DHCP, DNS and NPS Role Migration to Windows Server 2025 — Failover Pairs, Zones, RADIUS Policies and IPAM
DHCP, DNS and NPS Role Migration to Windows Server 2025 moves the network infrastructure roles every device in your estate depends on — DHCP scopes, reservations, options, policies and failover relationships; DNS zones, forwarders, conditional forwarders and scavenging; NPS/RADIUS network and connection request policies, RADIUS clients, shared secrets and the server certificate behind Wi-Fi and VPN authentication; and IPAM where it is deployed — from Windows Server 2016 or older hosts to Windows Server 2025 hosts, with a cutover plan per role, validation from real clients on real VLANs, and decommission of the old servers. IT Partner uses Microsoft's role-native export and import tooling rather than a copy of the server, rebuilds DHCP failover pairs through Microsoft's chained-relationship procedure so the lease database replicates instead of being pasted, and hands your network team the change list for relay agents and RADIUS clients. $450 per role server plus a $950 base fee, fixed and quoted in writing before work begins; a typical engagement of a few role servers at one or two sites takes about 1 week. Estates of 10 or more role servers, or multi-site DHCP failover designs, are quoted per estate. Windows Server 2016 leaves extended support on 12 January 2027 per Microsoft's product lifecycle. One small domain controller that carries DNS and DHCP with it is the Domain Services and Active Directory Roles Migration, not this page.
What this engagement is
Windows Server 2016 leaves extended support on 12 January 2027 per Microsoft's product lifecycle, and in most estates the servers that will hurt the most are not the application hosts but the quiet ones: the DHCP pair every laptop, phone and printer leases from, the DNS servers every lookup passes through, and the NPS servers that decide whether a Wi-Fi or VPN connection is allowed. They carry the highest dependency count with the least documentation, they were often built by someone who has since left, and their cutover touches network equipment we do not manage. This service is built for infrastructure teams at mid-size and enterprise organizations with multi-site networks and dozens of role servers — DHCP failover pairs, dedicated DNS servers and secondary zones, NPS behind 802.1X and VPN, IPAM — that need the roles moved to Windows Server 2025 in a controlled order with a rollback behind every step. If you run one small domain controller that also holds DNS and DHCP, the Domain Services and Active Directory Roles Migration exists for exactly that and costs less; we will say so on the scoping call. Each role has a Microsoft-documented move, and we use it rather than cloning the disk or upgrading the host in place. DHCP: Export-DhcpServer captures the server-level configuration — option definitions, vendor and user classes, policies, MAC filters — and every scope with its options, reservations, exclusions and, for a standalone server, the active leases; Import-DhcpServer restores it on the new host, which is then authorized in Active Directory while the old one is unauthorized and stopped. For failover pairs Microsoft's procedure is different and we follow it exactly: the old relationship is removed, only the server-level configuration is imported on the new hosts, a temporary failover relationship between an old and a new server replicates the scopes and the lease database, and the final relationship is then built between the two Windows Server 2025 servers with the same mode (load balance or hot standby), maximum client lead time, state-switchover interval and message-authentication secret as before. DNS: zones stored in Active Directory load on any domain controller that runs the DNS role and travel with the domain controllers, so what this service exports, recreates and checks is everything that does not replicate — standalone primary, secondary and stub zones on member servers, server-level and conditional forwarders, root hints and recursion settings, scavenging (exactly one server should scavenge, and the aging settings must match), response rate limiting and DNS policies where they exist, and the NS records and delegations that still name the old hosts. NPS: Export-NpsConfiguration carries RADIUS clients with their shared secrets, remote RADIUS server groups, connection request and network policies and logging settings to the new server in one file — a file Microsoft's documentation says contains those secrets unencrypted, so it is handled and destroyed accordingly — after which the new server is registered in Active Directory (the RAS and IAS Servers group that lets it read dial-in properties), a server certificate with the Server Authentication purpose is enrolled from your enterprise CA for PEAP and EAP-TLS, SQL accounting logging is reconfigured by hand because it is the one setting the export omits, and the Microsoft Entra multifactor authentication NPS extension, where you use it, is reinstalled and re-registered against your tenant. What decides the cutover is not the export but the addresses. DHCP relay agents on your routers and switches, the DNS server addresses in DHCP option 006 and in static configurations, and the RADIUS client entries on wireless controllers, switches, firewalls and VPN gateways all point at the old servers by IP. There are two honest ways to handle that, and we write the choice down per server before anything moves: keep the addresses — the new host takes over the old server's IP after the old one is retired, so nothing on the network changes — or issue new addresses and update every dependent, which is the cleaner design and the longer change list. Either way the plan accounts for lease timing: a DHCP client learns a changed option only at renewal, half-way through its