Windows server 2019 upgrade to 2022

Windows Server Active Directory upgrades are a part of administering Windows Server Active Directory infrastructure on-premises.  Currently, businesses may have a mix of Windows Server infrastructure and many are running Windows Server 2019 domain controllers in their environment which currently offer the latest and greatest features in the realm of Windows Server Active Directory infrastructure. As the release of Windows Server 2022 looms near on the horizon, many organizations will be looking at upgrading their existing infrastructure to include Windows Server 2022 on-premises Active Directory domain controllers.  In this Windows Server Active Directory upgrade guide, we will look at the steps involved to upgrade Windows Server 2019 Active Directory to Windows Server 2022.

Microsoft’s Windows Server 2022 operating system will be the latest and most advanced Windows Server operating system to date.  Microsoft has steadily been making their Windows Server operating system more “cloud-aware,” with many more Azure features integrated into the operating system natively.  Microsoft is vouching to have Azure be the management plane for all operations, including on-premises operations with solutions such as Azure Arc and others. 

Using the new capabilities and features unlocked by using Windows Admin Center, Windows Server 2022 will have the most direct integration with Azure of any server operating system.  Microsoft is certainly wanting to get everyone focused on the Azure cloud.  The new integrations with Azure make Windows Server 2022 an easy way that customers get a powerful on-premises operating system with all the Azure bells and whistles offered by Microsoft and unlocked potential with Windows Admin Center.

New Security features

One of the huge themes with Windows Server 2022 is security.  Let’s face it.  Security is on the minds of just about everyone these days, from IT operations, security engineers, and business leaders alike.  Windows Server 2022 integrates the new Secured Core implementation from Microsoft.  What is secured core?  It is a new set of security features at the core of Windows Server 2022 and unlocked by the right hardware underneath the hood, such as TPM 2.0. 

It also includes technologies such from current hardware OEM vendors including Bitlocker, and virtualization-based security (VBS) turned on by default.  With the Secured Core server, these features are enabled out of the box from the OEM manufacturer so when the customer provisions the new hardware, a strong security foundation is enabled by default.

As this guide is focused on Windows Server 2022 Active Directory, as you can imagine, having even better security enabled for physical and virtual domain controllers is certainly a step in the right direction.  Attackers are looking for easy ways to compromise Active Directory environments and user account in general.  Having a better security foundation as provided in Windows Server 2022 helps businesses further protect Active Directory assets. 

What about other Active Directory features found in Windows Server 2022?  You are not going to notice a tremendously different Active Directory interface, experience, or capabilities with Windows Server 2022.  Or, any differences at all. If you are like me, you have seen a trend from Microsoft of decoupling requirements of solutions from Active Directory proper, requiring domain joins, etc, for solutions to work correctly.  Microsoft sees the writing on the wall with future infrastructure.  Businesses will be stitching together infrastructure that exists in on-premises environments, cloud, and edge environments.

The traditional on-premises Active Directory that we have known now for decades is fading into the past as new solutions like Azure Active Directory (Azure AD) are more enticing with the tremendous focus on cloud and cloud-native applications. With remote work being the foreseeable future for most organizations, if not the permanent configuration for employees, traditional connectivity to on-premises infrastructure, including Active Directory domain controllers is no longer realistic. VPN connections for everyone is not considered feasible any longer and contains it own set of security vulnerabilities.

Modern apps, containers, and Kubernetes

Another advancing area of focus and polishing from Microsoft is the area of containers, and specifically Kubernetes.  Kubernetes is certainly where all the interest resides with containerized workloads.  Kubernetes is by far the most powerful and popular container orchestration platform available. Windows Server 2022 will be able to use something known as group Managed Service Accounts (gMSAs) to provide an Active Directory identity to containers. You can do this today with domain-joined hosts, however, this will not be required with Windows Server 2022. Again, this goes back to the point of the traditional Active Directory requirements being phased out.   

So, let’s look at the process to upgrade Windows Server 2019 Active Directory to Windows Server 2022. For this run-through, I am using the Windows Server Insider Preview build 20344. What does this process look like? Well, actually not very different if at all than previous Windows versions. Here I am creating a new Windows Server 2022 VM in vSphere 7.0 Update 2. It is nice that we now have the Microsoft Windows Server 2022 option.

