Multi-Site Domain Controller Migration to Windows Server 2025 replaces the Windows Server 2016 or 2019 domain controllers of one forest and one domain — up to six Active Directory sites and fourteen domain controllers — with Windows Server 2025 domain controllers, in the order that keeps sign-in, Group Policy, DNS and the equipment that authenticates against Active Directory working at every site. IT Partner validates readiness first (AD health, replication, DNS, SYSVOL on DFS-R, FSMO roles, functional levels, schema version, time source, Group Policy count, and a verified backup with forest-recovery readiness as the precondition), raises the schema to the Windows Server 2025 level with adprep /forestprep and /domainprep as a gated change, moves Entra Connect off a retiring domain controller through a staging-mode swap with Password Hash Sync and password writeback verified afterwards, tests up to 25 named dependencies — LDAP and LDAPS applications, NAS, scan-to-folder printers, Linux hosts on SSSD or Winbind, production equipment — against the Windows Server 2025 defaults (SMB signing required, NTLMv1 removed, no RC4 ticket-granting tickets, strong certificate mapping enforced), then promotes, demotes and re-IPs site by site in overnight windows across your time zones so retired domain controller addresses keep answering, splits the FSMO roles across two new domain controllers and sets the time source, validates DNS and SYSVOL, rebuilds AD Sites and Services for the target topology, decommissions the old domain controllers with metadata cleanup, and hands over the migration runbook, per-step rollback, acceptance criteria per site and the closeout documentation. Remote delivery with named engineers per region for the overnight windows, over about eight weeks. From $12,500 for the standard scope, fixed in a written quote once the domain controller and dependency counts are agreed; a second domain, more sites or domain controllers, or more than 25 dependencies are quoted in writing. You provide the hardware or virtual machines, the base operating system, networking and firewall changes, licenses, and hands-on help at the regional sites. Not included: remediation of applications that fail on NTLMv1, SMB1 or RC4-only Kerberos (identified and reported; fixed by the application owner or by change order), PKI redesign, WAN and firewall work, hardware, and Windows Server licenses, CALs and Microsoft's Azure charges, which are always yours. One domain controller at one site is the $900 Domain Services and Active Directory Roles Migration, not this page. Windows Server 2016 leaves extended support on 12 January 2027 per Microsoft's product lifecycle.
Replacing one domain controller is a three-day job with a known shape. Replacing ten to fourteen of them across six sites on three continents is a different job, and the difference is not the number of servers — it is the order of operations and the things that break when the order is wrong. The forest schema has to be raised before the first Windows Server 2025 domain controller can be promoted, and that change cannot be undone except by a forest recovery. Entra Connect is often found running on one of the domain controllers being retired, so the identity bridge to Microsoft 365 has to move before that server is demoted. Retired domain controller addresses live on quietly in DHCP option 006, in the static DNS settings of printers and appliances, in the configuration of factory and lab equipment and in LDAP connection strings nobody has opened in years. And a Windows Server 2025 domain controller arrives with defaults — SMB signing required, NTLMv1 gone, no RC4 ticket-granting tickets, strong certificate mapping enforced — that older NAS units, scan-to-folder printers, Linux hosts on SSSD or Winbind and some production equipment were never tested against. This service exists to run that sequence as one plan, site by site, inside the standard scope printed above: one forest, one domain, up to six sites and fourteen domain controllers, with compatibility testing of up to 25 named dependencies. The engagement is built as six gated steps. Readiness first: the discovery questionnaire and a read-only validation of AD health, replication, DNS, SYSVOL on DFS-R, FSMO placement, functional levels, the schema version, the time source and the Group Policy estate, plus the gate that matters most — a verified, restorable backup and a documented forest-recovery path, because the schema change is one-way. Then the schema: Windows Server 2025 domain controllers need the forest schema at objectVersion 91 (a Windows Server 2016 forest sits at 87, a 2019 or 2022 forest at 88, per Microsoft's schema-version table at the time of writing), so adprep /forestprep and /domainprep run against the schema master in a dedicated window, from the Windows Server 2025 media, under an account in Schema Admins and Enterprise Admins, with replication of the change confirmed on every domain controller before anything else proceeds. Then Entra Connect: a new sync server on a member server (Microsoft requires a domain-joined Windows Server with the full desktop experience and recommends Windows Server 2025 or 2022) is built in staging mode with the exported configuration, its pending exports are compared with the production server, and the swap is made in one short window; Password Hash Sync and password writeback are inactive while a server is in staging mode, so both are verified on the new server after the swap, not before. Then the compatibility stage: each of the up to 25 named dependencies is tested against the first new domain controller in a pilot site, and anything that fails on NTLMv1, SMB1 or RC4-only Kerberos is written