Set boundaries before touching production identity.

Runbook note: Replace sample values such as `corp.example.com`, `HF-DC25-01`, legacy server names, and example IP addresses with your real environment values before execution.

• Use side-by-side migration only. Do not attempt in-place OS jumps from Server 2008 directly to Server 2025.
• Define migration window model: pilot site, phased site rollout, and final cutover with rollback checkpoints.
• Freeze high-risk AD/DNS schema and GPO changes during migration milestones.
• Publish success criteria: authentication stability, DNS response consistency, replication health, and application dependency signoff.
• Track every identity-critical service account, trust, certificate, and line-of-business dependency tied to current DCs.

Command path (create migration evidence folder and initial inventory):

• `New-Item -Path C:\MigrationEvidence -ItemType Directory -Force`
• `Get-Date | Out-File C:\MigrationEvidence\migration-start.txt`
• `netdom query fsmo | Out-File C:\MigrationEvidence\fsmo-start.txt`

GUI path: `Server Manager > Tools > Active Directory Users and Computers`, `Active Directory Sites and Services`, and `DNS` to validate current ownership and topology before change.

Document what exists before introducing new controllers.

• Inventory all current DCs, FSMO holders, site/subnet mappings, GC placement, and DNS hosting roles.
• Export health baseline: `dcdiag /v`, `repadmin /replsummary`, SYSVOL state, and DNS zone transfer behavior.
• Identify deprecated dependencies: NTLMv1 reliance, unsigned LDAP binds, legacy SMB workflows, and old cipher requirements.
• Map stale objects: disabled computers, orphaned servers, old DC records, and obsolete trust paths.
• Capture current time hierarchy and offset patterns so post-migration drift is immediately visible.

Command path (baseline capture):

• `Get-ADDomainController -Filter * | Select HostName,IPv4Address,Site,IsGlobalCatalog,OperationMasterRoles | Export-Csv C:\MigrationEvidence\dc-inventory.csv -NoTypeInformation`
• `Get-ADDomain | Select DNSRoot,DomainMode,PDCEmulator,RIDMaster,InfrastructureMaster | Format-List | Out-File C:\MigrationEvidence\domain-baseline.txt`
• `Get-ADForest | Select ForestMode,SchemaMaster,DomainNamingMaster | Format-List | Out-File C:\MigrationEvidence\forest-baseline.txt`
• `dcdiag /e /v > C:\MigrationEvidence\dcdiag-baseline.txt`
• `repadmin /replsummary > C:\MigrationEvidence\replsummary-baseline.txt`
• `w32tm /monitor > C:\MigrationEvidence\time-baseline.txt`

GUI path: `Server Manager > Tools > Active Directory Sites and Services` (site/subnet mapping), `DNS Manager` (zone and forwarder inventory), `Event Viewer` (Directory Service, DNS Server, DFS Replication logs).

Fix health debt first so migration is predictable.

• Resolve existing replication failures and lingering objects before adding any new DC.
• Ensure SYSVOL is on DFSR and not tied to legacy replication behavior that blocks newer DC operations.
• Clean DNS zone delegations, stale NS records, broken conditional forwarders, and invalid scavenging scope.
• Validate AD schema and functional-level readiness for introducing modern domain controllers.
• Back up system state for all role holders and validate restore workflow on isolated recovery infrastructure.

Command path (health and readiness checks):

• `repadmin /showrepl * /csv > C:\MigrationEvidence\showrepl-before.csv`
• `repadmin /replsummary /bysrc /bydest /sort:delta > C:\MigrationEvidence\replsummary-delta-before.txt`
• `dfsrmig /getglobalstate`
• `Get-DnsServerZone | Select ZoneName,ZoneType,IsDsIntegrated,ReplicationScope | Export-Csv C:\MigrationEvidence\dns-zones-before.csv -NoTypeInformation`
• `wbadmin start systemstatebackup -backuptarget:E: -quiet`

GUI path: `DFS Management` (SYSVOL/DFSR confirmation), `DNS Manager > Server Properties > Forwarders`, and `Windows Server Backup` for system state backup verification.

Harden and baseline new hosts before promotion.

• Deploy at least two Server 2025 hosts in separate failure domains or virtualization clusters.
• Patch fully, assign static IP/DNS, apply baseline security policy, and validate NTP upstream access.
• Pre-stage monitoring, event forwarding, backup agents, and admin access controls before AD DS promotion.
• Use naming, OU placement, and management tagging that distinguishes migration DCs from legacy nodes.
• Capture a pre-promotion baseline snapshot/backup where policy and platform standards permit.

Command path (new Server 2025 prep):

• `Rename-Computer -NewName "HF-DC25-01" -Restart`
• `New-NetIPAddress -InterfaceAlias "Ethernet" -IPAddress 10.10.10.21 -PrefixLength 24 -DefaultGateway 10.10.10.1`
• `Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses 10.10.10.10,10.10.10.11`
• `Install-WindowsFeature AD-Domain-Services,DNS -IncludeManagementTools`
• `w32tm /query /status`

GUI path: `Server Manager > Local Server` (name, NIC, time), then `Server Manager > Add roles and features` for `AD DS` and `DNS` role binaries.

Promote gradually and prove identity behavior at each step.

• Promote first Server 2025 node to DC with DNS enabled, then validate SRV/A registrations across sites.
• Add second Server 2025 DC and verify inbound/outbound replication is clean before moving roles.
• Confirm SYSVOL and NETLOGON availability from representative clients in each site.
• Run `dcdiag` and `repadmin` from both legacy and new controllers to verify cross-generation consistency.
• Only continue when authentication, GPO retrieval, and DNS lookups succeed from pilot workloads.

Command path (promotion and immediate validation):

• `Install-ADDSDomainController -DomainName "corp.example.com" -InstallDns -SiteName "Default-First-Site-Name" -Credential (Get-Credential) -SafeModeAdministratorPassword (Read-Host -AsSecureString "DSRM Password")`
• `Get-ADDomainController -Filter * | Select HostName,Site,IsGlobalCatalog`
• `dcdiag /test:dns /v > C:\MigrationEvidence\dcdiag-dns-after-promotion.txt`
• `repadmin /showrepl > C:\MigrationEvidence\showrepl-after-promotion.txt`
• `Resolve-DnsName -Type SRV _ldap._tcp.dc._msdcs.corp.example.com`

GUI path: `Server Manager > Notifications (flag icon) > Promote this server to a domain controller`, choose `Add a domain controller to an existing domain`, enable `DNS Server` and `Global Catalog` as planned.

Transfer ownership deliberately, not all at once.

• Move FSMO roles in planned sequence and record role holders after each transfer.
• Prioritize PDC Emulator transition with time hierarchy checks, since Kerberos stability depends on it.
• Update dependent systems that target old role holders explicitly (scripts, monitoring, and admin tooling).
• Validate RID issuance and directory write behavior post-transfer under real workload conditions.
• Keep rollback options defined until post-transfer health remains stable through at least one business cycle.

Command path (FSMO transfer and verification):

• `Move-ADDirectoryServerOperationMasterRole -Identity "HF-DC25-01" -OperationMasterRole SchemaMaster,DomainNamingMaster,PDCEmulator,RIDMaster,InfrastructureMaster -Confirm:$false`
• `netdom query fsmo`
• `Get-ADDomain | Select PDCEmulator,RIDMaster,InfrastructureMaster`
• `Get-ADForest | Select SchemaMaster,DomainNamingMaster`

GUI path: `AD Users and Computers > Domain > Operations Masters` (RID/PDC/Infrastructure), `AD Domains and Trusts > Operations Master` (Domain Naming), and `Active Directory Schema` snap-in (Schema Master).

Treat DNS as a migration stream, not a side effect.

• Confirm all AD-integrated zones replicate to intended scope and are hosted on new 2025 DC DNS roles.
• Migrate forwarders and conditional forwarders with explicit validation from each site resolver path.
• Shift DHCP option targets and static resolver configurations from legacy DC IPs to new DC IPs in phases.
• Remove stale NS and glue records that reference retired Server 2008 infrastructure.
• Run repeated validation from branch and core networks for short-name, FQDN, and SRV lookup consistency.