Here, I am joining the Windows Server 2022 server to the Windows Server 2019 Active Directory domain. This is being done after configuring the network on the Windows Server 2022 server for the domain, specifically DNS settings.

As you will see in the following screenshots, the process from Server Manager looks identical to Windows Server 2019. Here I am adding the Active Directory Domain Services (ADDS) role.

Below, I am selecting to Add a domain controller to an existing domain option and entering in the Windows Server 2019 domain.

Next, select the domain controller capabilities and site information as well as configuring the DSRM password.

DNS options.

Choose the replication options, here leaving as the default all domain controller option.

Specify the location of the AD DS database, log files and SYSVOL.

Review the options for the configuration of Active Directory on the Windows Server 2022 server.

Here is a look at the PowerShell script to perform the ADDS configuration.

Running the prerequisite check. AS you will note, there is no schema upgrades or anything listed for Windows Server 2022. It appears the same schema is used as Windows Server 2016 Active Directory, the same as Windows Server 2019.

Transferring Active Directory roles from Windows Server 2019 to Windows Server 2022

The steps below are familiar for most AD admins that have transferred roles before. But, just a quick run through of what this looks like with Windows Server 2022 – no difference. Transferring the RID, PDC, and Infrastructure Master roles below.

Transferring the domain naming master role to Windows Server 2022.

The same process of registering the Schema Management DLL must be performed for transferring the Schema Master role.

Transferring the Schema Master role.

Demoting the Windows Server 2019 Domain Controller

After transferring the roles, I went through the process in Server Manager to demote the Windows Server 2019 domain controller.

After demoting the Windows Server 2019 server, I wanted to check one last time on the Windows Server 2022 server which is now the solely available DC in the lab environment. It shows that Windows Server 2016 is the highest functional level.

Thoughts

Windows Server 2022 is a highly anticipated next release of the Windows Server operating system. It shows Microsoft’s shifting position on what features and functionality should be contained in Windows Server as well as the pivot to Azure integrated and cloud-native technologies.

As shown with the upgrade Windows Server 2019 Active Directory to Windows Server 2022 walkthrough, not much looks to have changed so far with Windows Server 2022 unless they sneak in features between the Insider Preview 20344 and the GA release. As shown, Windows Server 2016 is still the highest functional level for domains and forests at this time. Microsoft is drifting away from requiring Active Directory domain joins for most of their core features with each new Windows Server operating system release. This in itself shows where things are headed.

The post covers the steps upgrade domain controller running on Windows Server 2019 to Windows Server 2022. We will perform an in-place upgrade of a domain controller running on Windows Server.

An in-place upgrade is the solution if you want to keep the same hardware and all the server roles without flattening the server.

When you upgrade domain controller, it allows you to go from an older operating system to a newer one, while keeping your settings, server roles, and data intact.

This article can be used to perform an in-place upgrade of a domain controller running on Windows Server 2019 to Windows Server 2022.

Windows Server 2022 In-Place Upgrade Paths

When you plan to upgrade domain controller on Windows Server, it is important to check the upgrade paths. For example, when you want to do an in-place upgrade of Server 2109 to Server 2022, you first check if it’s a supported upgrade path.

I had published a guide listing all the Windows Server 2019 In-place upgrade paths. Microsoft hasn’t updated in-place upgrade paths for Windows Server 2022 yet. You don’t have to worry as upgrading a domain controller from Windows Server 2019 to Windows Server 2022 is supported.

Info – Windows Server can typically be upgraded through at least one, and sometimes even two, versions. For example, Windows Server 2016 and Windows Server 2019 can both be upgraded to Windows Server 2022.

Pre-requisites for Upgrading Domain Controller

The following list covers a few prerequisites before you upgrade domain controller from Windows Server 2019 to Windows Server 2022.