up with the failing default, the owner and the fix — remediation is the application owner's or a change order, not a surprise on cutover night. Then the per-site windows, typically three overnight windows across time zones: promote the new domain controller, confirm replication, move any roles it will hold, demote the old one, and move the retired address and DNS registration onto the replacement where the inventory shows it is still referenced, so whatever still points at the old address keeps working. Last, the forest-level finish: FSMO roles split across two new domain controllers with the PDC emulator as the authoritative time source, AD Sites and Services rebuilt for the target topology, DNS and SYSVOL validated, old domain controllers powered off for a soak and then cleaned out of the directory metadata. What the Windows Server 2025 defaults change, in plain terms. SMB signing is required by default for all outbound SMB connections, so a Windows Server 2025 host cannot reach a share on a device that cannot sign. NTLMv1 is removed, so a device or application that still authenticates with it fails. The Kerberos key distribution center no longer issues ticket-granting tickets with RC4, so an account or keytab restricted to RC4 — common on older Linux hosts and appliances — stops getting tickets. LDAP over TLS supports TLS 1.3 and new forests require LDAP signing by default; an existing forest keeps its LDAP signing policy, which we read and report rather than change. And strong certificate mapping for certificate-based sign-in has been fully enforced on every patched domain controller since Microsoft's February 2025 change (KB5014754), with the compatibility override retired in September 2025 — not a Windows Server 2025 difference, but the thing that bites when a smart-card or device certificate was issued without a strong mapping and nobody noticed because the old domain controllers were behind on updates. The compatibility report tells you which of your 25 dependencies each of these touches. Deeper hardening of the directory after the migration — tiering, legacy protocol removal, privileged access — is the Active Directory Security Assessment and Hardening, not this page. Three things this page sends elsewhere so you see them coming. Licensing: twelve to fourteen new domain controllers mean twelve to fourteen Windows Server 2025 licenses at the 16-core minimum per server, and Windows Server CALs must be the same version as the server software or later, so 2016-era CALs without Software Assurance mean a CAL refresh for every user or device — a bill that can be larger than the services fee. We hand you the count; the Windows Server and SQL Server Licensing and True-Up Advisory turns it into a defensible position, and the Windows Server calculator and CAL calculator price it at Microsoft's list price. Hotpatching: if security updates without a monthly reboot are the reason you chose Windows Server 2025, the new domain controllers need an Azure Arc connection, virtualization-based security enabled and the hotpatch enrollment, and Microsoft removed the hotpatch charge for Arc-connected Windows Server 2025 machines on 19 May 2026; that enrollment is cleanest at build time and is a priced option through Azure Arc Hybrid Server Management, or, when a parent company or auditor needs the servers under central management as evidence, through the Azure Arc Onboarding with Azure Update Manager for an Audited Estate at /services/azure-arc-update-manager-onboarding-audited-estate. The date: if the Windows Server 2016 domain controllers cannot all be replaced before 12 January 2027, the plan becomes two phases — the 2016 domain controllers first, the new sites and the site-link redesign after — with Windows Server 2016 Extended Security Updates through Azure Arc as the paid safety valve for the months in between, priced from the ESU calculator and enrolled through Windows Server ESU Enrollment through Azure Arc. ESU is the safety valve, not the plan.
Confirm the scope counts, the site list with time zones, the date that is driving you and the decision-makers. Take read-only access, run the validation, verify the backup and the forest-recovery path. The schema step does not start until this gate is passed in writing.
Agree the site order, the per-domain-controller naming and IP plan, the FSMO split, the target Sites and Services topology, the Entra Connect move and the build standard for your new servers. You name the up to 25 dependencies and their owners; we write the test for each. The licensing count goes to you now, so the CAL question is answered before the first server is built.
adprep /forestprep and /domainprep against the schema master in a dedicated window, under an account in Schema Admins and Enterprise Admins, from a verified backup state, with replication confirmed on every domain controller. A one-way change, so it has its own window and its own sign-off.
Promote the first Windows Server 2025 domain controller as the pilot — in the test site with the most old equipment, holding no operations master roles, with the site's existing domain controllers left running — point each named dependency at it, and test every category against a pass condition written before the test and a rollback that fits the step (revert the device; demote the pilot, clean while it holds no roles; point the test site back at its old domain controllers), then issue the compatibility report. The categories and their pass conditions are in What breaks when domain controllers move to Windows Server 2025. Build the new Entra Connect server in staging mode, compare exports, swap in a short window, and verify Password Hash Sync and writeback on the new server.
