Moving domain controllers from Windows Server 2016 or 2019 to 2025: in-place or side-by-side?
Prefer a new Windows Server 2025 domain controller, replication validation, FSMO transfer and controlled demotion of the old DC rather than defaulting to in-place upgrade.
Prefer a new Windows Server 2025 domain controller, replication validation, FSMO transfer and controlled demotion of the old DC rather than defaulting to in-place upgrade. For this case, first verify new Windows Server 2025 domain controller and AD/DNS replication health, then use FSMO roles to decide whether remediation is needed.
Why migrate now
For this server and database case, establish the failure boundary with Server 2025 and AD/DNS replication health, then continue to FSMO. Capture the current state, incident time and one known-good comparison before changing production configuration.
Pre-migration dependency inventory
| Check | Why it matters | Recommended action |
|---|---|---|
| 01 · new Windows Server 2025 domain controller | Verify new Windows Server 2025 domain controller on the affected path using logs, counters or state information rather than relying only on the configured rule. | Record the current value, evidence source and timestamp for new Windows Server 2025 domain controller. If adjustment is required, change one condition only and retain the original setting for rollback. |
| 02 · AD/DNS replication health | Verify AD/DNS replication health on the affected path using logs, counters or state information rather than relying only on the configured rule. | Check AD/DNS replication health read-only and save the result. If it differs from the baseline, correlate it with the incident time and recent changes before remediation. |
| 03 · FSMO roles | Verify FSMO roles on the affected path using logs, counters or state information rather than relying only on the configured rule. | Compare FSMO roles with a known-good peer, the log timeline and the real application path; confirm whether it is causal before changing production. |
| 04 · SYSVOL/NETLOGON | Review the current state, related logs and recent changes for SYSVOL/NETLOGON, then align them with the incident timeline before deciding whether a change is required. | Record the current value, evidence source and timestamp for SYSVOL/NETLOGON. If adjustment is required, change one condition only and retain the original setting for rollback. |
| 05 · demotion of legacy domain controllers | Review the current state, related logs and recent changes for demotion of legacy domain controllers, then align them with the incident timeline before deciding whether a change is required. | Check demotion of legacy domain controllers read-only and save the result. If it differs from the baseline, correlate it with the incident time and recent changes before remediation. |
| 06 · in-place upgrade risk | Review the current state, related logs and recent changes for in-place upgrade risk, then align them with the incident timeline before deciding whether a change is required. | Compare in-place upgrade risk with a known-good peer, the log timeline and the real application path; confirm whether it is causal before changing production. |
Recommended migration path
- Start with read-only evidence. Check new Windows Server 2025 domain controller and AD/DNS replication health before changing configuration.
- If the first checks are normal, continue with FSMO roles and SYSVOL/NETLOGON, keeping evidence tied to the incident time.
- Change configuration only when the evidence explains the symptom. For demotion of legacy domain controllers, preserve the original value and define the rollback trigger before adjustment.
- Validate in-place upgrade risk in a controlled scope before expanding to production users or traffic.
Cutover window
- Validate the complete user or application workflow; do not stop at the single status of new Windows Server 2025 domain controller.
- Recheck demotion of legacy domain controllers and in-place upgrade risk after the change and confirm that no new bypass, permission expansion or secondary error has appeared.
- Archive evidence from new Windows Server 2025 domain controller through in-place upgrade risk, together with before/after configuration, business validation and the rollback point.
Validation and rollback
- Changing Server 2025 and AD/DNS replication health at the same time, which makes the original cause impossible to prove.
- Treating a normal result for FSMO as proof that SYSVOL/NETLOGON and the rest of the business path are healthy.
- Leaving a temporary exception related to demotion of legacy domain controllers or in-place upgrade risk in production without an owner, expiry time and rollback note.
Related questions
Where should I start with “Moving domain controllers from Windows Server 2016 or 2019 to 2025: in-place or side-by-side?”?
Start with new Windows Server 2025 domain controller and AD/DNS replication health; they establish the first useful troubleshooting boundary without changing production state.
What should be checked after the first layer looks normal?
Continue with FSMO roles and SYSVOL/NETLOGON, then correlate the result with the incident time and the actual user or application path.
What should be retained after the change?
Keep evidence for demotion of legacy domain controllers and in-place upgrade risk, plus the original configuration, validation result, observation notes and rollback point.