lease, so we shorten lease durations ahead of a DNS address change and restore them afterwards, and we cut NPS over one RADIUS client at a time so a wireless controller can be pointed back in seconds if a policy behaves differently on the new host. Every change to network equipment is on the change list we hand your network team; we do not log in to your switches, controllers or firewalls, and the scope says so. Three boundaries. Domain controllers are not moved here: DNS that lives on a domain controller travels with the domain controller, and promoting Windows Server 2025 domain controllers and demoting the old ones — with the Windows Server 2016 forest and domain functional level Microsoft requires before a 2025 domain controller can be promoted — is the Domain Services and Active Directory Roles Migration, which we sequence with this work when both are in scope. Certificate Services is not moved here either, and the order matters: NPS trusts a server certificate issued by your CA, so if the CA is also leaving a 2016 host, the Active Directory Certificate Services (AD CS) Migration runs first. And the estate-wide questions — which 2016 hosts to upgrade in place, which to rebuild, which to bridge with Microsoft's Extended Security Updates through Azure Arc at Microsoft's per-core charge to you, and which to move to Azure — belong to the Windows Server 2016 End of Support Assessment and Roadmap and the Windows Server 2016 to 2025 Upgrade Service; this page is the role-server piece of that plan.
Which one applies to you
Every role on your inventory has a Microsoft-documented move, a list of things the move does not carry, and a piece of the network that has to change. This is what the service does for each.
| DHCP | DNS | NPS / RADIUS | IPAM (where present) | |
|---|---|---|---|---|
| Carried over | Server-level option definitions, vendor and user classes, policies and MAC filters; every scope and superscope with options, reservations, exclusions and delays; active leases on a standalone server; failover relationships rebuilt with the same mode, maximum client lead time, switchover interval and secret. | Standalone primary, secondary and stub zones exported and imported; server and conditional forwarders; root hints, recursion and scavenging settings; response rate limiting and DNS policies where configured. Zones stored in Active Directory are verified on the new server rather than exported. | RADIUS clients with shared secrets, remote RADIUS server groups, connection request and network policies, EAP settings, accounting log settings and NPS templates, through Microsoft's configuration export and import. | The IPAM database moved to a SQL Server instance you provide (a one-way move per Microsoft), the new IPAM server provisioned against it, access-provisioning GPOs re-run, managed DHCP and DNS servers rediscovered and address spaces verified. |
| Rebuilt or re-entered by hand | Authorization in Active Directory; the DNS dynamic-update credential and DnsUpdateProxy membership; server bindings per adapter; audit-log and backup paths. | NS records and delegations that name the old hosts; the scavenging owner; forwarder ordering and timeouts; DNS server security settings. | Registration in Active Directory (RAS and IAS Servers group); the server certificate enrolled from your enterprise CA; SQL Server accounting logging; the Microsoft Entra multifactor authentication NPS extension, reinstalled and re-registered where you use it. | Service accounts and IPAM administrator role assignments; scheduled discovery; custom fields and logical groups checked after the move. |
| What changes on the network | Relay agent (IP helper) addresses on routers, switches and firewalls — unless the new server takes over the old address. | DHCP option 006 and static DNS client settings; conditional forwarders on other DNS servers and in partner forests that point at you. | RADIUS server entries on wireless controllers, switches, VPN gateways and RD Gateways; PEAP and EAP-TLS client profiles that pin the NPS server name or CA, pushed by your endpoint team or our [managed Intune service](/services/managed-intune-service). | Nothing on the network; IPAM management GPOs re-link to the managed servers. |
| Validated with | A lease obtained and renewed from a real client on every VLAN and site the scopes serve; reservations honored; failover state and replication healthy on both partners. | Internal, external and conditional-forwarder lookups from clients at each site; zone transfers to secondaries; dynamic registration from a domain-joined client; a scavenging dry run. | A successful 802.1X Wi-Fi or wired authentication and a VPN authentication per policy from real devices, with the event log showing the intended policy matched; an MFA prompt where the extension is used. | Address utilization and the DHCP and DNS management views populated for every managed server; a change made through IPAM lands on the target server. |
| Rollback | Old server re-authorized and started; for failover, the old partner stays intact until the final relationship is healthy. | Clients and forwarders pointed back at the old host, which keeps serving until decommission. | RADIUS clients pointed back at the old NPS, which is left running until every policy has passed on the new one. | Old IPAM server retained until the new one has completed a full discovery and audit cycle. |
Each role server on your inventory counts once toward the per-server fee, whatever combination of roles it holds, and a Windows Server 2025 host that only receives a role counts as a server. The base fee covers the planning, cutover coordination and documentation that do not scale with server count. Estates of 10 or more role servers, and DHCP failover designs that span multiple sites, are quoted per estate after scoping — before anything moves.