• Verify the target server meets system requirements – Most important, check the hardware requirements and confirm if your server after the upgrade can run smoothly.
• Verify Application compatibility – There is no easy shortcut for this, you have to manually test the working of applications on a test server.
• Connectivity – Check connectivity to the target server from the computer where you plan to run the in-place upgrade.
• Back up your Server before upgrade – Microsoft recommends that you back up your operating system, apps, and virtual machines before you upgrade domain controller.
• Download Windows Server 2022 – Windows Server 2022 is available for download in Microsoft Evaluation center. However, I recommend downloading the latest and a full version via Microsoft VLSC or Visual Studio subscriptions.

Check the AD Schema Version

When you plan for an in-place upgrade of a domain controller running on Windows Server, the Schema version requires an update to the latest version.

You can quickly open the PowerShell and run the following command to determine the current AD Schema version.

Get-ADObject (Get-ADRootDSE).schemaNamingContext -Property objectVersion

In a separate post, I have covered multiple methods to find the Active Directory Schema version on Windows Server. The post also lists all the AD Schema versions with objectVersion Value.

The AD Schema version of Windows Server 2022 and Windows Server 2019 is 88. So if you are upgrading the domain controller from Windows Server 2019 to Server 2022, you can skip the schema upgrade step as there are no changes with Schema version.

Run Adprep /ForestPrep

The adprep /forestprep prepares a forest for the introduction of a domain controller. You must run this command only once in the forest.

Ensure you run this command on the domain controller that holds the schema operations master role for the forest. You must be a member of all the following groups to run this command :-

• Enterprise Admins group
• Schema Admins group
• Domain Admins group of the domain that hosts the schema master

If you run the adprep /forestprep to upgrade the schema on a domain controller running Windows Server 2019, you see this.

Forest-wide information has already been updated. The Adprep did not attempt to rerun this operation – This means you don’t need to upgrade the schema as it is on latest version.

Forest-wide information has already been updated.
[Status/Consequence]
Adprep did not attempt to rerun this operation

Run Adprep /DomainPrep

You run the adprep /domainprep command after the forestprep command finishes and after the changes replicate to all the domain controllers in the forest.

If you run the adprep /domain to upgrade the schema on a domain controller running Windows Server 2019, you see this.

Domain-wide information has already been updated. The Adprep did not attempt to rerun this operation – This means you don’t need to upgrade the schema as it is on latest version.

Upgrade Domain Controller from Windows Server 2016 to Server 2022

If you are running the AD domain controller on Windows Server 2016, and you want to upgrade to Windows Server 2022, the schema version differs.

Windows Server 2016 has Schema objectVersion Value 87 whereas the schema version of Windows Server 2022 is 88. Hence, you must run the adprep.exe /forestprep to upgrade the schema to the latest version if you are upgrading from Server 2016 to Server 2019.

The adprep tool extends the Active Directory schema and updates permissions as necessary to prepare a forest and domain for a domain controller that runs the Windows Server 2016/2019 operating system.

To upgrade domain controller on Windows Server, you need the Windows Server media. Copy the Windows Server 2022 ISO media to the Windows Server and mount it.

From the Windows Server 2022 setup media, run the setup.exe as administrator.

On the Install Windows Server screen click Next.

To upgrade the operating system to Windows Server 2022, enter the product key and click Next.

On Select Image screen, select the correct operating system image. The Windows Server 2022 Datacenter (Desktop Experience) image is selected. Click Next.

For Applicable notices and license terms, click Accept.

On Choose what to keep screen, select Keep files, settings and apps. If you want to remove the settings, files and apps select Nothing. Click Next.

Note – Ideally, on a server running domain controller role, you should not install applications, especially the third-party software programs.

On Ready to install window, click Install. This begins the Windows Server domain controller upgrade.

Your server will restart several times during the upgrade. It is best to leave the server as it and let it complete the in-place upgrade.

The domain controller upgrade usually takes time to complete depending upon the size of your infrastructure. There are several factors that determine the time required to upgrade a domain controller.

After a couple of restarts, the Windows Server 2016 running the domain controller is upgraded to Windows Server 2022.

You can verify the Windows Server edition by opening About My PC. In the below screenshot, you see that the edition is Windows Server 2022 datacenter and version is 21H2.

And yes, the Windows.old folder is created on the C: drive after you perform domain controller upgrade.