Last reviewed: September 2026. Microsoft can change prerequisites and Active Directory guidance, so confirm current requirements before changing a production domain.
Migrating a domain controller to Windows Server 2025 is different from upgrading an ordinary Windows Server. A domain controller may handle user sign-ins, computer authentication, Active Directory, Group Policy, DNS, and other services your business relies on every day. If the migration goes wrong, users may suddenly be unable to sign in, access shared resources, or connect to important business applications.
For this reason, the recommended approach is usually not to upgrade the existing domain controller in place. Instead, install Windows Server 2025 on a new server or virtual machine, join it to your existing domain, promote it to an additional domain controller, verify that Active Directory is working correctly, transfer the required roles, and only then retire the older DC.
This guide explains how to migrate a domain controller running Windows Server 2016, 2019, or 2022 to Windows Server 2025, with practical checks and beginner-friendly explanations along the way.
Windows Server 2025 Domain Controller Migration: Quick Answer
- Check the health of your existing Active Directory environment.
- Confirm the domain and forest functional levels.
- Verify SYSVOL replication.
- Back up the existing domain controllers.
- Install Windows Server 2025 on a new server or virtual machine.
- Join the new server to the existing domain.
- Install Active Directory Domain Services.
- Promote Windows Server 2025 to an additional domain controller.
- Verify Active Directory, DNS, SYSVOL, and replication.
- Transfer FSMO roles where required.
- Move DNS, DHCP, and other dependencies away from the old DC.
- Test authentication and business applications.
- Demote the old domain controller.
- Consider raising the domain and forest functional levels later.
In simple terms: Check → Back Up → Build → Promote → Replicate → Verify → Transfer → Test → Demote
Domain Controller Migration Flow
Domain Controller Migration vs an In-Place Windows Server Upgrade
It is important to separate these two jobs. An in-place Windows Server upgrade installs a newer Windows Server release over the existing operating system while attempting to retain applications, files, roles, and settings.
A domain controller migration normally introduces a new server into Active Directory while the old domain controller continues operating temporarily. The two DCs coexist while Active Directory information replicates to the new server, creating a valuable safety window for testing before the old machine is retired.
| Method | What it does | Best fit |
|---|---|---|
| In-place upgrade | Installs a newer OS over the existing Windows Server installation. | Healthy, compatible non-DC servers that remain on the same system. |
| Domain controller migration | Builds a new Server 2025 system, promotes it as a DC, replicates AD, transfers roles, then demotes the old DC. | Active Directory domain controllers and side-by-side migrations. |
Is your server not a domain controller? Use our separate Windows Server 2019/2022 to Windows Server 2025 upgrade guide. That article covers the general operating-system upgrade intent, while this guide focuses on Active Directory and domain controller migration.
Can Windows Server 2016, 2019 and 2022 Domain Controllers Migrate to Server 2025?
Yes, provided the existing Active Directory environment meets Windows Server 2025 requirements. The key detail is your Active Directory functional level, not simply the Windows Server version shown on the old DC.
| Current DC | Server 2025 migration | What to check first |
|---|---|---|
| Windows Server 2022 | Yes | AD health, replication, DNS, functional levels, applications, and backups. |
| Windows Server 2019 | Yes | Same core checks. Do not assume the domain functional level matches the OS. |
| Windows Server 2016 | Yes | Functional levels, legacy dependencies, SYSVOL replication, applications, and combined server roles. |
Before You Start: Windows Server 2025 DC Migration Checklist
Before installing anything, document the environment. At minimum, identify:
- Every existing domain controller and its Windows Server version
- Domain and forest functional levels
- Global Catalog servers
- FSMO role holders
- DNS servers
- DHCP servers
- IP addresses used for DNS
- Applications using LDAP or Active Directory
- Services referring directly to the old DC
- Current Active Directory replication status
- Backup and recovery procedures
Step 1: Check the Domain and Forest Functional Levels
Start by finding out which Active Directory functional levels you currently use.
Get-ADDomain | Select-Object DNSRoot, DomainModeGet-ADForest | Select-Object Name, ForestModeFor Windows Server 2025 to become a domain controller in an existing domain, the environment must meet the current Microsoft functional-level prerequisites. A result showing Windows Server 2016 can be normal even if current DCs run Server 2019 or Server 2022.
