I had to completely change the IP range of one location because it was to be connected to our network, and the same IP ranges were already in use. Routing between the locations would therefore have been impossible and I didn’t want to use NAT for this.
The following requirements were specified:
- Active Directory domain should not be migrated.
- Only VPN between the location and HQ
- Need only to consume some Web Applications und Services from HQ
- Location should be remain self-sufficient
The following list shows my thoughts, approaches, and solutions, and is probably not exhaustive.
Preparation for IP change
- Create a reverse lookup zone for the new range in DNS
- Check replication of the new zone to the DNS server
- Create and save DCDIAG
- Check DC replication
- Document static DNS entries
- Check any scripts or services for static IP entries (backups, Netlogon, SMTP, etc.)
- If possible, replace static IP entries with DNS entries and test
- Document devices with fixed IPs (e.g., printers, terminals, etc.) -> manual adjustment required
- Document DHCP options
- Document DHCP reservations
- Create a list of all active IP addresses and associated devices
- Document firewall rules
- Document firewall routing
- Document antivirus scanners or other services that use IP addresses for location detection
Migration of the first DC with FSMO roles
- New IP, subnet, and gateway Configure the following:
- Set WINS and DNS to localhost 172.0.0.1
- Start the WINS and DNS services to perform service binding
- ipconfig /flushdns (clears DNS cache)
- nbtstat -RR (clears WINS cache)
- ipconfig /registerdns (re-register DNS)
- dcdiag /fix (fixes problems in the domain controller and rewrites some entries)
- Check DNS SRV records in DNS and delete old ones if necessary (_GC is important)
- Restart netlogon
Migrate the other Domain Controllers
- Configure the new IP address, subnet mask, and gateway
- Configure WINS and DNS correctly (configure 172.0.0.1 as the second server)
- Start the WINS and DNS services to perform service binding
- ipconfig /flushdns (clears DNS cache)
- nbtstat -RR (clears WINS cache)
- ipconfig /registerdns (re-register DNS)
- dcdiag /fix (fixes problems in the (DC and rewrites some entries)
- Check DNS SRV records in DNS and delete old ones if necessary (_GC is important)
- Restart netlogon
- Test DC replication via „AD Site and Services“ or „Repadmin“
- Run and save dcdiag
- Check the event logs fro errors
Migration DHCP Server
- Delete the old DHCP scope
- Enter the new DHCP scope and configure the options
- Restore previous DHCP reservations
TIP: I’ve written a good guide for migrating the DHCP server, which also covers adjusting the IP range:
Move all DHCP scopes and settings to a new Server – ADMINRALF.DE
Migration of Member Servers, Clients, and Other Devices
- Enter the new IP address, subnet mask, and gateway
- Enter WINS and DNS correctly
- ipconfig /flushdns (if possible)
- nbtstat -RR (if possible)
- ipconfig /registerdns (If possible/necessary)
- Check DNS entries on the DNS servers
- Restart machines, services, or devices if necessary
Other adjustments
- Change static DNS entries to new IPs
- Adjust services and devices that could not be changed to DNS entries
- Adjust firewall rules
- Adjust routing in the firewall and network
- Adjust antivirus software and other services for location detection
- Change also the DNS settings of the first Domain Controller (second should by 127.0.0.1)
Final tests Active Directory
- Check DCDIAG
- Check event logs
- Check all important services (mail, file shares, databases, etc.)
- Check external access (e.g., VPN)
- Check backups
- Check the availability of important devices (UPS, switches, etc.)
Sources of Inforamtion: