Upgrade Domain Controllers to Windows Server 2012 R2 and Windows Server 2012

Applies To: Windows Server 2012 R2, Windows Server 2012

This topic provides background information about Active Directory Domain Services in Windows Server 2012 R2 and Windows Server 2012 and explains the process for upgrading domain controllers from Windows Server 2008 or Windows Server 2008 R2.

• Domain controller upgrade steps

• What's new in Windows Server 2012?

• What’s new in AD DS in Windows Server 2012 R2?

• What’s new in AD DS in Windows Server 2012?

• AD DS server role installation changes

• Deprecated features and behavior changes related to AD DS in Windows Server 2012

• Operating system requirements

• Supported in-place upgrade paths

• Functional level features and requirements

• AD DS interoperability with other server roles and Windows operating systems

• Operations master roles

• Virtualizing domain controllers

• Administration of Windows Server 2012 servers

• Application compatibility

• Known issues

Domain controller upgrade steps

The recommended way to upgrade a domain is to promote domain controllers that run newer versions of Windows Server and demote older domain controllers as needed. That method is preferable to upgrading the operating system of an existing domain controller. This list covers general steps to follow before you promote a domain controller that runs a nnewer version of Windows Server:

1. Verify the target server meets system requirements.

2. Verify Application compatibility.

3. Verify security settings. For more information, see Deprecated features and behavior changes related to AD DS in Windows Server 2012 and Secure default settings in Windows Server 2008 and Windows Server 2008 R2.

4. Check connectivity to the target server from the computer where you plan to run the installation.

5. Check for availability of necessary operation master roles:

   • To install the first DC that runs Windows Server 2012 in an existing domain and forest, the machine where you run the installation needs connectivity to the schema master in order to run adprep /forestprep and the infrastructure master in order to run adprep /domainprep.

   • To install the first DC in a domain where the forest schema is already extended, you only need connectivity to infrastructure master.

   • To install or remove a domain in an existing forest, you need connectivity to the domain naming master.

   • Any domain controller installation also requires connectivity to the RID master.

   • If you are installing the first read-only domain controller in an existing forest, you need connectivity to the infrastructure master for each application directory partition, also known as a non-domain naming context or NDNC.

6. Be sure to supply the necessary credentials to run the AD DS installation.

   Installation action	Credential requirements
   Install a new forest	Local Administrator on the target server
   Install a new domain in an existing forest	Enterprise Admins
   Install an additional DC in an existing domain	Domain Admins
   Run adprep /forestprep	Schema Admins, Enterprise Admins, and Domain Admins
   Run adprep /domainprep	Domain Admins
   Run adprep /domainprep /gpprep	Domain Admins
   Run adprep /rodcprep	Enterprise Admins

   You can delegate permissions to install AD DS. For more information, see Installation Management Tasks.

Steps-by-step instructions to promote new and replica Windows Server 2012 domain controllers using Windows PowerShell cmdlets and Server Manager can be found in the following links:

• Install Active Directory Domain Services (Level 100)

• Install a New Windows Server 2012 Active Directory Forest (Level 200)

• Install a Replica Windows Server 2012 Domain Controller in an Existing Domain (Level 200)

• Install a New Windows Server 2012 Active Directory Child or Tree Domain (Level 200)

• Install a Windows Server 2012 Active Directory Read-Only Domain Controller (RODC) (Level 200)

• Step-by-Step Guide for Setting Up Windows Server 2012 Domain Controller (en-US)

What's new in Windows Server 2012?

New features listed by server role and technology area are listed in the following table. For more whitepapers, video demonstrations, and presentations about other features in Windows Server 2012, see Server and Cloud Platform.

Automatic Maintenance and changes to restart behavior after updates are applied by Windows Update

Prior to the release of Windows 8, Windows Update managed its own internal schedule to check for updates, and to download and install them. It required that the Windows Update Agent was always running in the background, consuming memory and other system resources.

Windows 8 and Windows Server 2012 introduce a new feature called Automatic Maintenance. Automatic Maintenance consolidates many different features that each used to manage its own scheduling and execution logic. This consolidation allows for all these components to use far less system resources, work consistently, respect the new Connected Standby state for new device types, and consume less battery on portable devices.

