferring group policy, groups, and users, and transferring DNS and DHCP services. The engagement is designed to move the typical functions of an existing domain controller to a new server while preserving the required Active Directory, DNS, DHCP, and GPO functionality.
This service is typically needed when replacing an older domain controller, moving away from an SBS server, or keeping an on-premises Domain Controller while moving other services to Microsoft 365. It is also appropriate when the organization needs new server hardware or a newer operating system for its Domain Controller.
The listed service duration is 3 days. Actual timing depends on your environment and is confirmed with IT Partner during the kickoff meeting.
The service is priced at a fixed $900 per project, quoted in writing before work begins — you pay after you approve delivery. Work outside the stated scope — such as operating system installation on the new server or migration to Entra ID — is quoted separately.
Before the engagement starts, the operating system for the new Domain Controller must already be installed, and all devices should be configured to use a DHCP server. These prerequisites matter because the service scope does not include remote Windows OS installation on the server or support for devices with static network settings.
No, remote installation of the Microsoft Windows operating system on the server is not included in this service. This exclusion applies, for example, when using a virtual machine or remote server management technologies such as iLO, so the new server OS should be installed before the migration begins.
No, migration to Microsoft Entra ID is not included in the Domain Services and Active Directory Roles Migration service. The service is focused on transferring on-premises Domain Controller functions, including DNS and DHCP, to a new server.
The engagement typically starts with a kickoff meeting, followed by preparation of the new server, staged transfer of roles and data, verification of work, demotion of the old Domain Controller, and final verification with issue fixing if needed. This staged approach helps confirm that the new Domain Controller can perform the required functions before the old one is turned off.
Yes, preserving Group Policy settings is part of the stated success criteria for this service. IT Partner’s responsibilities include transferring group policy, groups, and users, so GPO settings are included in the migration scope.
The implementation plan may include demotion of the old Domain Controller after the new Domain Controller is verified. A stated success criterion is that the old Domain Controller is demoted and can be turned off.
No, support of devices with static network settings is not included in this service. The prerequisites state that all devices should be configured to use a DHCP server, so any static-device remediation should be handled separately or discussed with IT Partner before the engagement.
Completion is verified against criteria such as the new Domain Controller being available to users, users being able to log in, GPO settings being saved, DHCP working with settings preserved, and the old Domain Controller being demoted and ready to turn off. The implementation plan also includes verification of work and fixing issues if any are found within the engagement scope.
Safe when it is gated, and no, it is not rolled back. adprep /forestprep extends the schema of the whole forest to the Windows Server 2025 level — objectVersion 91 per Microsoft's schema table at the time of writing, where Windows Server 2019 and 2022 forests sit at 88 — and /domainprep updates each domain; promoting a Windows Server 2025 domain controller through Server Manager or PowerShell runs both automatically, so the question is when, not whether. A schema extension adds classes and attributes and cannot be undone by Microsoft's tooling; the only way back is a forest recovery from a backup taken before the change. That is why we treat it as a gated production change: a verified, restorable backup of a domain controller, a dedicated window, the schema master healthy, and replication confirmed to every domain controller before the first promotion. The step-by-step order is in Replacing Windows Server 2016 domain controllers with Windows Server 2025: the order of operations, and the case where Entra Connect runs on the domain controller you are retiring is in Moving Entra Connect off a domain controller you are retiring.
More than the directory. DHCP option 006 handing out the old server's address as a DNS server, static DNS server settings on servers, printers, NAS devices and appliances, the LDAP or RADIUS server fields on firewalls and VPN gateways, application configuration files and connection strings that name the server, service principal names and certificates issued to its name, and scripts and scheduled tasks that map a share on it. Demotion cleans up the directory's own records and does nothing for any of those. This engagement transfers DNS and DHCP with the domain controller, and where the plan calls for it the new server can take over the retired server's IP address after demotion so anything still pointing at the old address keeps working — the choice is made at the kickoff meeting. The read-only commands and an inventory template are in Finding everything that still points at an old domain controller. Support of devices with static network settings stays outside this fee, as the scope says.
Yes. On 7 April 2027 Microsoft retires the legacy service-account sign-in that Entra Connect Sync uses to reach the tenant; from that day a server below version 2.6.84.0, or still authenticating with the Directory Synchronization Accounts user, stops synchronizing — users keep signing in through Password Hash Sync, but new accounts, attribute changes and password changes stop reaching Microsoft Entra ID. When the sync server sits on the domain controller being retired, the relocation builds the replacement on the current release in staging mode, so application-based authentication is registered during setup rather than switched afterwards, and we confirm it with Get-ADSyncEntraConnectorCredential, which must return Application — the build alone is not enough, since a current build still on ServiceAccount stops like any other. Auto-upgrade does not do this for you: since version 2.6.84.0 the product never switches an existing server's identity in the background. The version ladder and the in-place switch for a server that is not moving are in Entra Connect application-based authentication by 7 April 2027.