Step 2: Check Active Directory Health
Do not begin a domain controller migration with known Active Directory problems.
dcdiagdcdiag /e /vrepadmin /replsummarydcdiag /test:DNS /vLook for unexplained replication failures and DNS errors. Active Directory relies heavily on DNS to locate domain controllers, Kerberos, LDAP, and Global Catalog services. A successful Server 2025 promotion can still lead to authentication problems if DNS is not configured correctly.
Step 3: Verify SYSVOL Replication
SYSVOL contains domain information such as Group Policy files and sign-in scripts. Modern domains use DFS Replication (DFSR) for SYSVOL. Older Active Directory environments that have been upgraded repeatedly deserve extra checking for legacy replication configuration before a Server 2025 DC is introduced.
Step 4: Create and Verify Your Backups
Before making changes to Active Directory, create an appropriate backup and verify that it is usable. A backup job that reports success is not the same as a recovery plan.
| Backup question | Record / confirm |
|---|---|
| When did the last successful backup finish? | ____________________________ |
| Which domain controllers are covered? | ____________________________ |
| Where is the backup stored? | ____________________________ |
| Has a restore been tested? | Yes / No |
| Who performs recovery? | ____________________________ |
| Are recovery credentials accessible? | Yes / No |
Step 5: Install Windows Server 2025 on the New Server
Install a fresh copy of Windows Server 2025 on the new server or virtual machine. Do not overwrite or upgrade your existing domain controller. Keep the old DC running while you configure and test the new Server 2025 domain controller.
Need installation help? See Brytesoft's Windows Server 2025 installation and activation guide.
- Install current Windows updates.
- Configure a static IP address.
- Configure DNS so the server can resolve the existing AD domain.
- Confirm connectivity to the current domain controller.
- Assign a clear hostname such as
DC2025-01. - Join the machine to the existing domain.
- Restart the server.
Step 6: Install Active Directory Domain Services
- Open Server Manager.
- Select Manage → Add Roles and Features.
- Choose Role-based or feature-based installation.
- Select the new Server 2025 machine.
- Select Active Directory Domain Services.
- Add the required management features when prompted.
- Complete the installation.
Installing the role does not yet make the server a domain controller. After installation, Server Manager offers the option to promote this server to a domain controller.
Step 7: Promote Server 2025 to an Additional Domain Controller
Choose Add a domain controller to an existing domain. Do not create a new forest if the goal is to migrate the existing domain.
- DNS Server
- Global Catalog
- Active Directory site
- Directory Services Restore Mode password
Step 8: Verify the Windows Server 2025 Domain Controller
Do not immediately shut down the old DC. First, prove that the new one works.
dcdiagrepadmin /replsummaryGet-ADDomainController -Filter *- Active Directory Users and Computers opens normally
- DNS zones and required records are present
- SYSVOL and NETLOGON are available
- Group Policy objects are present
- Replication is healthy
- User authentication works
- Event logs do not show significant AD DS, DFSR, or DNS errors
Step 9: Find the Current FSMO Role Holders
Active Directory uses five special Flexible Single Master Operations roles: Schema Master, Domain Naming Master, PDC Emulator, RID Master, and Infrastructure Master.
netdom query fsmoStep 10: Transfer FSMO Roles to Windows Server 2025
Once the new DC is healthy, transfer the roles that should reside on it. For a straightforward small-business migration where the older DC is being retired, this often means moving all five roles to the Server 2025 DC.
Move-ADDirectoryServerOperationMasterRole `
-Identity "DC2025-01" `
-OperationMasterRole SchemaMaster,DomainNamingMaster,PDCEmulator,RIDMaster,InfrastructureMasternetdom query fsmoStep 11: Check DNS Before Retiring the Old DC
If the new Server 2025 DC also provides DNS, confirm that DNS is functioning correctly before demotion.
- Active Directory-integrated DNS zones
- SRV records
- Forwarders
- Domain-controller records
- DNS client settings
- Static DNS settings on servers
- DHCP DNS options
Step 12: Migrate DHCP and Other Server Roles Separately
A domain controller may be wearing several hats. Active Directory replication does not automatically migrate DHCP, file shares, printers, certificate services, applications, scripts, or scheduled tasks.
| Dependency | Migration note |
|---|---|
| DHCP | Separate Windows Server role. Export/import or migrate it separately before the old DC is retired. |
| File shares | Files and share permissions do not move merely because a new DC is promoted. |
| Applications | Check for old DC hostnames, IP addresses, LDAP endpoints, service accounts, and hard-coded configuration. |
| Certificates / services | Review certificate services, scheduled tasks, scripts, monitoring, and security agents independently. |
Step 13: Test Real User Authentication
- Sign in to a domain workstation.