Command path (DNS move and cleanup):

• `Get-DnsServerZone | Select ZoneName,IsDsIntegrated,ReplicationScope`
• `Set-DnsServerForwarder -IPAddress 1.1.1.1,8.8.8.8 -PassThru`
• `Get-DnsServerResourceRecord -ZoneName "_msdcs.corp.example.com" -RRType NS`
• `ipconfig /registerdns`
• `Resolve-DnsName dc01.corp.example.com`
• `Resolve-DnsName -Type SRV _kerberos._tcp.corp.example.com`

GUI path: `DNS Manager > Forward Lookup Zones`, `Reverse Lookup Zones`, `Server Properties > Forwarders`, and zone `Name Servers` tabs for stale DC references.

Verify replication and time convergence before decommissioning old DCs.

• Set the new PDC Emulator to reliable external NTP peers and verify domain hierarchy convergence with `w32tm`.
• Track replication latency and backlog across sites until values stabilize under normal load.
• Validate trust paths, Kerberos ticket issuance, and service account logons from representative application tiers.
• If hybrid identity is used, verify directory sync object consistency and password-writeback behavior after role moves.
• Maintain alerting on AD DS, DNS, Kerberos, and time service channels throughout the migration window.

Command path (time, replication, auth validation):

• `w32tm /config /manualpeerlist:"0.pool.ntp.org,0x8 1.pool.ntp.org,0x8" /syncfromflags:manual /reliable:yes /update`
• `Restart-Service w32time`
• `w32tm /resync /rediscover`
• `w32tm /query /source`
• `repadmin /replsummary`
• `repadmin /queue`
• `Test-ComputerSecureChannel -Verbose`

GUI path: `Group Policy Management` (time and hardening policy scope), `Event Viewer > Applications and Services Logs > Microsoft > Windows > Time-Service`, and `Directory Service` log checks on all DCs.

Decommission Server 2008 controllers only after evidence-based signoff.

• Demote legacy DCs gracefully where possible, then perform metadata cleanup for any forced removals.
• Remove stale DNS records, old site links, legacy service connection points, and abandoned replication objects.
• Raise functional levels only after confirming no remaining legacy compatibility requirements.
• Retire weak protocol paths and legacy auth policies that were preserved only for transitional compatibility.
• Update disaster recovery runbooks, role maps, and operations documentation to reflect the new controller estate.

Command path (retire old DCs and remove stale objects):

• `Uninstall-ADDSDomainController -DemoteOperationMasterRole:$true -RemoveApplicationPartitions -LocalAdministratorPassword (Read-Host -AsSecureString "Local Admin Password")`
• `Get-ADDomainController -Filter * | Select HostName,Site,IsGlobalCatalog`
• `netdom query fsmo`
• `Remove-DnsServerResourceRecord -ZoneName "corp.example.com" -RRType A -Name "OLD-DC01" -Force`
• `repadmin /replsummary`

GUI path: `Server Manager > AD DS > More > Demote this domain controller`, then `Active Directory Sites and Services` and `DNS Manager` to confirm old controller metadata and records are removed.

Use a repeatable verification matrix before declaring completion.

• Identity tests: user logon, service account auth, MFA bridge points, and trust-based app access.
• Directory tests: object create/update/delete, group membership propagation, and GPO processing.
• DNS tests: forward and reverse lookups, SRV resolution, conditional forwarding, and branch path behavior.
• Resilience tests: controlled DC restart, replication catch-up, and failover between new controllers.
• Recovery tests: system state restore rehearsal and documented rollback decision criteria.

Command path (production cutover test pack):

• `dcdiag /e /test:Advertising /test:Services /test:DNS /v > C:\MigrationEvidence\dcdiag-final.txt`
• `repadmin /replsummary > C:\MigrationEvidence\replsummary-final.txt`
• `nltest /dsgetdc:corp.example.com`
• `gpresult /r /scope computer > C:\MigrationEvidence\gpresult-computer.txt`
• `gpresult /r /scope user > C:\MigrationEvidence\gpresult-user.txt`
• `Resolve-DnsName corp.example.com`
• `Resolve-DnsName -Type SRV _ldap._tcp.dc._msdcs.corp.example.com`
• `Test-Path \\corp.example.com\SYSVOL`
• `Test-Path \\corp.example.com\NETLOGON`
• `wbadmin get versions`

GUI path: `Event Viewer` (Directory Service, DFS Replication, DNS Server), `Active Directory Administrative Center` (object operations), `DNS Manager` (live resolution checks), and `Windows Server Backup` (restore-point verification).