When dealing with Active Directory domain controllers that also serve as DNS servers, the decommissioning process requires careful planning to maintain DNS resolution during the transition period. The primary challenge lies in ensuring continuous DNS service while migrating from the old DC to new infrastructure.

This method involves transferring the old DC's IP address to the new server. Here's the technical implementation:

# PowerShell script to add secondary IP to new DC
$newIP = "192.168.1.100" # Old DC's IP
$interfaceIndex = (Get-NetAdapter -Name "Ethernet").ifIndex
New-NetIPAddress -IPAddress $newIP -PrefixLength 24 -InterfaceIndex $interfaceIndex

# Configure DNS to listen on additional IP
Add-DnsServerListenAddress -IPAddress $newIP

Key considerations for this approach:

• Requires temporary IP address overlap during cutover
• Needs ARP cache flushing on network devices
• DNS zones must be properly replicated beforehand

Alternative method keeping DNS on the old server temporarily:

# Configure conditional forwarder on old DNS server
Add-DnsServerConditionalForwarderZone 
    -Name "contoso.com" 
    -MasterServers 192.168.1.200 
    -PassThru

# Verify forwarding configuration
Get-DnsServerForwarder

Implementation notes:

• Easier to implement in heterogeneous environments
• Allows gradual client migration
• Introduces additional hop in DNS resolution

For updating client configurations at scale:

# Batch update DHCP scope options
Set-DhcpServerv4OptionValue -ScopeId 192.168.1.0 
    -DnsServer 192.168.1.200 
    -Force

# Remote client DNS update script
$computers = Get-ADComputer -Filter * | Select-Object -ExpandProperty Name
foreach ($computer in $computers) {
    Invoke-Command -ComputerName $computer -ScriptBlock {
        Set-DnsClientServerAddress -InterfaceIndex (Get-NetAdapter).InterfaceIndex 
            -ServerAddresses ("192.168.1.200","192.168.1.201")
    }
}

Essential verification commands:

# Check DNS resolution health
Test-DnsServer -IPAddress 192.168.1.200 -Context Dns

# Monitor DNS traffic during transition
Get-DnsServerStatistics -ZoneName "contoso.com" -Detail

# Verify DC demotion readiness
Test-ADDSDomainControllerUninstallation -RemoveDns

Transition metrics to monitor:

• DNS query distribution between old and new servers
• Active Directory replication health
• Client connection success rates

Once all clients have migrated and monitoring shows minimal traffic to the old DC:

# Safe demotion procedure
Uninstall-ADDSDomainController -DemoteOperationMasterRole 
    -RemoveApplicationPartition 
    -IgnoreLastDnsServerForZone 
    -Force 
    -NoRebootOnCompletion

# Clean up metadata if needed
NTDSUTIL "metadata cleanup" "connections" "connect to server DC01" "quit" "select operation target" "list sites" "select site 0" "list domains" "select domain 1" "list servers" "select server oldDC" "quit" "remove selected server" "quit" "quit"

---

When dealing with domain controllers that also serve as DNS servers, decommissioning requires careful planning to avoid service disruption. The primary challenge lies in maintaining DNS resolution during the transition period while ensuring Active Directory replication integrity.

Let's examine both methodologies in depth, with technical implementation details:

Method 1: IP Address Reassignment

This approach involves transferring the old DC's IP address to a new server:

# PowerShell example for adding secondary IP
New-NetIPAddress -InterfaceAlias "Ethernet0" -IPAddress "192.168.1.10" 
  -PrefixLength 24 -DefaultGateway 192.168.1.1

Key considerations:

• Requires DNS service binding to the additional IP
• Must update all AD replication partners
• Potential ARP cache issues during cutover

Method 2: DNS Forwarder Configuration

This method keeps DNS running temporarily on the decommissioned server:

# Windows DNS Server forwarder configuration
dnscmd /ResetForwarders 192.168.1.20 /timeout 3 /slave

Implementation notes:

• Works well for gradual client migration
• Creates additional DNS hop
• Requires careful monitoring of DNS performance

For large environments, I recommend a phased approach:

1. First update DHCP scopes with new DNS servers
2. Then migrate static-configured servers in batches
3. Finally handle legacy systems and network devices

Essential PowerShell commands for verification:

# Check DC replication status
repadmin /showrepl

# Verify DNS queries
Resolve-DnsName example.com -Server 192.168.1.10

# Monitor client DNS traffic
Get-DnsServerQueryResolutionPolicy -ZoneName "domain.com"

Here's how we handled a 500-server migration:

# Migration script example
$LegacyDC = "DC01.contoso.com"
$NewDC = "DC02.contoso.com"

# Phase 1: Update DHCP
Set-DhcpServerv4OptionValue -DnsServer $NewDC -Force

# Phase 2: Migrate servers
Import-CSV .\servers.csv | ForEach-Object {
  $NICs = Get-NetAdapter -ComputerName $_.ServerName
  $NICs | Set-DnsClientServerAddress -ServerAddresses $NewDC
}

# Phase 3: Final cleanup
Remove-ADDomainController -Identity $LegacyDC -Demote -LastDomainControllerInDomain:$false

The ideal transition window depends on:

• DNS TTL settings (typically 1 hour for internal zones)
• DHCP lease durations
• Active Directory replication latency