- Restart a workstation and sign in again.
- Access network resources.
- Apply Group Policy.
- Resolve internal DNS records.
- Test important business software.
- Test VPN authentication where relevant.
- Test systems that depend on LDAP or Active Directory.
If the business operates across multiple offices, networks, or Active Directory sites, test from those locations too.
Step 14: Demote the Old Domain Controller
Only demote the old DC after the new Server 2025 domain controller and every relevant dependency have been validated.
| Requirement | Done |
|---|---|
| Replication healthy | ☐ |
| New DC functioning correctly | ☐ |
| DNS working | ☐ |
| SYSVOL available | ☐ |
| NETLOGON available | ☐ |
| Required FSMO roles moved | ☐ |
| Global Catalog coverage adequate | ☐ |
| DHCP addressed | ☐ |
| Application dependencies checked | ☐ |
| Clients no longer rely exclusively on old DNS | ☐ |
| Backups current | ☐ |
| Real-world authentication tested | ☐ |
dcdiagrepadmin /replsummaryStep 15: Should You Raise the Functional Level to Windows Server 2025?
Not immediately. A staged migration lets Server 2025 coexist with older supported domain controllers while you validate the environment. Treat a functional-level increase as a separate change after older DCs have been retired and the environment is stable.
Extra Checks When Migrating From Windows Server 2016
Windows Server 2016 deserves separate attention because older environments have had more time to accumulate legacy configuration and combined server roles.
Check the actual functional level
A Server 2016 domain controller does not automatically mean the domain itself is operating at the Server 2016 functional level.
Check SYSVOL
Confirm SYSVOL replication is healthy and uses the supported replication technology for your environment.
Check old applications
Legacy applications may rely on older LDAP behavior, specific server names, specific IP addresses, or services installed directly on the DC.
Check how many jobs the old server performs
Small businesses often run DNS, DHCP, file sharing, printing, and applications on the same machine. Moving Active Directory does not move these workloads automatically.
Including Server 2016 also expands long-tail search coverage while keeping this article focused on Active Directory migration rather than the generic Windows Server in-place upgrade terms already owned by the existing upgrade guide.
Windows Server 2025 Standard or Datacenter for a Domain Controller?
You do not need Datacenter simply because the server is a domain controller. Base the edition choice mainly on the wider server environment, virtualization density, and required edition-specific features.
| Standard | Datacenter | |
|---|---|---|
| Typical environment | Physical or lightly virtualized | Highly virtualized |
| Domain controller role | Supported | Supported |
| Typical small-business fit | Often | When virtualization density or Datacenter features justify it |
Review Windows Server 2025 Standard, Windows Server 2025 Datacenter, or the Windows Server 2025 Standard vs Datacenter guide before deployment.
Windows Server 2025 Licensing and CAL Considerations
Migrating Active Directory does not remove Windows Server licensing requirements. Your new deployment still needs the appropriate Windows Server license for the hardware and environment, and applicable users or devices may also require Windows Server CALs. Remote Desktop Services CALs are a separate consideration for full RDS deployments.
For more detail, see Brytesoft's Windows Server 2025 licensing, pricing and CAL guide or browse the Windows Server range.
Common Windows Server 2025 Domain Controller Migration Mistakes
1. Migrating an unhealthy Active Directory
Fix existing replication, DNS, and SYSVOL problems first.
2. Treating a DC like an ordinary server upgrade
Use the domain-controller migration path rather than a generic in-place procedure.
3. Demoting the old DC too quickly
Allow time to validate the new server properly.
4. Forgetting DNS
Verify zones, records, clients, and DHCP DNS settings.
5. Assuming FSMO roles moved where you wanted
Check and transfer role holders deliberately.
6. Forgetting DHCP
DHCP migration is a separate task.
7. Raising the functional level during the same change window
Stabilize the DC migration first.
8. Seizing FSMO roles during a healthy migration
Use graceful transfer when the old role holder is available.
9. Turning off the old DC instead of demoting it
Use the supported demotion process.
