-->
By Microsoft Windows Server Team. On October 2, 2018, we announced the availability of Windows Server 2019 and Windows Server, version 1809. And we are pleased to announce it now supports migration of Windows Server 2008 32-bit. 0 Comments; Remote Desktop Services 2019 generally available with Windows Server 2019. Home » Microsoft » Windows Server » Windows Server 2008 » Create Two-Way Forest Trust in Windows Server 2008 R2 Posted on October 29, 2012 by Bipin in Windows Server 2008 Trust is relationship that is established between domains within a forest or across the forest which allows for sharing of resources and authentication. Server 2008 R2 Domain Controller and Windows 10 clients. Windows Server > Group Policy. Microsoft does not guarantee the accuracy of this information. What are the risks of a multi-homed domain controller with Server 2008 R2? Can I filter just only Facebook with an Windows Server 2012 R2 by software? Get answers from your peers along with millions of IT pros who visit Spiceworks. What are the risks of a multi-homed domain controller with Windows Server 2008 R2?
Applies To: Windows Server
This topic provides background information about Active Directory DomainServices in Windows Server 2016 and explains the process for upgrading domain controllers from Windows Server 2012 or Windows Server 2012 R2.
Pre-requisites
The recommended way to upgrade a domain is to promote domain controllers that run newer versions of Windows Server and demote the older domain controllers as needed. That method is preferable to upgrading the operating system of an existing domain controller. This list covers general steps to follow before you promote a domain controller that runs a newer version of Windows Server:
- Verify the target server meets system requirements.
- Verify Application compatibility.
- Review Recommendations for moving to Windows Server 2016
- Verify security settings. For more information, see Deprecated features and behavior changes related to AD DS in Windows Server 2016.
- Check connectivity to the target server from the computer where you plan to run the installation.
- Check for availability of necessary operation master roles:
- To install the first DC that runs Windows Server 2016 in an existing domain and forest, the machine where you run the installation needs connectivity to the schema master in order to run adprep /forestprep and the infrastructure master in order to run adprep /domainprep.
- To install the first DC in a domain where the forest schema is already extended, you only need connectivity to the infrastructure master.
- To install or remove a domain in an existing forest, you need connectivity to the domain naming master.
- Any domain controller installation also requires connectivity to the RID master.
- If you are installing the first read-only domain controller in an existing forest, you need connectivity to the infrastructure master for each application directory partition, also known as a non-domain naming context or NDNC.
Installation steps and required administrative levels
The following table provides a summary of the upgrade steps and the permission requirements to accomplish these steps
| Installation action | Credential requirements |
|---|---|
| Install a new forest | Local Administrator on the target server |
| Install a new domain in an existing forest | Enterprise Admins |
| Install an additional DC in an existing domain | Domain Admins |
| Run adprep /forestprep | Schema Admins, Enterprise Admins, and Domain Admins |
| Run adprep /domainprep | Domain Admins |
| Run adprep /domainprep /gpprep | Domain Admins |
| Run adprep /rodcprep | Enterprise Admins |
For additional information on new features in Windows Server 2016, see What's new in Windows Server 2016.
Supported in-place upgrade paths
Domain controllers that run 64-bit versions of Windows Server 2012 or Windows Server 2012 R2 can be upgraded to Windows Server 2016. Only 64-bit version upgrades are supported because Windows Server 2016 only comes in a 64-bit version.
| If you are running this edition: | You can upgrade to these editions: |
|---|---|
| Windows Server 2012 Standard | Windows Server 2016 Standard or Datacenter |
| Windows Server 2012 Datacenter | Windows Server 2016 Datacenter |
| Windows Server 2012 R2 Standard | Windows Server 2016 Standard or Datacenter |
| Windows Server 2012 R2 Datacenter | Windows Server 2016 Datacenter |
| Windows Server 2012 R2 Essentials | Windows Server 2016 Essentials |
| Windows Storage Server 2012 Standard | Windows Storage Server 2016 Standard |
| Windows Storage Server 2012 Workgroup | Windows Storage Server 2016 Workgroup |
| Windows Storage Server 2012 R2 Standard | Windows Storage Server 2016 Standard |
| Windows Storage Server 2012 R2 Workgroup | Windows Storage Server 2016 Workgroup |
For more information about supported upgrade paths, see Supported Upgrade Paths
Adprep and Domainprep
If you are doing an in-place upgrade of an existing domain controller to the Windows Server 2016 operating system, you will need to run adprep /forestprep and adprep /domainprep manually. Adprep /forestprep needs to be run only once in the forest. Adprep /domainprep needs to be run once in each domain in which you have domain controllers that you are upgrading to Windows Server 2016.
If you are promoting a new Windows Server 2016 server you do not need to run these manually. These are integrated into the PowerShell and Server Manager experiences.
For more information on running adprep see Running Adprep
Functional level features and requirements
Windows Server 2016 requires a Windows Server 2003 forest functional level. That is, before you can add a domain controller that runs Windows Server 2016 to an existing Active Directory forest, the forest functional level must be Windows Server 2003 or higher. If the forest contains domain controllers running Windows Server 2003 or later but the forest functional level is still Windows 2000, the installation is also blocked.
Windows 2000 domain controllers must be removed prior to adding Windows Server 2016 domain controllers to your forest. In this case, consider the following workflow:
- Install domain controllers that run Windows Server 2003 or later. These domain controllers can be deployed on an evaluation version of Windows Server. This step also requires running adprep.exe for that operating system release as a prerequisite.
- Remove the Windows 2000 domain controllers. Specifically, gracefully demote or forcibly remove Windows Server 2000 domain controllers from the domain and used Active Directory Users and Computers to remove the domain controller accounts for all removed domain controllers.
- Raise the forest functional level to Windows Server 2003 or higher.
- Install domain controllers that run Windows Server 2016.
- Remove domain controllers that run earlier versions of Windows Server.