Typically three overnight windows across time zones, each covering the sites in that region: promote, confirm replication, move roles, demote, re-IP and validate against the signed acceptance criteria. Each site is accepted before the next window opens, and the rollback step for every action is in the runbook.
Place the roles on the two designated new domain controllers, set the PDC emulator as the authoritative time source, validate DNS and SYSVOL across the forest, and rebuild subnets, site links and replication schedules for the target topology.
Power off the old domain controllers for the agreed soak, clean up metadata in the directory and DNS, deliver the closeout documentation and the licensing count, and hold the handover session. Hotpatch and Azure Arc enrollment of the new domain controllers, if you took the option, is scheduled here.
Start with the two things that gate everything else: a verified backup with a forest-recovery path, and a read-only readiness check of replication, DNS, SYSVOL replication mode, FSMO placement, functional levels and the schema version. Then the order is fixed by dependencies, not preference: raise the schema to the Windows Server 2025 level (one-way, its own window), move Entra Connect off any domain controller you are retiring, test the systems that authenticate against Active Directory from outside Windows against the first new domain controller in a pilot site, and only then run the per-site windows — promote the new domain controller, confirm replication, move roles, demote the old one, move its address across where something still points at it. The forest-level finish (FSMO split, time source, Sites and Services, decommission) comes last. Everything on this page runs in that order for up to six sites and fourteen domain controllers, in about eight weeks; a single domain controller uses the $900 Domain Services and Active Directory Roles Migration instead.
It is safe when it is treated as what it is — an irreversible, forest-wide schema change. There is no adprep undo; the only rollback is a forest recovery from backup. So we run it as a gated change: a verified, restorable backup and a documented recovery path first, a dedicated window, an account in Schema Admins and Enterprise Admins, adprep /forestprep from the Windows Server 2025 media against the schema master, then /domainprep, and replication of the change confirmed on every domain controller before anything else proceeds. Windows Server 2025 needs the schema at objectVersion 91; a Windows Server 2016 forest sits at 87 and a 2019 or 2022 forest at 88, per Microsoft's table at the time of writing. The schema step does not raise your functional level — that is a separate, also irreversible decision, and it is not in this scope.
By never having two active sync servers and never having none. We build a new Entra Connect server on a member server — Microsoft requires a domain-joined Windows Server with the full desktop experience and recommends Windows Server 2025 or 2022 — import the exported configuration, and leave it in staging mode, where it imports and synchronizes but exports nothing. We compare its pending exports with the production server, fix any difference, then swap in one short window: the old server goes into staging mode, the new one comes out of it. Password Hash Sync and password writeback are inactive on a staging server, so we verify both on the new server right after the swap with a password change in each direction. The retiring domain controller is demoted only after that. The new server runs the current release with application-based authentication — confirmed with Get-ADSyncEntraConnectorCredential returning Application — which Microsoft requires by 7 April 2027 at the time of writing, so you are not back here for that; what changes on that date and how a server that is not moving is switched in place is in Entra Connect application-based authentication by 7 April 2027.
You look where the references actually live, and you plan for the ones you miss. The readiness stage inventories DHCP option 006 on every scope, the static DNS settings of printers, NAS units, appliances and production equipment, LDAP connection strings in application configurations, and the DNS client settings of servers with static addresses. The safety net for the ones no inventory catches is the re-IP step: after the old domain controller is demoted, its address and DNS registration move to the replacement where the inventory shows the address is still referenced, so a device that was never found keeps working while it is fixed properly. Moving the DHCP scopes themselves off the old domain controllers is the priced DHCP, DNS and NPS Role Migration option.
The things that still depend on a default Windows Server 2025 turns off. SMB signing is required for every outbound SMB connection, so a Windows Server 2025 host cannot write to a NAS or a scan-to-folder destination that cannot sign. NTLMv1 is removed, so a device or application authenticating with it fails. The key distribution center no longer issues RC4 ticket-granting tickets, so a Linux host on SSSD or Winbind, or an appliance, with an account or keytab limited to RC4 stops getting Kerberos tickets. Strong certificate mapping is fully enforced for certificate-based sign-in. That is why the scope includes a compatibility stage: up to 25 named dependencies tested against the first new domain controller in a pilot site, each written up as pass, pass with a change, or fail with the failing default, the owner and the fix — before any production site is cut over. The fix itself — firmware, a configuration change, a keytab reissued with AES — is the owner's or a change order.
One site at a time, inside that site's own night, with a domain controller that already works before the old one is touched. Each region gets an overnight window — typically three windows across time zones for six sites — run by named engineers in that region. In the window: promote the new domain controller, confirm replication from every site, move any role it will hold, demote the old one, move the retired address where it is still referenced, and run the acceptance tests you signed beforehand. Users in that site authenticate against the new domain controller before the old one is demoted, and the other sites keep authenticating against their own domain controllers throughout. Every step has a rollback in the runbook, and a site is accepted before the next window opens.