Windows Server 2025 Domain Controller Migration Checklist
Before Migration
| Requirement | Done |
|---|---|
| Existing DCs documented | ☐ |
| FSMO role holders identified | ☐ |
| Global Catalog servers identified | ☐ |
| Domain functional level checked | ☐ |
| Forest functional level checked | ☐ |
| SYSVOL replication checked | ☐ |
| dcdiag reviewed | ☐ |
| replication reviewed | ☐ |
| DNS checked | ☐ |
| backups verified | ☐ |
| Dependent applications identified | ☐ |
New Windows Server 2025 DC
| Requirement | Done |
|---|---|
| Clean Server 2025 installation completed | ☐ |
| Current updates installed | ☐ |
| Static IP configured | ☐ |
| Joined to domain | ☐ |
| AD DS role installed | ☐ |
| Promoted successfully | ☐ |
| DNS verified | ☐ |
| SYSVOL verified | ☐ |
| NETLOGON verified | ☐ |
| replication verified | ☐ |
| authentication tested | ☐ |
Before Demoting the Old DC
| Requirement | Done |
|---|---|
| FSMO roles transferred where required | ☐ |
| DNS clients updated | ☐ |
| DHCP addressed | ☐ |
| Application dependencies checked | ☐ |
| Global Catalog coverage confirmed | ☐ |
| replication healthy | ☐ |
| User sign-in tested | ☐ |
| Business applications tested | ☐ |
After Demotion
| Requirement | Done |
|---|---|
| Old DC removed cleanly | ☐ |
| DNS checked again | ☐ |
| Replication checked again | ☐ |
| authentication retested | ☐ |
| Event logs reviewed | ☐ |
| Backup jobs updated | ☐ |
| monitoring updated | ☐ |
| documentation updated | ☐ |
| Functional-level upgrade considered separately | ☐ |
Final Recommendation
A Windows Server 2025 domain controller migration is not really about replacing one operating system with another. It is about moving responsibility safely from one server to another.
Use this sequence: Check → Back Up → Build → Promote → Replicate → Verify → Transfer → Test → Demote.
Keeping the existing domain controller online while Server 2025 is introduced gives you time to confirm that Active Directory, DNS, Group Policy, authentication, and business applications are operating correctly before the older server is retired.
If you are still deciding whether Server 2025 is right for your infrastructure, compare Windows Server 2022 and Windows Server 2025 or explore Brytesoft's Windows Server 2025 options before deployment.
FAQ About How to Migrate a Domain Controller to Windows Server 2025
Can I migrate a Windows Server 2016 domain controller directly to Windows Server 2025?
Yes, provided the existing Active Directory environment meets the current Windows Server 2025 prerequisites. Check functional levels, Active Directory health, SYSVOL replication, applications, and backups before starting.
Can Windows Server 2019 and Windows Server 2025 domain controllers coexist?
Yes, they can coexist during a phased migration when the Active Directory environment meets the required functional-level and compatibility conditions.
Can Server 2022 and Server 2025 domain controllers coexist?
Yes. A staged migration can keep the older DC online while Server 2025 is promoted and tested.
Should I in-place upgrade a domain controller to Windows Server 2025?
For this guide, use the side-by-side domain-controller migration approach: clean-install Server 2025, promote it, verify it, transfer roles, and then demote the older DC.
Do FSMO roles move automatically?
Do not assume the desired role placement will happen automatically. Identify existing role holders and transfer roles deliberately.
What happens to my Active Directory users and computers?
When replication is healthy, Active Directory objects such as users, groups, computers, and organizational units replicate to the new DC. You do not recreate all users manually.
Will Group Policy migrate?
Group Policy information stored in Active Directory and SYSVOL should replicate to healthy domain controllers. Verify both before retirement of the old DC.
Does DNS move automatically?
Active Directory-integrated zones can replicate to another DNS-enabled DC, but you still need to verify zones, records, forwarders, and client DNS settings.
Does DHCP migrate automatically?
No. DHCP is a separate server role and needs its own migration process.
Can I reuse the old domain controller's IP address?
It may be possible in some designs, but using a new static IP and deliberately updating dependencies is usually easier to validate. Reusing an old DC address should be planned carefully.
When should I raise the functional level to Windows Server 2025?
Consider it only after older domain controllers have been retired and the environment is stable. Treat it as a separate controlled change.
What should I do if dcdiag or repadmin reports errors?
Investigate and resolve the errors before demoting a functioning domain controller. Replication, DNS, and SYSVOL problems are safer to diagnose while the original environment remains available.