Because Windows Update is a part of Automatic Maintenance in Windows 8 and Windows Server 2012, its own internal schedule for setting a day and time to install updates is no longer effective. To help ensure consistent and predictable restart behavior for all devices and computers in your enterprise, including those that run Windows 8 and Windows Server 2012, see Microsoft KB article 2885694 (or see October 2013 cumulative rollup 2883201), then configure policy settings described in the WSUS blog post Enabling a more predictable Windows Update experience for Windows 8 and Windows Server 2012 (KB 2885694).

What’s new in AD DS in Windows Server 2012 R2?

The following table summarizes new features for AD DS in Windows Server 2012 R2, with a link to more detailed information where it is available. For a more detailed explanation of some features, including their requirements, see What's New in Active Directory in Windows Server 2012 R2.

What’s new in AD DS in Windows Server 2012?

The following table summarizes the new features for AD DS in Windows Server 2012, with a link to more detailed information where it is available. For a more detailed explanation of some features, including their requirements, see What’s New in Active Directory Domain Services (AD DS).

Automatic Maintenance and changes to restart behavior after updates are applied by Windows Update

Prior to the release of Windows 8, Windows Update managed its own internal schedule to check for updates, and to download and install them. It required that the Windows Update Agent was always running in the background, consuming memory and other system resources.

Windows 8 and Windows Server 2012 introduce a new feature called Automatic Maintenance. Automatic Maintenance consolidates many different features that each used to manage its own scheduling and execution logic. This consolidation allows for all these components to use far less system resources, work consistently, respect the new Connected Standby state for new device types, and consume less battery on portable devices.

Because Windows Update is a part of Automatic Maintenance in Windows 8 and Windows Server 2012, its own internal schedule for setting a day and time to install updates is no longer effective. To help ensure consistent and predictable restart behavior for all devices and computers in your enterprise, including those that run Windows 8 and Windows Server 2012, you can configure the following Group Policy settings:

• Computer Configuration|Policies|Administrative Templates|Windows Components|Windows Update|Configure Automatic Updates

• Computer Configuration|Policies|Administrative Templates|Windows Components|Windows Update|No auto-restart with logged on users

• Computer Configuration|Policies|Administrative Templates|Windows Components|Maintenance Scheduler|Maintenance Random Delay

The following table lists some examples of how to configure these settings to provide desired restart behavior.

For more information about why the Windows engineering team implemented these changes, see Minimizing restarts after automatic updating in Windows Update.

AD DS server role installation changes

In Windows Server 2003 through Windows Server 2008 R2, you ran the x86 or X64 version of the Adprep.exe command-line tool before running the Active Directory Installation Wizard, Dcpromo.exe, and Dcpromo.exe had optional variants to install from media or for unattended installation.

Beginning in Windows Server 2012, command-line installations are performed by using the ADDSDeployment Module in Windows PowerShell. GUI-based promotions are performed in Server Manager using a completely new AD DS Configuration Wizard. To simplify the installation process, ADPREP has been integrated into the AD DS installation and runs automatically as needed. The Windows PowerShell–based AD DS Configuration Wizard automatically targets the schema and infrastructure master roles in the domains where DCs are being added, then remotely runs the required ADPREP commands on the relevant domain controllers.

Prerequisite checks in the AD DS Installation Wizard identify potential errors before the installation begins. Error conditions can be corrected to eliminate concerns from a partially complete upgrade. The wizard also exports a Windows PowerShell script that contains all the options that were specified during the graphical installation.

Taken together, the AD DS installation changes simplify the DC role installation process and reduce the likelihood of administrative errors, especially when you are deploying multiple domain controllers across global regions and domains. More detailed information on GUI and Windows PowerShell-based installations, including command line syntax and step-by-step wizard instructions, see Install Active Directory Domain Services. For administrators that want to control the introduction of schema changes in an Active Directory forest independent of the installation of Windows Server 2012 DCs in an existing forest, Adprep.exe commands can still be run at an elevated command prompt.

