Kind of continuing where solution to this topic has lead me to.

promote 2016 Essentials to domaincontroller - can't contact DC

I am in process of replacing an existing SBS 2008 to a new Windows Server 2016 Essentials within the same Domain. And I do not have much beckground especially in Windows. The step I am at in the Migration process is to add the new Server to the existing Domain (worked) and then promote the Essentials Server to a Domain Controller. I choose the Option to "Add a domain dontroller to an existing domain" and am confronted with the 'Domain Controller Options' which look like this:

[+] Domain Name System (DNS) Server
[+] Global Catalog
[ ] Read only domain Controller (RODC)

I am wondering a Little if RODC shouldn't be checked, as I was not expecting to be the "boss in the ring" with the new Server Right away.


This option, if enabled, would reduce functionality:

  • By default, dcpromo will build a standard DC, which will be writable and will hold a full copy of the AD database.
  • With the "RODC" option enabled, dcpromo will build a restricted DC, which will be read-only and its database will omit some domain secrets (e.g. admins' password hashes).

You must have at least one normal DC, so don't use the RODC option unless you really know you need it.

Note that Active Directory is peer-to-peer, so a newly promoted DC won't take over anything from other DCs, nor will it automatically demote them in any way. Regular replication is done in all directions, except for FSMO roles – those must be transferred manually if you plan on shutting down the previous DC.

Edit: I completely forgot that demoting DCs is a thing. So yeah, demote the old DC before shutting it down (with the new DC online), and that should take care of everything.

  • thx. That's basically what I found elswhere in the meantime. And 'yes' I am planing to take over the domain with this new Server. As much as I know I have 21 days from today to do so (without any clear idea what would happen whether I didn't manage to get everything done during that period). – vrms Jun 15 '18 at 13:59
  • one question I have Right now is whether I can shutdown this new machine (having added it to the domain now and promoted to DC) without affecting anything (I mean can the users still logon to the domain with only the source [and to be replaced] SBS Server which still holds all shares)? Or do I have to make sure the new Server (which does not hold any data, nor is in Control of DHCP thus far) is running if any user wants to work? I'll have to add another HD yet, move it from my Office to the Server room, …. stuff like that – vrms Jun 15 '18 at 14:04
  • When clients try to log in (anywhere in the domain), they'll try both DCs until at least one answers. Having a DC that's powered off would cause occassional login delays (maybe 10-30s), but I don't think it would break anything. (Of course, you must power the new DC on and let it resync with the old DC before killing the old one...) – grawity Jun 15 '18 at 15:01
  • is the mentioned resync process something I have to actively tell the new DC to do, or would it happen in the Background automatically? – vrms Jun 18 '18 at 7:20
  • It's automatic on schedule, but also google "ntds force replication" for ways to trigger it immediately. – grawity Jun 18 '18 at 10:00

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.