Success criteria
What you receive
How the work unfolds
Confirm the server list, sites, owners, maintenance windows and the date driving the work. IT Partner collects the DHCP, DNS, NPS and IPAM configuration remotely with read-only PowerShell, maps relay agents, RADIUS clients, forwarders and failover partners, and confirms the Windows Server 2025 hosts are built to the prerequisites.
Deliver the migration and cutover plan: per-server address strategy, cutover order across roles and sites, lease-duration changes, validation steps, rollback triggers and the network change list. You approve the plan; nothing is exported before that, and any server that belongs to another service — a domain controller, a certification authority — is named now.
Install and configure the DNS role on the new hosts, verify the zones that replicate, import standalone zones and recreate forwarders, scavenging and policies; import the NPS configuration, register the servers, enroll the server certificate and install the MFA extension where used. Both roles run beside the old servers; nothing points at them yet.
Export and import DHCP per server, rebuild failover relationships through Microsoft's chained procedure, authorize the new servers and move IPAM where in scope. Leases were shortened on day 2 where the plan calls for it, so option changes reach clients inside the cutover window.
In the agreed windows: address takeover, or the network change list applied by your team per role and site, then validation from real clients on every VLAN — lease, lookup, Wi-Fi and VPN authentication — with the old servers held ready for rollback.
Old servers unauthorized and retired after the soak period you choose, lease durations restored, DNS and Active Directory records cleaned, as-built documentation delivered, open items assigned and delivery approved. Estates quoted per estate repeat days 3–5 per site on the schedule the quote states.
Prerequisites
Who does what
IT Partner
- Run the kickoff, collect the inventory and dependency map, and produce the migration and cutover plan, address strategy, network change list and written fixed quote.
- Perform every DHCP, DNS, NPS and IPAM export, import and reconfiguration on the old and new servers, including failover rebuilds, certificate enrollment, Active Directory registration and authorization.
- Coordinate each cutover window, validate every role from real clients per VLAN and site, and execute the rollback if a trigger is hit.
- Handle exported files that contain RADIUS shared secrets as sensitive data — encrypted in transit, destroyed after import — and document that disposition.
- Decommission the old role servers, clean up DNS and Active Directory records, and deliver the as-built documentation and handover session.
- Say plainly when a server belongs to another service — a domain controller, a certification authority, a third-party appliance — and sequence it rather than force it.
- Remove the access granted for the work at closeout.
Your team
- Provide the inventory, owners, access and maintenance windows before kickoff, and the Windows Server 2025 hosts built to the prerequisites before day 3.
- Buy and hold Windows Server 2025 licenses and CALs and the SQL Server license for IPAM, and own licensing compliance.
- Apply the network change list — relay agents, RADIUS clients, static DNS settings — through your network team or vendor inside the cutover windows, and hold the change freeze.
- Approve the plan, the address strategy and each cutover, and sign the decommission of each old server.
- Provide test devices and users at each site, and application owners for systems with static DNS or RADIUS dependencies.
- Push updated Wi-Fi and VPN client profiles where the NPS server name or issuing CA changes, through your endpoint management or our managed Intune service.
- Review the deliverables and approve delivery, or report defects, within the schedule.
What's not included
Limitations & technical notes
Frequently asked questions
What does this service migrate, exactly?
Four roles, and everything Microsoft's tooling and a careful engineer can carry between hosts. DHCP: scopes, superscopes, reservations, exclusions, options at every level, classes, policies, MAC filters, leases for standalone servers, and failover relationships rebuilt. DNS: standalone, secondary and stub zones exported and imported, forwarders, conditional forwarders, root hints, recursion, scavenging, response rate limiting and DNS policies recreated, NS records and delegations updated, and zones stored in Active Directory verified on the new server. NPS: RADIUS clients with shared secrets, remote RADIUS server groups, connection request and network policies, the server certificate, Active Directory registration, accounting logging and the Entra multifactor authentication extension where used. IPAM: the database on SQL Server, the new server provisioned, managed servers rediscovered. Plus the cutover plan, the network change list, validation from real clients at every site and decommission of the old hosts.
