Move domain controllers in "sites&services"

---

Hi!

We are planning to move two of our domain controllers to one of our other sites. And I am wondering how this will effect on clients who has validate themself thrue one of these domain controllers to login.
When we move the domain controllers will the clients lose their session and have to login again? Or is the move itself harmless? Is there anything special we have to think about when moving a DC to another site?

P.S Thanks for a wonderful site, ITpro.tv have really learnt me alote. And sorry for my bad english.

//Daniel

Hi Daniel,

Moving the domain controllers to a different site won't cause any issues, as long as the clients can still contact a domain controller. If not, you will need to ensure clients can contact a domain controller.

You will also have to move the domain controllers to the appropriate site using the Active Directory Sites and Services console.

You can also use PowerShell cmdlet Move-ADDirectoryServer
https://docs.microsoft.com/en-us/powershell/module/addsadministration/move-addirectoryserver?view=win10-ps

Thanks for the great answer Mike!
Just one follow up question, after the move, we are going to have domain controllers with the same IP subnet on two different Sites.
Can this cause any problems? And would it best practice to change the IP for the domain controllers that is in the site that wont be having their subnet?

//Daniel

@Daniel-Östlund,

When you talk about sites, are you referring to just physical location or an actual site defined in Active Directory? It is not possible to have a subnet span to different sites in Active Directory Sites and Services. Sites are defined by subnet addresses. If a site defined in Active Directory has a subnet that spans multiple physical locations, this will defeat the purpose of sites.

Changing the IP address of a domain controller is possible, but I have seen a lot of issues when this is done. Is there a specific reason you are moving the domain controllers?

Assuming these are not the only domain controllers, the best practice would be to remove the AD role from the domain controllers you want to move. Once they are no longer domain controllers, you can move them to the new location, and change their IP address if necessary. Then you can add the AD role back. You would need to check if they hold any operations master roles and move the roles if they do, before you demote them.

Let me know if this helps, or if you have more questions!

It is an actual site defined in Active Directory. I´m not sure why they have set it up with two sites when all the servers we have are seperated in two hostcenters that are local. This was done before I began here and there is no documentation.

Well the reason is, and I shall try to explain as best I can. Site nr2 has today no DC under it. But there is several subnets that is linked to it. One of these subnets is our Exchange servers on. And now our exchange department cant upgrade Exchange CU because there is no DC under that site that have the schema master roll.
We at AD wanted at first just move the subnet to the site that host the domain controller who has the Schema role. But our guys that handle Exchange told us that Exchange could not handle the move of subnet so we had to move a domain controller and the schema role instead.

I hope that clarify it.

@Daniel-Östlund ,

Ugh, Exchange, lol.

It makes sense. I would recommend removing AD from one of the servers, moving and reconfiguring it, and then installing AD again. You would need to wait for (or force) replication between removing and installing. This would give you the opportunity to do whatever you needed to the server (change the IP address, rename, etc) without affecting AD.

Years ago, you weren't allowed to change the IP address on a domain controller. Then, in Server 2008 I think, Microsoft said you could. I have tried it, and most things work. But there are some things that just seem to fail. DNS records get updated, SRV records, etc., but I have had weird issues, like time sync issues, after changing a DCs IP address.

So even though Microsoft supports it, it doesn't seem like it's worth the risk to me. Especially when it is so easy to just remove AD, and then add AD once the move is complete.

The schema master role is forest-wide, meaning there is only one DC in the entire forest that holds the schema master role. If you are trying to move the DC that holds that role, you would need to move the role to another DC, (and any other roles), remove AD, move the server and reconfigure, then add AD, then move the role to the new DC.