Deprecated features and behavior changes related to AD DS in Windows Server 2012

There are some changes related to AD DS:

• Deprecation of Adprep32.exe

  There is only one version of Adprep.exe and it can be run as needed on 64-bit servers that run Windows Server 2008 or later. It can be run remotely, and must be run remotely if that targeted operations master role is hosted on a 32-bit operating system or Windows Server 2003.

• Deprecation of Dcpromo.exe

  Dcpromo is deprecated although in Windows Server 2012 only it can still be run with an answer file or command line parameters to give organizations time to transition existing automation to the new Windows PowerShell installation options.

• LMHash is disabled on user accounts

  Secure defaults in Security templates on Windows Server 2008, Windows Server 2008 R2 and Windows Server 2012 enable the NoLMHash policy which is disabled in the security templates of Windows 2000 and Windows Server 2003 domain controllers. Disable the NoLMHash policy for LMHash-dependent clients as required, using the steps in KB article 946405.

Beginning with Windows Server 2008, domain controllers also have the following secure default settings, compared to domain controllers that run Windows Server 2003 or Windows 2000.

Operating system requirements

The minimum system requirements for Windows Server 2012 are listed in the following table. For more information about system requirements and pre-installation information, see Installing Windows Server 2012. There are no additional system requirements to install a new Active Directory forest, but you should add sufficient memory to cache the contents of Active Directory database in order to improve performance for domain controllers, LDAP client requests, and Active Directory-enabled applications. If you are upgrading an existing domain controller or adding a new domain controller to an existing forest, review the next section to ensure the server meets disk space requirements.

Disk space requirements for upgrading domain controllers

This section covers disk space requirements only for upgrading domain controllers from Windows Server 2008 or Windows Server 2008 R2. For more information about disk space requirements for upgrading domain controllers to earlier versions of Windows Server, see Disk space requirements for upgrading to Windows Server 2008 or Disk space requirements for upgrading to Windows Server 2008 R2.

Size the disk that hosts the Active Directory database and log files in order to accommodate the custom and application-driven schema extensions, application and administrator-initiated indexes, plus space for the objects and attributes that you will be added to the directory over deployment life of the domain controller (typically 5 to 8 years). Right sizing at deployment time is typically a good investment compared to greater touch costs required to expand disk storage after deployment. For more information, see Capacity Planning for Active Directory Domain Services.

On domain controllers that you plan to upgrade, make sure that the drive that hosts the Active Directory database (NTDS.DIT) has free disk space that represents at least 20% of the NTDS.DIT file before you begin the operating system upgrade. If there is insufficient free disk space on the volume, the upgrade can fail and the upgrade compatibility report returns an error indicating insufficient free disk space:

In this case, you can try an offline defragmentation of the Active Directory database to recapture additional space, and then retry the upgrade. For more information, see Compact the Directory Database File (Offline Defragmentation).

Available SKUs

There are 4 editions of Windows Server: Foundation, Essentials, Standard and Datacenter. The two editions that support the AD DS role are Standard and Datacenter.

In previous releases, Windows Server editions differed in their support of server roles, processor counts and large memory support. The Standard and Datacenter editions of Windows Server support all features and underlying hardware but vary in their virtualization rights – two virtual instances are allowed for Standard edition and unlimited virtual instances are allowed for Datacenter edition.

Windows client and Windows Server operating systems that are supported to join Windows Server domains

The following Windows client and Windows Server operating systems are supported for domain member computers with domain controllers that run Windows Server 2012 or later:

• Client operating systems: Windows 8.1, Windows 8, Windows 7, Windows Vista, Windows XP

  Computers that run Windows 8.1 or Windows 8 are also able to join domains that have domain controllers that run earlier version of Windows Server, including Windows Server 2003 or later. In this case however, some Windows 8 features may require additional configuration or may not be available. For more information about those features and other recommendations for managing Windows 8 clients in downlevel domains, see Running Windows 8 member computers in Windows Server 2003 domains.