How is DHCP moved without clients losing their addresses?
With Microsoft's DhcpServer PowerShell module rather than a copy of the disk. Export-DhcpServer writes the server configuration, every scope and — for a standalone server — the active leases to a file; Import-DhcpServer restores it on the Windows Server 2025 host, leases included, so a client that renews after cutover finds its address still held for it. The new server is authorized in Active Directory, the old one is unauthorized and stopped, and relay agents are pointed at the new server or the new server takes over the old address. The DNS dynamic-update credential and DnsUpdateProxy membership are re-entered on the new host because they do not travel in the export, and a client on every VLAN the scopes serve obtains and renews a lease before we call the role done.
How do you migrate a DHCP failover pair?
By Microsoft's documented procedure, which deliberately does not export leases. The old failover relationship is removed; only the server-level configuration — option definitions, classes, policies, MAC filters — is imported on the two new servers; a temporary failover relationship between an old partner and a new one replicates the scopes and the lease database; that relationship is removed and the final one is created between the two Windows Server 2025 servers with the original mode (load balance or hot standby), maximum client lead time, state-switchover interval and message-authentication secret. Relay agents are then updated. One partner carries the scopes during the sequence, so it sits in a maintenance window, and options on the new partner are verified before the final relationship is formed.
What about DNS — do zones need to be exported?
Only the ones that do not replicate. Zones stored in Active Directory load on any domain controller that runs the DNS role, so they move with the domain controllers and we verify them on the new server rather than export them; a member server can hold them only as secondary zones. Standalone primary zones, secondary and stub zones, server-level forwarders, root hints, recursion and scavenging settings, response rate limiting and DNS policies are per-server, and those are exported, recreated and checked. Conditional forwarders may be replicated through the directory or held per server depending on how they were created, and each is treated accordingly. The two things people forget are that exactly one server should own scavenging, with matching aging settings across zones, and that NS records and delegations still naming the old hosts have to be edited by hand — both are on the checklist.
How is NPS moved, and what breaks most often?
Export-NpsConfiguration writes RADIUS clients with their shared secrets, remote RADIUS server groups, connection request and network policies and logging settings to one XML file; Import-NpsConfiguration loads it on the new server and replaces whatever was there. Microsoft's documentation is explicit that the file holds the shared secrets unencrypted, so we treat it as a secret. Then the parts the export leaves out: the server is registered in Active Directory so it can read account dial-in properties, a server certificate with the Server Authentication purpose is enrolled from your enterprise CA, SQL accounting logging is reconfigured, and the Entra multifactor authentication extension is reinstalled where used. What breaks most often is not on the server: a PEAP or EAP-TLS client profile that trusts a specific server name or CA rejects the new certificate, and a RADIUS client whose entry was never updated keeps talking to the old host. Both are on the plan before cutover.
We use the Entra ID multifactor authentication extension on NPS. Does it come across?
It has to be reinstalled. The Microsoft Entra multifactor authentication NPS extension is installed per NPS server, and its installer's PowerShell script creates a certificate on that server and associates it with the service principal in your tenant — so a new server needs its own installation and registration, and its own outbound access to Microsoft's endpoints. Microsoft's documentation lists Windows Server 2012 or later as the platform requirement, and the licensing is yours: Entra multifactor authentication rights through Entra ID P1 or P2 or a suite that includes them. We install and register it on each new NPS host, validate an MFA prompt on a real VPN or RD Gateway login, and leave the old server in place until you sign its decommission.
Do our routers, switches and wireless controllers need to change?
Yes, unless the new servers take over the old addresses. Relay agents — IP helper addresses — on routers, switches and firewalls point at DHCP servers by IP; wireless controllers, switches, VPN gateways and RD Gateways hold RADIUS server entries by IP with a shared secret; other DNS servers, partner forests and static clients hold DNS server addresses. All of that goes on the change list we hand your network team, in cutover order, with a rollback line per item. We do not log in to network equipment ourselves — that boundary is written into this service — and the alternative that avoids most of the change list is the address takeover described in the next answer.
Can the new servers keep the old IP addresses?