Rolling back functional levels
After you set the forest functional level (FFL) to a certain value, you cannot roll back or lower the forest functional level, with the following exceptions:
- If you are upgrading from Windows Server 2012 R2 FFL, you can lower it back to Windows Server 2012 R2.
- If you are upgrading from Windows Server 2008 R2 FFL, you can lower it back to Windows Server 2008 R2.
After you set the domain functional level to a certain value, you cannot roll back or lower the domain functional level, with the following exceptions:
- When you raise the domain functional level to Windows Server 2016 and if the forest functional level is Windows Server 2012 or lower, you have the option of rolling the domain functional level back to Windows Server 2012 or Windows Server 2012 R2.
For more information about features that are available at lower functional levels, see Understanding Active Directory Domain Services (AD DS) Functional Levels.
AD DS interoperability with other server roles and Windows operating systems
AD DS is not supported on the following Windows operating systems:
- Windows MultiPoint Server
- Windows Server 2016 Essentials
AD DS cannot be installed on a server that also runs the following server roles or role services:
- Microsoft Hyper-V Server 2016
- Remote Desktop Connection Broker
Administration of Windows Server 2016 servers
Use the Remote Server Administration Tools for Windows 10 to manage domain controllers and other servers that run Windows Server 2016. You can run the Windows Server 2016 Remote Server Administration Tools on a computer that runs Windows 10.
Step-by-Step for Upgrading to Windows Server 2016
The following is a simple example of upgrading the Contoso forest from Windows Server 2012 R2 to Windows Server 2016.
Join the new Windows Server 2016 to your forest. Restart when prompted.
Sign in to the new Windows Server 2016 with a domain admin account.
In Server Manager, under Add Roles and Features, install Active Directory Domain Services on the new Windows Server 2016. This will automatically run adprep on the 2012 R2 forest and domain.
In Server Manager, click the yellow triangle, and from the drop-down click Promote the server to a domain controller.
On the Deployment Configuration screen, select Add a domain controller to an existing forest and click next.
On the Domain Controller options screen, enter the Directory Services Restore Mode (DSRM) password and click next.
For the remainder of the screens click Next.
On the Prerequisite Check screen, click install. Once the restart has completed you can sign back in.
On the Windows Server 2012 R2 server, in Server Manager, under tools, select Active Directory Module for Windows PowerShell.
In the PowerShell windows use the Move-ADDirectoryServerOperationMasterRole to move the FSMO roles. You can type the name of each -OperationMasterRole or use numbers to specify the roles. For more information see Move-ADDirectoryServerOperationMasterRole
Verify the roles have been moved by going to the Windows Server 2016 server, in Server Manager, under tools, select Active Directory Module for Windows PowerShell. Use the
Get-ADDomainandGet-ADForestcmdlets to view the FSMO role holders.Demote and remove the Windows Server 2012 R2 domain controller. For information on demoting a dc, see Demoting Domain Controllers and Domains
Once the server is demoted and removed you can raise the forest functional and domain functional levels to Windows Server 2016.
Next Steps
-->Applies To: Windows Server 2016, Windows Server 2012 R2, Windows Server 2012
This topic provides background information about Active Directory Domain Services in Windows Server 2012 R2 and Windows Server 2012 and explains the process for upgrading domain controllers from Windows Server 2008 or Windows Server 2008 R2.
Domain controller upgrade steps
The recommended way to upgrade a domain is to promote domain controllers that run newer versions of Windows Server and demote older domain controllers as needed. That method is preferable to upgrading the operating system of an existing domain controller. This list covers general steps to follow before you promote a domain controller that runs a newer version of Windows Server:
Verify the target server meets system requirements.
Verify Application compatibility.
Verify security settings. For more information, see Deprecated features and behavior changes related to AD DS in Windows Server 2012 and Secure default settings in Windows Server 2008 and Windows Server 2008 R2.
Check connectivity to the target server from the computer where you plan to run the installation.
Check for availability of necessary operation master roles:
- To install the first DC that runs Windows Server 2012 in an existing domain and forest, the machine where you run the installation needs connectivity to the schema master in order to run adprep /forestprep and the infrastructure master in order to run adprep /domainprep.
- To install the first DC in a domain where the forest schema is already extended, you only need connectivity to infrastructure master.
- To install or remove a domain in an existing forest, you need connectivity to the domain naming master.
- Any domain controller installation also requires connectivity to the RID master.
- If you are installing the first read-only domain controller in an existing forest, you need connectivity to the infrastructure master for each application directory partition, also known as a non-domain naming context or NDNC.
Be sure to supply the necessary credentials to run the AD DS installation.
Installation action Credential requirements Install a new forest Local Administrator on the target server Install a new domain in an existing forest Enterprise Admins Install an additional DC in an existing domain Domain Admins Run adprep /forestprep Schema Admins, Enterprise Admins, and Domain Admins Run adprep /domainprep Domain Admins Run adprep /domainprep /gpprep Domain Admins Run adprep /rodcprep Enterprise Admins You can delegate permissions to install AD DS. For more information, see Installation Management Tasks.
Steps-by-step instructions to promote new and replica Windows Server 2012 domain controllers using Windows PowerShell cmdlets and Server Manager can be found in the following links:
Windows Update considerations
Prior to the release of Windows 8, Windows Update managed its own internal schedule to check for updates, and to download and install them. It required that the Windows Update Agent was always running in the background, consuming memory and other system resources.
Windows 8 and Windows Server 2012 introduce a new feature called Automatic Maintenance. Automatic Maintenance consolidates many different features that each used to manage its own scheduling and execution logic. This consolidation allows for all these components to use far less system resources, work consistently, respect the new Connected Standby state for new device types, and consume less battery on portable devices.