• Server operating systems: Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, Windows Server 2003 R2, Windows Server 2003

Supported in-place upgrade paths

Domain controllers that run 64-bit versions of Windows Server 2008 or Windows Server 2008 R2 can be upgraded to Windows Server 2012. You cannot upgrade domain controllers that run Windows Server 2003 or 32-bit versions of Windows Server 2008. To replace them, install domain controllers that run a later version of Windows Server in the domain, and then remove the domain controllers that Windows Server 2003.

For more information about supported upgrade paths, see Evaluation Versions and Upgrade Options for Windows Server 2012. Note that you cannot convert a domain controller that runs an evaluation version of Windows Server 2012 directly to a retail version. Instead, install an additional domain controller on a server that runs a retail version and remove AD DS from the domain controller that runs on the evaluation version.

Due to a known issue, you cannot upgrade a domain controller that runs a Server Core installation of Windows Server 2008 R2 to a Server Core installation of Windows Server 2012. The upgrade will hang on a solid black screen late in the upgrade process. Rebooting such DCs exposes an option in boot.ini file to roll back to the previous operating system version. An additional reboot triggers the automatic rollback to the previous operating system version. Until a solution is available, it is recommended that you install a new domain controller running a Server Core installation of Windows Server 2012 instead of in-place upgrading an existing domain controller that runs a Server Core installation of Windows Server 2008 R2. For more information, see KB article 2734222.

Functional level features and requirements

Windows Server 2012 requires a Windows Server 2003 forest functional level. That is, before you can add a domain controller that runs Windows Server 2012 to an existing Active Directory forest, the forest functional level must be Windows Server 2003 or higher. This means that domain controllers that run Windows Server 2008 R2, Windows Server 2008, or Windows Server 2003 can operate in the same forest, but domain controllers that run Windows 2000 Server are not supported and will block installation of a domain controller that runs Windows Server 2012. If the forest contains domain controllers running Windows Server 2003 or later but the forest functional level is still Windows 2000, the installation is also blocked.

Windows 2000 domain controllers must be removed prior to adding Windows Server 2012 domain controllers to your forest. In this case, consider the following workflow:

1. Install domain controllers that run Windows Server 2003 or later. These domain controllers can be deployed on an evaluation version of Windows Server. This step also requires running adprep.exe for that operating system release as a prerequisite.

2. Remove the Windows 2000 domain controllers. Specifically, gracefully demote or forcibly remove Windows Server 2000 domain controllers from the domain and used Active Directory Users and Computers to remove the domain controller accounts for all removed domain controllers.

3. Raise the forest functional level to Windows Server 2003 or higher.

4. Install domain controllers that run Windows Server 2012.

5. Remove domain controllers that run earlier versions of Windows Server.

The new Windows Server 2012 domain functional level enables one new feature: the KDC support for claims, compound authentication, and Kerberos armoring KDC administrative template policy has two settings (Always provide claims and Fail unarmored authentication requests) that require Windows Server 2012 domain functional level. For more information, see Support for claims, compound authentication, and Kerberos armoring.

The Windows Server 2012 forest functional level does not provide any new features, but it ensures that any new domain created in the forest will automatically operate at the Windows Server 2012 domain functional level. The Windows Server 2012 domain functional level does not provide other new features beyond KDC support for claims, compound authentication, and Kerberos armoring. But it ensures that any domain controller in the domain runs Windows Server 2012. For more information about other features that are available at different functional levels, see Understanding Active Directory Domain Services (AD DS) Functional Levels.

After you set the forest functional level to a certain value, you cannot roll back or lower the forest functional level, with the following exceptions: after you raise the forest functional level to Windows Server 2012, you can lower it to Windows Server 2008 R2. If Active Directory Recycle Bin has not been enabled, you can also lower the forest functional level from Windows Server 2012 to Windows Server 2008 R2 or Windows Server 2008 or from Windows Server 2008 R2 back to Windows Server 2008. If the forest functional level is set to Windows Server 2008 R2, it cannot be rolled back, for example, to Windows Server 2003.