Yes, and for many estates it is the better plan. After the old server is unauthorized and shut down, the new Windows Server 2025 host takes its address, and relay agents, RADIUS clients, DHCP options and static configurations keep working unchanged; client caches settle within minutes. The cost is a short window in which neither server holds the address, and a rollback that means re-addressing again, so we use it where the network change list would otherwise be long — many sites, many RADIUS clients — and issue new addresses where the estate is small or the addressing is being re-planned anyway. The choice is written per server in the plan you approve.
Our DNS and DHCP run on domain controllers. Is this the right service?
It depends on how many. One small domain controller that also holds DNS and DHCP — the SBS-style server — is the Domain Services and Active Directory Roles Migration: one server, a lower fixed price, three days, and it moves DNS and DHCP with the domain controller. Several domain controllers with DNS on all of them, plus dedicated DHCP or NPS servers, is this page for the role servers and the domain controller service for the promotions and demotions, sequenced together: zones stored in Active Directory move with the domain controllers, while forwarders, scavenging, conditional forwarders and NS records — which do not — are handled here. Microsoft requires a Windows Server 2016 forest and domain functional level before a Windows Server 2025 domain controller can be promoted, so we check that on day 1.
What is IPAM's status in Windows Server 2025, and how do you move it?
IPAM is still a role in Windows Server 2025 and is not on Microsoft's removed or deprecated list at the time of writing; the Windows Internal Database it uses by default is, alongside the other roles that use it, with Microsoft advising a move to SQL Server. Microsoft's Move-IpamDatabase cmdlet migrates the database from the Windows Internal Database to SQL Server in one direction only. So an IPAM move under this service means a SQL Server instance you provide, the database moved there, the new IPAM server provisioned against it, the access GPOs provisioned again and the managed DHCP and DNS servers rediscovered — and a check that address utilization and the DHCP and DNS management views are populated before the old server is retired.
How much does it cost, and what counts as a server?
$450 per role server plus a $950 base fee — a fixed price, quoted in writing after the inventory and before any export; you pay after you approve delivery. A server counts once whatever combination of DHCP, DNS, NPS and IPAM it holds, and a Windows Server 2025 host that only receives a role counts as a server. A DHCP failover pair with two DNS servers and two NPS servers is six role servers, which comes to $3,650. Estates of 10 or more role servers and DHCP failover designs that span multiple sites are quoted per estate. Windows Server 2025 licenses and CALs, SQL Server licensing for IPAM, hardware and the network changes are yours.
How long does it take, and what is the downtime?
About 1 week for a typical engagement of a few role servers: inventory and plan on days 1–2, DNS and NPS on day 3, DHCP and IPAM on day 4, cutover and validation on day 5, decommission after the soak period you choose. Downtime is measured in minutes per role, not hours: DHCP clients hold their leases through the switch and renew against the new server; DNS lookups fail over to the second server in every client's list while one is moved; RADIUS clients are re-pointed one at a time with the old NPS still answering. Larger or multi-site estates repeat the cycle per site on the schedule the quote states.
Should we just upgrade the role servers in place instead?
Usually not. An in-place upgrade keeps years of configuration drift and stale drivers on a host that may fail the Windows Server 2025 hardware requirements, takes the role down for the whole upgrade window, and leaves the previous installation as the only rollback. A side-by-side migration keeps the old server serving until the new one has passed validation from real clients, gives you a rollback that takes seconds, and lets you land the roles on the hosts and sites you actually want. Where an in-place upgrade is right — a plain application or file server — the Windows Server 2016 to 2025 Upgrade Service does it, and that page routes DHCP, DNS and NPS role holders here on purpose.
We will not finish before 12 January 2027. What then?
Then the role servers move first, because they are the ones every other system depends on, and whatever cannot be moved in time is bridged. Microsoft offers Extended Security Updates for Windows Server 2016 after 12 January 2027, bought through volume licensing or enabled through Azure Arc and billed by Microsoft per core to you; enrolling servers through Arc is the Windows Server ESU Enrollment through Azure Arc service. The plan we write on day 2 names which servers need the bridge and for how long. We do not sell ESU as a strategy — it is a fee that buys time, and this service is what the time is for.
Who owns this service at IT Partner?
Roman Sotnik is the service owner. IT Partner has been a Microsoft partner since 2006 and holds the Solutions Partner for Infrastructure designation; this service sits beside our Active Directory, certificate services, Windows Server upgrade and Azure migration practices, which is why a domain controller, a certification authority or a host that should move to Azure is routed to the right team instead of forced through this one.