Share via

migrate domain controller from on prem to azure VM through azure migrate

Dattaram Kachale 0 Reputation points
2023-12-18T12:50:23.1833333+00:00

I intend to migrate a domain controller 2012 from on-premises to an Azure VM using Azure Migrate. for migration we have to create local user in source Vm However, the domain controller in question does not have a local account. How should I proceed with this migration?

Azure Migrate
Azure Migrate
A central hub of Azure cloud migration services and tools to discover, assess, and migrate workloads to the cloud.
721 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,958 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,748 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Thameur-BOURBITA 32,596 Reputation points
    2023-12-18T16:21:43.25+00:00

    Hi @Dattaram Kachale

    The recommended approach to migrate a domain controller is to promote a additional domain controller on new Azure VM, move FSMO rôle on it and then demote old domain controller on-premises.

    Please don't forget to accept helpful answer

  2. SadiqhAhmed-MSFT 38,736 Reputation points Microsoft Employee
    2023-12-18T20:23:41.5566667+00:00

    @Dattaram Kachale Thank you for reaching out to us on Microsoft docQ&A platform. Happy to answer any questions you may have!

    I see that you want to migrate DC from on-prem to Azure VM and would like to know if it can be done without a local account.

    Local account is used for pulling software inventory and Dependency analysis. If you are following agentless approach, then you should be able to migrate without local account.

    I understand that you must be concerned about sharing DC user account due to compliance issue. You can even use domain account for the same.

    In case of agent-based migration, you can skip assessment part since, it is a DC so you can directly migrate to recommended SKU in Azure and directly install mobility agent on source server and register it with replication appliance. In this scenario, you just need to create a dummy account.

    User's image

    Refer to the doc here - Migrate machines as physical server to Azure with Azure Migrate. - Azure Migrate | Microsoft Learn

    Note: The answer/suggestions above suits best for cloud only scenario.

    Recommendations: As mentioned by "Thameur-BOURBITA" or create a dedicated secure VNET in Azure with newly deployed AD DS Servers which are protected by NSG's with specific rules. An example of this is in the diagram shown in the link below:

    https://learn.microsoft.com/en-us/azure/architecture/example-scenario/identity/adds-extend-domain

    Allow replication to happen and confirm that all is healthy, then add the new servers as authentication and DNS reference points for your existing servers prior to migration. This of course depends on having connectivity in place via either S2S VPN or ExpressRoute (which I assume you do).

    You would then have separate VNETs in Azure for your App VMs which would also be protected by NSG's.

    Hope this helps. Feel free to write back to us if you have any further concerns in this matter!

    If the response helped, do "Accept Answer" and up-vote it

    0 comments