Because Windows Update is a part of Automatic Maintenance in Windows 8 and Windows Server 2012, its own internal schedule for setting a day and time to install updates is no longer effective. To help ensure consistent and predictable restart behavior for all devices and computers in your enterprise, including those that run Windows 8 and Windows Server 2012, see Microsoft KB article 2885694 (or see October 2013 cumulative rollup 2883201), then configure policy settings described in the WSUS blog post Enabling a more predictable Windows Update experience for Windows 8 and Windows Server 2012 (KB 2885694).
What's new in AD DS in Windows Server 2012 R2?
The following table summarizes new features for AD DS in Windows Server 2012 R2, with a link to more detailed information where it is available. For a more detailed explanation of some features, including their requirements, see What's New in Active Directory in Windows Server 2012 R2.
| Feature | Description |
|---|---|
| Workplace Join | Allows information workers to join their personal devices with their company to access company resources and services. |
| Web Application Proxy | Provides access to web application using a new Remote Access role service. |
| Active Directory Federation Services | AD FS has simplified deployment and improvements to enable users to access resources from personal devices and help IT departments manage access control. |
| SPN and UPN uniqueness | Domain Controllers running Windows Server 2012 R2 block the creation of duplicate service principal names (SPNs) and user principal names (UPNs). |
| Winlogon Automatic Restart Sign-On (ARSO) | Enables lock screen applications to be restarted and available on Windows 8.1 devices. |
| TPM Key Attestation | Enables CAs to cryptographically attest in an issued certificate that the certificate requester private key is actually protected by a Trusted Platform Module (TPM). |
| Credentials Protection and Management | New credential protection and domain authentication controls to reduce credential theft. |
| Deprecation of File Replication Service (FRS) | The Windows Server 2003 domain functional level is also deprecated because at the functional level, FRS is used to replicate SYSVOL. That means when you create a new domain on a server that runs Windows Server 2012 R2, the domain functional level must be Windows Server 2008 or newer. You can still add a domain controller that runs Windows Server 2012 R2 to an existing domain that has a Windows Server 2003 domain functional level; you just can't create a new domain at that level. |
| New domain and forest functional levels | There are new functional levels for Windows Server 2012 R2. New features are available at Windows Server 2012 R2 DFL. |
| LDAP query optimizer changes | Performance improvement in LDAP search efficiency and LDAP search time of complex queries. |
| 1644 Event improvements | LDAP search result statistics were added to event ID 1644 to aid in troubleshooting. |
| Active Directory replication throughput improvement | Adjusts the maximum AD Replication throughput from 40Mbps to around 600 Mbps |
What's new in AD DS in Windows Server 2012?
The following table summarizes the new features for AD DS in Windows Server 2012, with a link to more detailed information where it is available. For a more detailed explanation of some features, including their requirements, see What's New in Active Directory Domain Services (AD DS).
| Feature | Description |
|---|---|
| Active Directory-Based Activation (AD BA) see Volume Activation Overview | Simplifies the task of configuring the distribution and management of volume software licenses. |
| Active Directory Federation Services (AD FS) | Adds role install via Server Manager, simplified trust-setup, automatic trust management, SAML-protocol support, and more. |
| Active Directory lost page flush events | NTDS ISAM event 530 with jet error -1119 is logged to detect lost page flush events to Active Directory databases. |
| Active Directory Recycle Bin User Interface | Active Directory Administrative Center (ADAC) adds GUI management of recycle bin feature originally introduced in Windows Server 2008 R2. |
| Active Directory Replication and Topology Windows PowerShell cmdlets | Supports the creation and management of Active Directory sites, site-links, connection objects, and more using Windows PowerShell. |
| Dynamic Access Control | New claims-based authorization platform that enhances the legacy access control model. |
| Fine-Grained Password Policy User Interface | ADAC adds GUI support for the creating, editing and assignment of PSOs originally added in Windows Server 2008. |
| Group Managed Service Accounts (gMSA) | A new security principal type known as a gMSA. Services running on multiple hosts can run under the same gMSA account. |
| DirectAccess Offline Domain Join | Extends offline domain-join by including DirectAccess prerequisites. |
| Rapid deployment via virtual domain controller (DC) cloning | Virtualized DCs can be rapidly deployed by cloning existing virtual domain controllers using Windows PowerShell cmdlets. |
| RID pool changes | Adds new monitoring events and quotas to safeguard against excessive consumption of the global RID pool. Optionally doubles the size of the global RID pool if the original pool becomes exhausted. |
| Secure Time service | Enhances security for W32tm by removing secrets from the wire, removing the MD5 hash functions and requiring the server to authenticate with Windows 8 time clients |
| USN rollback protection for virtualized DCs | Accidentally restoring snapshot backups of virtualized DCs no longer causes USN rollback. |
| Windows PowerShell History Viewer | Allow administrators to view the Windows PowerShell commands executed when using ADAC. |
Automatic Maintenance and changes to restart behavior after updates are applied by Windows Update
Prior to the release of Windows 8, Windows Update managed its own internal schedule to check for updates, and to download and install them. It required that the Windows Update Agent was always running in the background, consuming memory and other system resources.
Windows 8 and Windows Server 2012 introduce a new feature called Automatic Maintenance. Automatic Maintenance consolidates many different features that each used to manage its own scheduling and execution logic. This consolidation allows for all these components to use far less system resources, work consistently, respect the new Connected Standby state for new device types, and consume less battery on portable devices.