Twelve Windows Server 2025 Standard licenses at the 16-core minimum per server, or Datacenter where a host licenses more virtual machines than Standard allows, and Windows Server CALs of the same version as the server software or later for every user or device that authenticates. The CAL version matters more than people expect: a 2016 CAL does not cover a 2025 server, so 2016-era CALs without Software Assurance mean a CAL refresh across the organization on the day the first Windows Server 2025 domain controller goes into production, and that bill can exceed the services fee. We hand you the count in week 2; the Windows Server calculator and the CAL calculator price it at Microsoft's list price, and the Windows Server and SQL Server Licensing and True-Up Advisory turns it into a defensible position. You buy the licenses from us or from anyone.
Hotpatching needs three things on each domain controller: Windows Server 2025 Standard or Datacenter at the current cumulative update from a baseline month, an Azure Arc connection through the Connected Machine agent, and virtualization-based security enabled, which needs UEFI with Secure Boot or a generation 2 virtual machine — so it is easiest to get right when the server is built, which is why the build standard asks for it. Azure Arc's control plane carries no charge, and Microsoft removed the hotpatch charge for Arc-connected Windows Server 2025 machines on 19 May 2026; the charges that do exist are for services you attach, such as Azure Update Manager where Microsoft charges for it. Microsoft's hotpatch documentation does not state a domain-controller exclusion at the time of writing, so we enroll one domain controller first and watch a full cycle. The enrollment itself is a priced option through the Azure Arc Hybrid Server Management page, and Microsoft's charges are always yours.
Then the plan becomes two phases and the calendar stops being the risk. Phase one replaces the Windows Server 2016 domain controllers — the ones that lose updates on 12 January 2027 — and phase two adds the new sites and the site-link redesign afterwards. For the months in between, Windows Server 2016 Extended Security Updates through Azure Arc keep the remaining 2016 domain controllers patched; Microsoft bills ESU from 13 January 2027 for the servers you enroll, the ESU calculator estimates the cost before you decide, and enrollment is the Windows Server ESU Enrollment through Azure Arc service. We say in week 1 whether the date is reachable with the scope as written, and ESU is the safety valve, not the plan.
The base covers the standard scope as printed: readiness validation, the schema preparation, the Entra Connect move, compatibility testing of up to 25 named dependencies, per-site promote, demote and re-IP across up to six sites, the FSMO split and time source, DNS and SYSVOL validation, Sites and Services for the target topology, decommission with metadata cleanup, and the runbook, rollback, acceptance and closeout documentation — for one forest and one domain with up to fourteen domain controllers, delivered remotely. The written quote adds a per-domain-controller fee for the count in your inventory and is fixed before the schema step; you pay after you approve delivery. On-site presence, DHCP scope moves, Arc and hotpatch enrollment, AD CS migration and a licensing quote are priced options, and anything beyond the caps is quoted in writing.
Not during the migration. Promoting a Windows Server 2025 domain controller only needs the domain and forest at the Windows Server 2016 level, and the schema update does not change the functional level. The Windows Server 2025 level — and the optional 32k database page format that comes with it — is forest-wide, requires every domain controller in the forest to run Windows Server 2025 first, and cannot be reversed without a forest recovery. It is a separate decision after the last old domain controller is gone, made in writing, with a fresh backup, as its own short engagement.
It changes where they go. A cluster or storage that needs Active Directory to boot cannot be the only home of the domain controllers it authenticates against, so the design keeps at least one domain controller per site on a host that does not depend on the cluster — a standalone host or a physical server — and disables hypervisor time synchronization on every virtual domain controller so the PDC emulator stays the time source. If the cluster itself is on Windows Server 2016, its upgrade is the separate Hyper-V Failover Cluster Upgrade to Windows Server 2025, sequenced after the domain controllers it depends on.
No. The standard scope is remote delivery with named engineers per region for the overnight windows, and hands-on help at each site from your side for console access and power. On-site presence for the core cutover is a priced option, quoted per site with travel at cost, for customers whose change process or whose site requires it.
No — and the other page is cheaper. One domain controller at one site, with its DNS and DHCP, is the Domain Services and Active Directory Roles Migration at $900 over three days. This page starts paying for itself when there are several sites, a schema change nobody wants to be first to run, Entra Connect on a domain controller, equipment that authenticates against Active Directory, and cutover windows that have to happen in different nights. If you are between the two, the Windows Server 2016 End of Support Assessment and Roadmap puts every host on one plan and tells you which page you need.