After you set the domain functional level to a certain value, you cannot roll back or lower the domain functional level, with the following exceptions: when you raise the domain functional level to Windows Server 2008 R2 or Windows Server 2012, and if the forest functional level is Windows Server 2008 or lower, you have the option of rolling the domain functional level back to Windows Server 2008 or Windows Server 2008 R2. You can lower the domain functional level only from Windows Server 2012 to Windows Server 2008 R2 or Windows Server 2008 or from Windows Server 2008 R2 to Windows Server 2008. If the domain functional level is set to Windows Server 2008 R2, it cannot be rolled back, for example, to Windows Server 2003.

For more information about features that are available at lower functional levels, see Understanding Active Directory Domain Services (AD DS) Functional Levels.

Beyond functional levels, a domain controller that runs Windows Server 2012 provides additional features that are not available on a domain controller that runs an earlier version of Windows Server. For example, a domain controller that runs Windows Server 2012 can be used for virtual domain controller cloning, whereas a domain controller that runs an earlier version of Windows Server cannot. But virtual domain controller cloning and virtual domain controller safeguards in Windows Server 2012 do not have any functional level requirements.

AD DS interoperability with other server roles and Windows operating systems

AD DS is not supported on the following Windows operating systems:

• Windows MultiPoint Server

• Windows Server 2012 Essentials

AD DS cannot be installed on a server that also runs the following server roles or role services:

• Hyper-V Server

• Remote Desktop Connection Broker

Operations master roles

Some new features in Windows Server 2012 affect operations master roles:

• The PDC emulator must be running Windows Server 2012 to support cloning virtual domain controllers. There are additional prerequisites for cloning DCs. For more information, see Active Directory Domain Services (AD DS) Virtualization.

• New security principals are created when the PDC emulator runs Windows Server 2012.

• The RID Master has new RID issuance and monitoring functionality. The improvements include better event logging, more appropriate limits, and the ability to - in an emergency - increase the overall RID pool allocation by one bit. For more information, see Managing RID Issuance.

Virtualizing domain controllers

Improvements in AD DS beginning in Windows Server 2012 enable safer virtualization of domain controllers and the ability to clone domain controllers. Cloning domain controllers in turn enables rapid deployment of additional domain controllers in a new domain and other benefits. For more information, see Introduction to Active Directory Domain Services (AD DS) Virtualization (Level 100).

Administration of Windows Server 2012 servers

Use the Remote Server Administration Tools for Windows 8 to manage domain controllers and other servers that run Windows Server 2012. You can run the Windows Server 2012 Remote Server Administration Tools on a computer that runs Windows 8.

Application compatibility

The following table covers common Active Directory-integrated Microsoft applications. The table covers what versions of Windows Server that the applications can be installed on and whether the introduction of Windows Server 2012 DCs affects application compatibility.