Because Windows Update is a part of Automatic Maintenance in Windows 8 and Windows Server 2012, its own internal schedule for setting a day and time to install updates is no longer effective. To help ensure consistent and predictable restart behavior for all devices and computers in your enterprise, including those that run Windows 8 and Windows Server 2012, you can configure the following Group Policy settings:
- Computer Configuration|Policies|Administrative Templates|Windows Components|Windows Update|Configure Automatic Updates
- Computer Configuration|Policies|Administrative Templates|Windows Components|Windows Update|No auto-restart with logged on users
- Computer Configuration|Policies|Administrative Templates|Windows Components|Maintenance Scheduler|Maintenance Random Delay
The following table lists some examples of how to configure these settings to provide desired restart behavior.
| Scenario | Recommended configuration(s) |
| WSUS managed - Install updates once per week - Reboot Fridays at 11PM | Set machines to auto-install, prevent auto-reboot until desired time Policy: Configure Automatic Updates (Enabled) Configure automatic updating: 4 - Auto download and schedule the install Policy: No auto-restart with logged-on users (Disabled) WSUS deadlines: set to Fridays at 11PM |
| WSUS managed - Stagger installs across different hours/days | Set target groups for different groups of machines that should be updated together Use above steps for previous scenario Set different deadlines for different target groups |
| Not WSUS-managed - no support for deadlines - Stagger installs at different times | Policy: Configure Automatic Updates (Enabled) Configure automatic updating: 4 - Auto download and schedule the install Registry key: Enable the registry key discussed in Microsoft KB article 2835627 Policy: Automatic Maintenance Random Delay (Enabled) Set Regular maintenance random delay to PT6H for 6-hour random delay to provide the following behavior: - Updates will install at the configured maintenance time plus a random delay - Restart for each machine will take place exactly 3 days later Alternatively, set a different maintenance time for each group of machines |
For more information about why the Windows engineering team implemented these changes, see Minimizing restarts after automatic updating in Windows Update.
AD DS server role installation changes
In Windows Server 2003 through Windows Server 2008 R2, you ran the x86 or X64 version of the Adprep.exe command-line tool before running the Active Directory Installation Wizard, Dcpromo.exe, and Dcpromo.exe had optional variants to install from media or for unattended installation.
Beginning in Windows Server 2012, command-line installations are performed by using the ADDSDeployment Module in Windows PowerShell. GUI-based promotions are performed in Server Manager using a completely new AD DS Configuration Wizard. To simplify the installation process, ADPREP has been integrated into the AD DS installation and runs automatically as needed. The Windows PowerShell-based AD DS Configuration Wizard automatically targets the schema and infrastructure master roles in the domains where DCs are being added, then remotely runs the required ADPREP commands on the relevant domain controllers.
Prerequisite checks in the AD DS Installation Wizard identify potential errors before the installation begins. Error conditions can be corrected to eliminate concerns from a partially complete upgrade. The wizard also exports a Windows PowerShell script that contains all the options that were specified during the graphical installation.
Taken together, the AD DS installation changes simplify the DC role installation process and reduce the likelihood of administrative errors, especially when you are deploying multiple domain controllers across global regions and domains.
More detailed information on GUI and Windows PowerShell-based installations, including command line syntax and step-by-step wizard instructions, see Install Active Directory Domain Services. For administrators that want to control the introduction of schema changes in an Active Directory forest independent of the installation of Windows Server 2012 DCs in an existing forest, Adprep.exe commands can still be run at an elevated command prompt.
Deprecated features and behavior changes related to AD DS in Windows Server 2012
There are some changes related to AD DS:
- Deprecation of Adprep32.exe
- There is only one version of Adprep.exe and it can be run as needed on 64-bit servers that run Windows Server 2008 or later. It can be run remotely, and must be run remotely if that targeted operations master role is hosted on a 32-bit operating system or Windows Server 2003.
- Deprecation of Dcpromo.exe
- Dcpromo is deprecated although in Windows Server 2012 only it can still be run with an answer file or command line parameters to give organizations time to transition existing automation to the new Windows PowerShell installation options.
- LMHash is disabled on user accounts
- Secure defaults in Security templates on Windows Server 2008, Windows Server 2008 R2 and Windows Server 2012 enable the NoLMHash policy which is disabled in the security templates of Windows 2000 and Windows Server 2003 domain controllers. Disable the NoLMHash policy for LMHash-dependent clients as required, using the steps in KB article 946405.
Beginning with Windows Server 2008 , domain controllers also have the following secure default settings, compared to domain controllers that run Windows Server 2003 or Windows 2000.
| Encryption type or policy | Windows Server 2008 default | Windows Server 2012 and Windows Server 2008 R2 default | Comment |
| AllowNT4Crypto | Disabled | Disabled | Third-party Server Message Block (SMB) clients may be incompatible with the secure default settings on domain controllers. In all cases, these settings can be relaxed to allow interoperability, but only at the expense of security. For more information, see article 942564 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=164558). |
| DES | Enabled | Disabled | Article 977321 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=177717) |
| CBT/Extended Protection for Integrated Authentication | N/A | Enabled | See Microsoft Security Advisory (937811) (https://go.microsoft.com/fwlink/?LinkId=164559) and article 976918 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=178251). Review and install the hotfix in article 977073 (https://go.microsoft.com/fwlink/?LinkId=186394) in the Microsoft Knowledge Base as required. |
| LMv2 | Enabled | Disabled | Article 976918 in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=178251) |
Operating system requirements
The minimum system requirements for Windows Server 2012 are listed in the following table. For more information about system requirements and pre-installation information, see Installing Windows Server 2012. There are no additional system requirements to install a new Active Directory forest, but you should add sufficient memory to cache the contents of Active Directory database in order to improve performance for domain controllers, LDAP client requests, and Active Directory-enabled applications. If you are upgrading an existing domain controller or adding a new domain controller to an existing forest, review the next section to ensure the server meets disk space requirements.
| Processor | 1.4 Ghz 64-bit processor |
| RAM | 512 MB |
| Free disk space requirements | 32 GB |
| Screen resolution | 800 x 600 or higher |
| Miscellaneous | DVD drive, keyboard, Internet access |
Disk space requirements for upgrading domain controllers
This section covers disk space requirements only for upgrading domain controllers from Windows Server 2008 or Windows Server 2008 R2 . For more information about disk space requirements for upgrading domain controllers to earlier versions of Windows Server, see Disk space requirements for upgrading to Windows Server 2008 or Disk space requirements for upgrading to Windows Server 2008 R2.
