Active Directory and Group PolicyNew in this releasePublished 20 July 2026

Moving domain controllers from Windows Server 2016 or 2019 to 2025: in-place or side-by-side?

Prefer a new Windows Server 2025 domain controller, replication validation, FSMO transfer and controlled demotion of the old DC rather than defaulting to in-place upgrade.

Control risk before changing productionValidate first in a test environment or on one representative system, and preserve configuration, logs and recoverable backups. Production cutovers, bulk policy changes, database repair and storage rebuild require a maintenance window and explicit rollback criteria.

1. Conclusion and scope

A domain controller provides more than user accounts: DNS, Kerberos, Group Policy, SYSVOL, time and many application-authentication paths depend on it. Side-by-side migration keeps the old DC available for rollback and allows replication and client behaviour to be proven before retirement.

This issue involves Active Directory, DNS, Group Policy, authentication and domain-controller health. Validate replication, backup and scope before change.

2. Risk signals that deserve priority

The current DC also hosts DHCP, file services, certificate services or third-party applications, with unclear role boundaries.
AD replication, DNS, SYSVOL or the event logs already contain unresolved errors.

3. Pre-change assessment checklist

Run dcdiag, repadmin, DNS and SYSVOL checks and repair the current directory before migration.
Confirm forest and domain functional levels, DFSR status, FSMO roles, sites and subnets, time source and system-state backup.
Identify applications with hard-coded DC IP addresses, LDAP servers, DNS resolvers or NTP sources.
Assess how Windows Server 2025 security defaults affect old SMB, LDAP, TLS and administration tools.

Read-only checks and validation examples

dcdiag /e /v
repadmin /replsummary
repadmin /showrepl * /csv
netdom query fsmo

corp.example, 192.0.2.0/24 and 203.0.113.0/24 are documentation-only examples. Replace them only after the actual environment values have been verified.

4. Recommended implementation sequence

Build a new server with a fixed IP, join the domain, install AD DS and DNS, and promote it as an additional DC.
Wait for and validate complete AD, DNS and SYSVOL replication before changing DNS client order and site configuration.
Transfer FSMO roles, configure the PDC time source, then observe sign-in, GPO, application authentication and event logs.
After all dependencies are removed, demote the old DC and clean DNS, Sites and Services, DHCP and monitoring records.

Remote assessment or on-site work?Logs, configuration and a small number of systems can usually be assessed remotely. Physical servers, storage, data-centre power, bulk cutover and recovery exercises should use a controlled on-site window. On-site service is available for Zhejiang, Shanghai and Jiangsu; other locations can be supported remotely.

5. Validation, rollback and common mistakes

repadmin /replsummary shows no persistent errors and critical dcdiag tests pass.
SYSVOL, NETLOGON, DNS zones, GPO and password changes replicate between DCs.
After restart, clients use the new DNS and DC for sign-in and application authentication.

Common mistakes

Migrating while replication is already unhealthy.
Powering off the old DC as a test before FSMO and dependencies are transferred.
Cloning a virtual DC disk to create the new controller.

Official references

Microsoft: What is new in Windows Server 2025

Frequently asked questions

Is an in-place DC upgrade unsupported?

Some paths may be supported, but side-by-side migration usually provides better rollback, validation and role cleanup.

Can old and new DCs run together?

Yes. The coexistence period is essential for validating replication, DNS, authentication and application dependencies.

Need an assessment based on the actual environment?

Provide versions, topology, complete errors, event-log timestamps, scope of impact, recent changes and actions already taken. We will first determine risk, service boundary and rollback, then confirm the implementation scope.