Product	Notes
Microsoft Configuration Manager 2007	Configuration Manager 2007 with SP2 (includes Configuration Manager 2007 R2 and Configuration Manager 2007 R3): Windows 8 Pro Windows 8 Enterprise Windows Server 2012 Standard Windows Server 2012 Datacenter Note Though these will be fully supported as clients, there is no plan to add support for deploying these as operating systems by using the Configuration Manager 2007 operating system deployment feature. Also, no site servers or site systems will be supported on any SKU of Windows Server 2012.
Microsoft SharePoint 2007	Microsoft Office SharePoint Server 2007 is not supported for installation on Windows Server 2012.
Microsoft SharePoint 2010	SharePoint 2010 Service Pack 2 is required to install and operate SharePoint 2010 on Windows Server 2012 Servers SharePoint 2010 Foundation Service Pack 2 is required to install and operate SharePoint 2010 Foundation on Windows Server 2012 Servers The SharePoint Server 2010 (without service packs) installation process fails on Windows Server 2012 The SharePoint Server 2010 prerequisite installer (PrerequisiteInstaller.exe) fails with error “This program has compatibility issues.” Clicking “Run the program without getting help” displays the error “Verifying if SharePoint can be installed | SharePoint Server 2010 (without service packs) cannot be installed on Windows Server 2012.”
Microsoft SharePoint 2013	Minimum requirements for a database server in a farm The 64-bit edition of Windows Server 2008 R2 Service Pack 1 (SP1) Standard, Enterprise, or Datacenter or the 64-bit edition of Windows Server 2012 Standard or Datacenter Minimum requirements for a single server with built-in database: The 64-bit edition of Windows Server 2008 R2 Service Pack 1 (SP1) Standard, Enterprise, or Datacenter or the 64-bit edition of Windows Server 2012 Standard or Datacenter Minimum requirements for front-end web servers and application servers in a farm: The 64-bit edition of Windows Server 2008 R2 Service Pack 1 (SP1) Standard, Enterprise, or Datacenter or the 64-bit edition of Windows Server 2012 Standard or Datacenter.
Microsoft System Center Configuration Manager 2012	System Center 2012 Configuration Manager Service Pack 1: Microsoft will add the following operating systems to our client support matrix with the release of Service Pack 1: Windows 8 Pro Windows 8 Enterprise Windows Server 2012 Standard Windows Server 2012 Datacenter All site server roles - including site servers, SMS providers, and management points - can be deployed to servers with the following operating system editions: Windows Server 2012 Standard Windows Server 2012 Datacenter
Microsoft Lync Server 2013	Lync Server 2013 requires with Windows Server 2008 R2 or Windows Server 2012. It cannot be run on a Server Core installation. It can be run on virtual servers.
Lync Server 2010	Lync Server 2010 can be installed on a new (not upgraded) installation Windows Server 2012 if October 2012 cumulative updates for Lync Server are installed. Upgrading the operating system to Windows Server 2012 for an existing installation of Lync Server 2010 is not supported. Microsoft Lync Server 2010 Group Chat Server is also not supported on Windows Server 2012.
System Center 2012 Endpoint Protection	System Center 2012 Endpoint Protection Service Pack 1 will update the client support matrix to include the following operating systems Windows 8 Pro Windows 8 Enterprise Windows Server 2012 Standard Windows Server 2012 Datacenter
System Center 2012 Forefront Endpoint Protection	FEP 2010 with Update Rollup 1 will update the client support matrix to include the following operating systems: Windows 8 Pro Windows 8 Enterprise Windows Server 2012 Standard Windows Server 2012 Datacenter
Forefront Threat Management Gateway (TMG)	TMG is supported to run only on Windows Server 2008 and Windows Server 2008 R2. For more information, see System requirements for Forefront TMG.
Windows Server Update Services	This release of WSUS already supports Windows 8-based computers or Windows Server 2012-based computers as clients.
Windows Server Update Services 3.0	Update KB article 2734608 lets servers that are running Windows Server Update Services (WSUS) 3.0 SP2 provide updates to computers that are running Windows 8 or Windows Server 2012: Note Customers with standalone WSUS 3.0 SP2 environments or System Center Configuration Manager 2007 Service Pack 2 environments with WSUS 3.0 SP2 require 2734608 to properly manage Windows 8-based computers or Windows Server 2012-based computers as clients.
Exchange 2013	Windows Server 2012 Standard and Datacenter are supported for the following roles: schema master, global catalog server, domain controller, mailbox and client access server role Forest Functional Level: Windows Server 2003 or higher Source: Exchange 2013 System Requirements
Exchange 2010	Source: Exchange 2010 Service Pack 3 Exchange 2010 with Service Pack 3 can be installed on Windows Server 2012 member servers. Exchange 2010 System Requirements lists the latest supported schema master, global catalog and domain controller as Windows Server 2008 R2. Forest Functional Level: Windows Server 2003 or higher
SQL Server 2012	Source: KB 2681562 SQL Server 2012 RTM is supported on Windows Server 2012.
SQL Server 2008 R2	Source: KB 2681562 Requires SQL Server 2008 R2 with Service Pack 1 or later to install on Windows Server 2012.
SQL Server 2008	Source: KB 2681562 Requires SQL Server 2008 with Service Pack 3 or later to install on Windows Server 2012.
SQL Server 2005	Source: KB 2681562 Not supported to install on Windows Server 2012.

Known issues

The following table lists known issues related to AD DS installation.

See Also

Windows Server 2012 Evaluation Resources Windows Server 2012 Evaluation Guide Install and Deploy Windows Server 2012