Size the disk that hosts the Active Directory database and log files in order to accommodate the custom and application-driven schema extensions, application and administrator-initiated indexes, plus space for the objects and attributes that you will be added to the directory over deployment life of the domain controller (typically 5 to 8 years). Right sizing at deployment time is typically a good investment compared to greater touch costs required to expand disk storage after deployment. For more information, see Capacity Planning for Active Directory Domain Services.
On domain controllers that you plan to upgrade, make sure that the drive that hosts the Active Directory database (NTDS.DIT) has free disk space that represents at least 20% of the NTDS.DIT file before you begin the operating system upgrade. If there is insufficient free disk space on the volume, the upgrade can fail and the upgrade compatibility report returns an error indicating insufficient free disk space:
In this case, you can try an offline defragmentation of the Active Directory database to recapture additional space, and then retry the upgrade. For more information, see Compact the Directory Database File (Offline Defragmentation).
Available SKUs
There are 4 editions of Windows Server: Foundation, Essentials, Standard and Datacenter.The two editions that support the AD DS role are Standard and Datacenter.
In previous releases, Windows Server editions differed in their support of server roles, processor counts and large memory support. The Standard and Datacenter editions of Windows Server support all features and underlying hardware but vary in their virtualization rights - two virtual instances are allowed for Standard edition and unlimited virtual instances are allowed for Datacenter edition.
Windows client and Windows Server operating systems that are supported to join Windows Server domains
The following Windows client and Windows Server operating systems are supported for domain member computers with domain controllers that run Windows Server 2012 or later:
- Client operating systems: Windows 8.1, Windows 8, Windows 7, Windows Vista
- Computers that run Windows 8.1 or Windows 8 are also able to join domains that have domain controllers that run earlier version of Windows Server, including Windows Server 2003 or later. In this case however, some Windows 8 features may require additional configuration or may not be available. For more information about those features and other recommendations for managing Windows 8 clients in downlevel domains, see Running Windows 8 member computers in Windows Server 2003 domains.
- Server operating systems: Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, Windows Server 2003 R2, Windows Server 2003
Supported in-place upgrade paths
Domain controllers that run 64-bit versions of Windows Server 2008 or Windows Server 2008 R2 can be upgraded to Windows Server 2012 . You cannot upgrade domain controllers that run Windows Server 2003 or 32-bit versions of Windows Server 2008. To replace them, install domain controllers that run a later version of Windows Server in the domain, and then remove the domain controllers that Windows Server 2003.
| If you are running these editions | You can upgrade to these editions |
|---|---|
| Windows Server 2008 Standard with SP2 OR Windows Server 2008 Enterprise with SP2 | Windows Server 2012 Standard OR Windows Server 2012 Datacenter |
| Windows Server 2008 Datacenter with SP2 | Windows Server 2012 Datacenter |
| Windows Web Server 2008 | Windows Server 2012 Standard |
| Windows Server 2008 R2 Standard with SP1 OR Windows Server 2008 R2 Enterprise with SP1 | Windows Server 2012 Standard OR Windows Server 2012 Datacenter |
| Windows Server 2008 R2 Datacenter with SP1 | Windows Server 2012 Datacenter |
| Windows Web Server 2008 R2 | Windows Server 2012 Standard |
For more information about supported upgrade paths, see Evaluation Versions and Upgrade Options for Windows Server 2012. Note that you cannot convert a domain controller that runs an evaluation version of Windows Server 2012 directly to a retail version. Instead, install an additional domain controller on a server that runs a retail version and remove AD DS from the domain controller that runs on the evaluation version.
Due to a known issue, you cannot upgrade a domain controller that runs a Server Core installation of Windows Server 2008 R2 to a Server Core installation of Windows Server 2012 . The upgrade will hang on a solid black screen late in the upgrade process. Rebooting such DCs exposes an option in boot.ini file to roll back to the previous operating system version. An additional reboot triggers the automatic rollback to the previous operating system version. Until a solution is available, it is recommended that you install a new domain controller running a Server Core installation of Windows Server 2012 instead of in-place upgrading an existing domain controller that runs a Server Core installation of Windows Server 2008 R2. For more information, see KB article 2734222.
Functional level features and requirements
Windows Server 2012 requires a Windows Server 2003 forest functional level. That is, before you can add a domain controller that runs Windows Server 2012 to an existing Active Directory forest, the forest functional level must be Windows Server 2003 or higher. This means that domain controllers that run Windows Server 2008 R2, Windows Server 2008, or Windows Server 2003 can operate in the same forest, but domain controllers that run Windows 2000 Server are not supported and will block installation of a domain controller that runs Windows Server 2012. If the forest contains domain controllers running Windows Server 2003 or later but the forest functional level is still Windows 2000, the installation is also blocked.
Windows 2000 domain controllers must be removed prior to adding Windows Server 2012 domain controllers to your forest. In this case, consider the following workflow:
Windows Server 2008 R2 Support
- Install domain controllers that run Windows Server 2003 or later. These domain controllers can be deployed on an evaluation version of Windows Server. This step also requires running adprep.exe for that operating system release as a prerequisite.
- Remove the Windows 2000 domain controllers. Specifically, gracefully demote or forcibly remove Windows Server 2000 domain controllers from the domain and used Active Directory Users and Computers to remove the domain controller accounts for all removed domain controllers.
- Raise the forest functional level to Windows Server 2003 or higher.
- Install domain controllers that run Windows Server 2012.
- Remove domain controllers that run earlier versions of Windows Server.
The new Windows Server 2012 domain functional level enables one new feature: the KDC support for claims, compound authentication, and Kerberos armoring KDC administrative template policy has two settings (Always provide claims and Fail unarmored authentication requests) that require Windows Server 2012 domain functional level.
