Recipe 3.11 Moving a Domain Controller to a Different Site

3.11.1 Problem

You want to move a domain controller to a different site.

3.11.2 Solution

3.11.2.1 Using a graphical user interface

1. Open the Active Directory Sites and Services snap-in.

2. In the left pane, expand the site that contains the domain controller.

3. Expand the Servers container.

4. Right-click on the domain controller you want to move and select Move.

5. In the Move Server box, select the site to which the domain controller will be moved and click OK.

3.11.2.2 Using a command-line interface

When using the dsmove command you must specify the DN of the object you want to move. In this case, it needs to be the distinguished name of the server object for the domain controller. The value for the -newparent option is the distinguished name of the Servers container you want to move the domain controller to.

> dsmove "<ServerDN>" -newparent "<NewServersContainerDN>"

For example, the following command would move dc2 from the Default-First-Site-Name site to the Raleigh site.

> dsmove "cn=dc2,cn=servers,cn=Default-First-Site-Name,cn=sites,cn=configuration,[RETURN]  rallencorp" -newparent "cn=servers,cn=Raleigh,cn=sites,cn=configuration,rallencorp"

3.11.2.3 Using VBScript

' This code moves a domain controller to a different site ' ------ SCRIPT CONFIGURATION ------ strDCName      = "<DomainControllerName>"  ' e.g. dc2 strCurrentSite = "<CurrentSiteName>"       ' e.g. Default-First-Site-Name strNewSite     = "<NewSiteName>"           ' e.g. Raleigh ' ------ END CONFIGURATION --------- strConfigDN = GetObject("LDAP://RootDSE").Get("configurationNamingContext") strServerDN = "LDAP://cn=" & strDCName & ",cn=servers,cn=" & _                       strCurrentSite & ",cn=sites," & strConfigDN strNewParentDN = "LDAP://cn=servers,cn=" & strNewSite & ",cn=sites," & _                          strConfigDN set objCont = GetObject(strNewParentDN) objCont.MoveHere strServerDN, "cn=" & strDCName WScript.Echo "Successfully moved " & strDCName & " to " & strNewSite

3.11.3 Discussion

When you install a new domain controller, a server object and nTDSDSA object for the domain controller get added to the site topology. The Knowledge Consistency Checker (KCC) and Intersite Topology Generator (ISTG) use these objects to determine whom the domain controller should replicate with.

A domain controller is assigned to the site that has been mapped to the subnet it is located on. If there is no subnet object that has an address range that contains the domain controller's IP address, the server object is added to the Default-First-Site-Name site. If the domain controller should be in a different site, you'll then need to manually move it. It is a good practice to ensure that a subnet object that matches the domain controller's subnet is already in Active Directory before promoting the server into the forest. That way you do not need to worry about moving it after the fact.

When moving a server object, remember that it has to be moved to a Servers container within a site, not directly under the site itself.

3.11.3.1 Using a command-line interface

In the solution provided, you need to know the current site of the domain controller you want to move. If you do not know the site it is currently in, you can use dsquery to find it. In fact, you can use dsquery in combination with dsmove in a single command line:

> for /F "usebackq" %i in (`dsquery server -name"<DomainControllerName>"`) do dsmove[RETURN] -newparent "cn=servers,cn=Default-First-Site,cn=sites,cn=configuration,<ForestDN>" %i

This command is long so I'll break it up into three parts to clarify it. The first part contains the for command extension that is built into the cmd.exe shell. When the /F "usebackq" syntax is specified, it is typically used to iterate over output from a command and perform certain functions on the output.

for /F "usebackq" %i in

The next part of the for loop contains the data to iterate over. In this case, I use dsquery to return the distinguished name of the server object for dc2.

(`dsquery server -name "<DomainControllerName>"`)

The last part executes a command for each result returned from dsquery. In this case, there should only be one result, so this command will only run once.

do dsmove -newparent "cn=servers,cn=Default-First- Site,cn=sites,cn=configuration,<ForestDN>" %i

3.11.3.2 Using VBScript

Just as with the CLI solution, in the VBScript solution you need to specify which site the server is currently in. If you prefer, you can programmatically query for the current site, as shown in Recipe 3.10.

3.11.4 See Also

Recipe 3.10 for finding a domain controller's site and Recipe 4.17 for moving objects to different containers