Some top­ics seem to pop up at ran­dom inter­vals, one of them being vir­tu­al­iz­ing Microsoft Active Direc­tory Domain Con­troller servers. The ques­tion is often either “Should I vir­tu­al­ize my Domain Con­trollers, and if so should I vir­tu­al­ize all of them?” or “Should I do a P2V (Phys­i­cal 2 Vir­tual) con­ver­sion of my exist­ing Domain Con­trollers, or cre­ate new ones?”

In this post, I’ll be talk­ing about the sec­ond ques­tion. While there is a lot to be said about the first one as well, I’ll leave that for future post.

Most busi­nesses have an exist­ing Active Direc­tory when they decide to vir­tu­al­ize. There might be dif­fer­ent rea­sons for going vir­tual with regards to Active Direc­tory, but in my mind there are close to no sce­nar­ios where I would even con­sider doing a P2V con­ver­sion of an Domain Controller.

The rea­sons for this are plenty:

  • You need to do a cold con­ver­sion
    You absolutely should not do a hot P2V migra­tion of a DC. If you try to hot migra­tion, you will end up with a domain con­troller that is out of sync with the oth­ers, lots of issues and a really painful headache
  • Never power on the old server
    The old server, the one you did a cold P2V migra­tion of, must never be pow­ered back on after the new vir­tual instance is started. If it gets pow­ered back on, you will once again be in a world of hurt.
  • Poten­tial Cleanup prob­lems
    You need to clean up the old dri­ver stack (most P2V tools will do this for you), and you might end up with for instance two net­work cards that share the same IP, one of them hid­den from view and not very eas­ily removed. This could in turn make the DNS ser­vices on a con­verted domain con­troller does bind to the wrong net­work inter­face. And we all know what hap­pens to Active Direc­tory if DNS doesn’t work right.

I’m sure there are many other poten­tial issues as well, like Ker­beros authen­ti­ca­tion or trust fail­ures and so on. This is not a sit­u­a­tion you want to end up in, espe­cially not in your pro­duc­tion environment.

Gabrie van Zan­ten recently pub­lished a recipe for P2V migra­tions of exist­ing Domain Con­trollers, called Vir­tu­al­iz­ing a domain con­troller, how hard can it be? and I’m con­fi­dent that this method would prob­a­bly work out fine.

My ques­tion is this; Why would you want to do this in the first place? It’s not like it’s hard to set up a new Domain Con­troller, make sure it repli­cates prop­erly with the exist­ing phys­i­cal or vir­tual ones, trans­fer any FSMO roles the soon-to-be-decommissioned Domain Con­troller has to the new instance and then safely and timely remove Active Direc­tory from the old server.

Of course, Gabe has a point when he men­tions that the issues you might get with a botched P2V of a Domain Con­troller would be the same as old style bad man­age­ment like using Syman­tec Ghost on a DC and roll back to an old image if some­thing fails, but why risk it at all?

Deploy­ing a new Win­dows Server 2008 R2 VM, run­ning dcpromo and set­ting up DNS does not take a long time, nor is it very com­plex to do.

I have not timed this, but I seri­ously doubt that cre­at­ing a cold P2V migra­tion boot device, shut­ting down the phys­i­cal server, boot­ing the cold migra­tion tool, do the actual P2V con­ver­sion and pow­er­ing on the new VM takes less time than it takes to set up a new VM. You might argue that you will have to install anti-virus and backup agents and pos­si­bly other tools to the new VM as well, but if your infra­struc­ture is some­what rea­son­ably set up with automa­tion tools etc. this should not really be a fac­tor to con­sider. Besides, if you do it this way you have a return path, after all you haven’t removed anything!

In fact, I’m pretty sure this whole post took longer to write than it would take to actu­ally set up a new Domain Con­troller in my pro­duc­tion environment.

My con­clu­sion is, don’t bother risk­ing a P2V of a Domain Con­troller. Set up a new VM instead, it’s easy, quick and risk free.

In other words, as the vSen­sei would say “just because you can, no mean you should”

So Gabe, as far as this one goes; You’re on your own! ;-)

Written by . Christian is the owner of vNinja.net and a Senior Consultant for EVRY ASA, specializing in virtualization. Active twitter user and vSoup.net Virtualization Podcast co-host.