The Windows Server 2012 forest functional level does not provide any new features, but it ensures that any new domain created in the forest will automatically operate at the Windows Server 2012 domain functional level. The Windows Server 2012 domain functional level does not provide other new features beyond KDC support for claims, compound authentication, and Kerberos armoring. But it ensures that any domain controller in the domain runs Windows Server 2012 . For more information about other features that are available at different functional levels, see Understanding Active Directory Domain Services (AD DS) Functional Levels.
After you set the forest functional level to a certain value, you cannot roll back or lower the forest functional level, with the following exceptions: after you raise the forest functional level to Windows Server 2012 , you can lower it to Windows Server 2008 R2 . If Active Directory Recycle Bin has not been enabled, you can also lower the forest functional level from Windows Server 2012 to Windows Server 2008 R2 or Windows Server 2008 or from Windows Server 2008 R2 back to Windows Server 2008 . If the forest functional level is set to Windows Server 2008 R2 , it cannot be rolled back, for example, to Windows Server 2003.
After you set the domain functional level to a certain value, you cannot roll back or lower the domain functional level, with the following exceptions: when you raise the domain functional level to Windows Server 2008 R2 or Windows Server 2012 , and if the forest functional level is Windows Server 2008 or lower, you have the option of rolling the domain functional level back to Windows Server 2008 or Windows Server 2008 R2 . You can lower the domain functional level only from Windows Server 2012 to Windows Server 2008 R2 or Windows Server 2008 or from Windows Server 2008 R2 to Windows Server 2008 . If the domain functional level is set to Windows Server 2008 R2 , it cannot be rolled back, for example, to Windows Server 2003.
For more information about features that are available at lower functional levels, see Understanding Active Directory Domain Services (AD DS) Functional Levels.
Beyond functional levels, a domain controller that runs Windows Server 2012 provides additional features that are not available on a domain controller that runs an earlier version of Windows Server. For example, a domain controller that runs Windows Server 2012 can be used for virtual domain controller cloning, whereas a domain controller that runs an earlier version of Windows Server cannot. But virtual domain controller cloning and virtual domain controller safeguards in Windows Server 2012 do not have any functional level requirements.
Note
Microsoft Exchange Server 2013 requires a forest functional level of Windows server 2003 or higher.
AD DS interoperability with other server roles and Windows operating systems
AD DS is not supported on the following Windows operating systems:
- Windows MultiPoint Server
- Windows Server 2012 Essentials
AD DS cannot be installed on a server that also runs the following server roles or role services:
- Hyper-V Server
- Remote Desktop Connection Broker
Operations master roles
Some new features in Windows Server 2012 affect operations master roles:
- The PDC emulator must be running Windows Server 2012 to support cloning virtual domain controllers. There are additional prerequisites for cloning DCs. For more information, see Active Directory Domain Services (AD DS) Virtualization.
- New security principals are created when the PDC emulator runs Windows Server 2012 .
- The RID Master has new RID issuance and monitoring functionality. The improvements include better event logging, more appropriate limits, and the ability to - in an emergency - increase the overall RID pool allocation by one bit. For more information, see Managing RID Issuance.
Note
Though they are not operations master roles, another change in AD DS installation is that DNS server role and the global catalog are installed by default on all domain controllers that run Windows Server 2012 .
Virtualizing domain controllers
Improvements in AD DS beginning in Windows Server 2012 enable safer virtualization of domain controllers and the ability to clone domain controllers. Cloning domain controllers in turn enables rapid deployment of additional domain controllers in a new domain and other benefits. For more information, see Introduction to Active Directory Domain Services (AD DS) Virtualization (Level 100).
Administration of Windows Server 2012 servers
Use the Remote Server Administration Tools for Windows 8 to manage domain controllers and other servers that run Windows Server 2012 . You can run the Windows Server 2012 Remote Server Administration Tools on a computer that runs Windows 8.
Application compatibility
Microsoft Windows Server 2008 R2 License
The following table covers common Active Directory-integrated Microsoft applications. The table covers what versions of Windows Server that the applications can be installed on and whether the introduction of Windows Server 2012 DCs affects application compatibility.
| Product | Notes |
|---|---|
| Microsoft Configuration Manager 2007 | Configuration Manager 2007 with SP2 (includes Configuration Manager 2007 R2 and Configuration Manager 2007 R3): - Windows 8 Pro - Windows 8 Enterprise - Windows Server 2012 Standard - Windows Server 2012 Datacenter Note: Though these will be fully supported as clients, there is no plan to add support for deploying these as operating systems by using the Configuration Manager 2007 operating system deployment feature. Also, no site servers or site systems will be supported on any SKU of Windows Server 2012. |
| Microsoft SharePoint 2007 | Microsoft Office SharePoint Server 2007 is not supported for installation on Windows Server 2012. |
| Microsoft SharePoint 2010 | SharePoint 2010 Service Pack 2 is required to install and operate SharePoint 2010 on Windows Server 2012 Servers SharePoint 2010 Foundation Service Pack 2 is required to install and operate SharePoint 2010 Foundation on Windows Server 2012 Servers The SharePoint Server 2010 (without service packs) installation process fails on Windows Server 2012 The SharePoint Server 2010 prerequisite installer (PrerequisiteInstaller.exe) fails with error 'This program has compatibility issues.' Clicking 'Run the program without getting help' displays the error 'Verifying if SharePoint can be installed | SharePoint Server 2010 (without service packs) cannot be installed on Windows Server 2012.' |
| Microsoft SharePoint 2013 | Minimum requirements for a database server in a farm The 64-bit edition of Windows Server 2008 R2 Service Pack 1 (SP1) Standard, Enterprise, or Datacenter or the 64-bit edition of Windows Server 2012 Standard or Datacenter Minimum requirements for a single server with built-in database: The 64-bit edition of Windows Server 2008 R2 Service Pack 1 (SP1) Standard, Enterprise, or Datacenter or the 64-bit edition of Windows Server 2012 Standard or Datacenter Minimum requirements for front-end web servers and application servers in a farm: The 64-bit edition of Windows Server 2008 R2 Service Pack 1 (SP1) Standard, Enterprise, or Datacenter or the 64-bit edition of Windows Server 2012 Standard or Datacenter. |
| Microsoft System Center Configuration Manager 2012 | System Center 2012 Configuration Manager Service Pack 1: Microsoft will add the following operating systems to our client support matrix with the release of Service Pack 1: - Windows 8 Pro - Windows 8 Enterprise - Windows Server 2012 Standard - Windows Server 2012 Datacenter All site server roles - including site servers, SMS providers, and management points - can be deployed to servers with the following operating system editions: - Windows Server 2012 Standard - Windows Server 2012 Datacenter |
| Microsoft Lync Server 2013 | Lync Server 2013 requires with Windows Server 2008 R2 or Windows Server 2012. It cannot be run on a Server Core installation. It can be run on virtual servers. |
| Lync Server 2010 | Lync Server 2010 can be installed on a new (not upgraded) installation Windows Server 2012 if October 2012 cumulative updates for Lync Server are installed. Upgrading the operating system to Windows Server 2012 for an existing installation of Lync Server 2010 is not supported. Microsoft Lync Server 2010 Group Chat Server is also not supported on Windows Server 2012. |
| System Center 2012 Endpoint Protection | System Center 2012 Endpoint Protection Service Pack 1 will update the client support matrix to include the following operating systems - Windows 8 Pro - Windows 8 Enterprise - Windows Server 2012 Standard - Windows Server 2012 Datacenter |
| System Center 2012 Forefront Endpoint Protection | FEP 2010 with Update Rollup 1 will update the client support matrix to include the following operating systems: - Windows 8 Pro - Windows 8 Enterprise - Windows Server 2012 Standard - Windows Server 2012 Datacenter |
| Forefront Threat Management Gateway (TMG) | TMG is supported to run only on Windows Server 2008 and Windows Server 2008 R2. For more information, see System requirements for Forefront TMG. |
| Windows Server Update Services | This release of WSUS already supports Windows 8-based computers or Windows Server 2012-based computers as clients. |
| Windows Server Update Services 3.0 | Update KB article 2734608 lets servers that are running Windows Server Update Services (WSUS) 3.0 SP2 provide updates to computers that are running Windows 8 or Windows Server 2012: Note: Customers with standalone WSUS 3.0 SP2 environments or System Center Configuration Manager 2007 Service Pack 2 environments with WSUS 3.0 SP2 require 2734608 to properly manage Windows 8-based computers or Windows Server 2012-based computers as clients. |
| Exchange 2013 | Windows Server 2012 Standard and Datacenter are supported for the following roles: schema master, global catalog server, domain controller, mailbox and client access server role Forest Functional Level: Windows Server 2003 or higher Source: Exchange 2013 System Requirements |
| Exchange 2010 | Source: Exchange 2010 Service Pack 3 Exchange 2010 with Service Pack 3 can be installed on Windows Server 2012 member servers. Exchange 2010 System Requirements lists the latest supported schema master, global catalog and domain controller as Windows Server 2008 R2. Forest Functional Level: Windows Server 2003 or higher |
| SQL Server 2012 | Source: KB 2681562 SQL Server 2012 RTM is supported on Windows Server 2012. |
| SQL Server 2008 R2 | Source: KB 2681562 Requires SQL Server 2008 R2 with Service Pack 1 or later to install on Windows Server 2012. |
| SQL Server 2008 | Source: KB 2681562 Requires SQL Server 2008 with Service Pack 3 or later to install on Windows Server 2012. |
| SQL Server 2005 | Source: KB 2681562 Not supported to install on Windows Server 2012. |
Known issues
The following table lists known issues related to AD DS installation.
| KB article number and title | Technology area impacted | Issue/description |
| 2830145: SID S-1-18-1 and SID S-1-18-2 can't be mapped on Windows 7 or Windows Server 2008 R2-based computers in a domain environment | AD DS Management/App compat | Applications that map SID S-1-18-1 and SID S-1-18-2, which are new in Windows Server 2012, may fail because the SIDs cannot be resolved on Windows 7-based or Windows Server 2008 R2-based computers. To resolve this issue, install the hotfix on the Windows 7-based and Windows Server 2008 R2-based computers in the domain. |
| 2737129: Group Policy preparation is not performed when you automatically prepare an existing domain for Windows Server 2012 | AD DS Installation | Adprep /domainprep /gpprep is not automatically run as part of installing the first DC that runs Windows Server 2012 in a domain. If it has never been run previously in the domain, it must be run manually. |
| 2737416: Windows PowerShell-based domain controller deployment repeats warnings | AD DS Installation | Warnings can appear during prerequisite validation and then reappear during the installation. |
| 2737424: 'Format of the specified domain name is invalid' error when you try to remove Active Directory Domain Services from a domain controller | AD DS Installation | This error appears if you are removing the last DC in a domain where pre-created RODC accounts still exist. This affects Windows Server 2012, Windows Server 2008 R2, and Windows Server 2008. |
| 2737463: Domain controller does not start, c00002e2 error occurs, or 'Choose an option' is displayed | AD DS Installation | A DC does not start because an administrator used Dism.exe, Pkgmgr.exe, or Ocsetup.exe to remove the DirectoryServices-DomainController role. |
| 2737516: IFM verification limitations in Windows Server 2012 Server Manager | AD DS Installation | IFM verification can have limitations as explained in the KB article. |
| 2737535: Install-AddsDomainController cmdlet returns parameter set error for RODC | AD DS Installation | You can receive an error when you try to attach a server to an RODC account if you specify arguments that are already populated on the pre-created RODC account. |
