JA EN
shiichan

AD migration from Windows Server 2016: get the order right and avoid failures!

JP Windows Support ★★★ View Markdown
#microsoft#security#infrastructure

Hey there, it's Shiichan! Today I'm sharing an article about the things to watch out for when migrating Active Directory domain controllers to a newer version of Windows Server. It sounds low-key, but it's packed with points that can cause authentication headaches if you skip them!

JP Windows Support jpwinsup.github.io

What was announced?

This is an article published on the JP Windows Support blog, written by Microsoft's Windows Commercial Support Directory Services team. It lays out the considerations for migrating Windows Server 2016 domain controllers to Windows Server 2022 or 2025, covering both the migration steps and the security updates involved. Windows Server 2016 reaches end of support on January 12, 2027, so the migration needs to be finished before then.

Why it matters

Migrating a domain controller isn't just about upgrading the OS, it also means carrying forward years of accumulated authentication-related security hardening. The longer an environment has been patched, the bigger the gap tends to be between the security features that are on by default in the new OS and the vulnerability mitigations the old environment hasn't caught up on yet. If you add a new domain controller without noticing that gap, it can cause authentication errors or replication trouble, so this is worth knowing ahead of time.

What changes

The article compares two approaches: an in-place upgrade that upgrades the existing domain controller's OS directly, and a rolling upgrade that installs the new OS clean, promotes it into the existing domain, and then demotes the old domain controllers. The article recommends the rolling upgrade, since it lets old and new domain controllers run in parallel and makes rollback easier.

And the single biggest point is this: before adding a domain controller running the new OS, apply the same vulnerability-mitigation updates to the Windows Server 2016 side first. Keeping this order prevents a mismatch in security settings between the old and new domain controllers.

Dive Deep

The article lays out in a table exactly which vulnerability mitigations need to be aligned:

  • CVE-2020-1472 (Netlogon): enforcement mode from February 2021
  • CVE-2021-42287 (Kerberos PAC): enforcement mode from October 2022
  • CVE-2022-37966 / 37967 / 38023 (Kerberos encryption, full PAC signing, Netlogon RPC): rolling out from November 2022 onward
  • KB5014754 (certificate authentication): rolling enforcement from February 2025
  • CVE-2024-26248 / 29056 (PAC validation): rolling enforcement from January 2025
  • CVE-2025-26647 (Kerberos certificate authentication): rolling enforcement from July 2025
  • CVE-2026-20833 (Kerberos RC4): rolling enforcement from April 2026

It also walks through a concrete example of how to move through these one at a time in audit mode while checking event logs, for an environment where Windows Server 2016 has gone a long time without updates.

If you're migrating to Windows Server 2025, there are a few extra things to watch for:

  • If the KRBTGT account doesn't have an AES key, authentication can fail on the new domain controller, since it won't issue RC4-encrypted TGTs
  • New deployments require LDAP signing by default
  • NTLMv1 is removed entirely, so you need to identify dependent systems ahead of time
  • Starting in April 2026, the default encryption for Kerberos service tickets switches to AES

One easy thing to overlook is the SYSVOL replication method. Windows Server 2019 and later no longer support the old FRS method, so you need to check ahead of time with dfsrmig /getglobalstate that the migration to DFSR is complete.

Functional levels also deserve attention: Windows Server 2022 requires a forest functional level of 2008 or higher, and Windows Server 2025 requires both the domain and forest functional level to be 2016 or higher. Neither one is raised automatically, so you need to raise it manually.

Wrap-up

  • Windows Server 2016 reaches end of support on January 12, 2027; a rolling upgrade is the recommended migration path
  • Apply the same vulnerability-mitigation updates to the source environment before adding the target OS, as a firm rule
  • You need to align the staged security mitigations spanning CVE-2020-1472 through CVE-2026-20833
  • Migrating to Windows Server 2025 adds checks for KRBTGT's AES key, mandatory LDAP signing, NTLMv1 removal, and SYSVOL's DFSR migration
  • Especially useful for IT admins running Active Directory domain controllers in their own environment

Related posts