| 2737560: 'Unable to perform Exchange schema conflict check' error, and prerequisites check fails | AD DS Installation | Prerequisite check fails when you configure the first Windows Server 2012 DC in an existing domain because DCs are missing the SeServiceLogonRight for Network Service or because WMI or DCOM protocols are blocked. |
| 2737797: AddsDeployment module with the -Whatif argument shows incorrect DNS results | AD DS Installation | The -WhatIf parameter shows DNS server will not be installed but it will be. |
| 2737807: The Next button is not available on the Domain Controller Options page | AD DS Installation | The Next button is disabled on the Domain Controller Options page because the IP address of the target DC does not map to an existing subnet or site, or because the DSRM password is not typed and confirmed correctly. |
| 2737935: Active Directory installation stalls at the 'Creating the NTDS settings object' stage | AD DS Installation | The installation hangs because the local Administrator password matches the domain Administrator password, or because networking problems prevent critical replication from completing. |
| 2738060: 'Access is denied' error message when you create a child domain remotely by using Install-AddsDomain | AD DS Installation | You receive the error when you run Install-ADDSDomain with the Invoke-Command cmdlet if the DNSDelegationCredential has a bad password. |
| 2738697: 'The server is not operational' domain controller configuration error when you configure a server by using Server Manager | AD DS Installation | You receive this error when you try to install AD DS on a workgroup computer because NTLM authentication is disabled. |
| 2738746: You receive access denied errors after you log on to a local administrator domain account | AD DS Installation | When you log on using a local Administrator account rather than the built-in Administrator account and then create a new domain, the account is not added to the Domain Admins group. |
| 2743345: 'The system cannot find the file specified' Adprep /gpprep error, or tool crashes | AD DS Installation | You receive this error when you run adprep /gpprep because the infrastructure master is implements a disjoint namespace |
| 2743367: Adprep 'not a valid Win32 application' error on Windows Server 2003, 64-bit version | AD DS Installation | You receive this error because Windows Server 2012 Adprep cannot be run on Windows Server 2003. |
| 2753560: ADMT 3.2 and PES 3.1 installation errors on Windows Server 2012 | ADMT | ADMT 3.2 cannot be installed on Windows Server 2012 by design. |
| 2750857: DFS Replication diagnostic reports do not display correctly in Internet Explorer 10 | DFS Replication | DFS Replication diagnostic report does not display correctly because of changes in Internet Explorer 10. |
| 2741537: Remote Group Policy updates are visible to users | Group Policy | This is due to scheduled tasks run in the context of each user who is logged on. The Windows Task Scheduler design requires an interactive prompt in this scenario. |
| 2741591: ADM files are not present in SYSVOL in the GPMC Infrastructure Status option | Group Policy | GP replication can report 'replication in progress' because GPMC Infrastructure Status does not follow customized filtering rules. |
| 2737880: 'The service cannot be started' error during AD DS configuration | Virtual DC cloning | You receive this error while installing or removing AD DS, or cloning, because the DS Role Server service is disabled. |
| 2742836: Two DHCP leases are created for each domain controller when you use the VDC cloning feature | Virtual DC cloning | This happens because the cloned domain controller received a lease before cloning and again when cloning was complete. |
| 2742844: Domain controller cloning fails and the server restarts in DSRM in Windows Server 2012 | Virtual DC cloning | The cloned DC starts in DSRM because cloning failed for any of a variety of reasons listed in the KB article. |
| 2742874: Domain controller cloning does not re-create all service principal names | Virtual DC cloning | Some three-part SPNs are not recreated on the cloned DC because of a limitation of the domain rename process. |
| 2742908: 'No logon servers are available' error after cloning domain controller | Virtual DC cloning | You receive this error when you try to log on after cloning a virtualized DC because cloning failed and the DC is started in DSRM. Log on as .administrator to troubleshoot the cloning failure. |
| 2742916: Domain controller cloning fails with error 8610 in dcpromo.log | Virtual DC cloning | Cloning fails because the PDC emulator has not performed inbound replication of the domain partition, likely because the role was transferred. |
| 2742927: 'Index was out of range' New-AdDcCloneConfig error | Virtual DC cloning | You receive the error after you run New-ADDCCloneConfigFile cmdlet while cloning virtual DCs, either because the cmdlet was not run from an elevated command prompt or because your access token does not contain the Administrators group. |
| 2742959: Domain controller cloning fails with error 8437: 'invalid parameter was specified for this replication operation' | Virtual DC cloning | Cloning failed because an invalid clone name or a duplicate NetBIOS name was specified. |
| 2742970: DC Cloning fails with no DSRM, duplicate source and clone computer | Virtual DC cloning | The cloned virtual DC boots in Directory Services Repair Mode (DSRM), using a duplicate name as the source DC because the DCCloneConfig.xml file was not created in the correct location or because the source DC was rebooted before cloning. |
| 2743278: Domain controller cloning error 0x80041005 | Virtual DC cloning | The cloned DC boots into DSRM because only one WINS server was specified. If any WINS server is specified, both Preferred and Alternate WINS servers must be specified. |
| 2745013: 'Server is not operational' error message if you run New-AdDcCloneConfigFile in Windows Server 2012 | Virtual DC cloning | You receive this error after you run the New-ADDCCloneConfigFile cmdlet because the server cannot contact a global catalog server. |
| 2747974: Domain controller cloning event 2224 provides incorrect guidance | Virtual DC cloning | Event ID 2224 incorrectly states that managed service accounts must be removed before cloning. Standalone MSAs must be removed but Group MSAs do not block cloning. |
| 2748266: You cannot unlock a BitLocker-encrypted drive after you upgrade to Windows 8 | BitLocker | You receive an 'Application not found' error when you try to unlock a drive on a computer that was upgraded from Windows 7. |
See Also
Recover Domain Controller 2008 R2
Windows Server 2012 Evaluation Resources
Windows Server 2012 Evaluation Guide
Install and Deploy Windows Server 2012