I'm getting conflicting guidance about moving a Hyper-V guest that runs Active Directory Domain Services to another host. Microsoft documentation warns against using Hyper-V Export for domain controllers because of possible USN rollback, but it also explains that Windows Server 2012 and later can detect a changed virtualization Generation ID and handle an import similarly to a nonauthoritative restore.
Is exporting and importing a domain controller supported on newer Windows Server versions? Is Live Migration safe, including Shared Nothing Live Migration? If neither approach is recommended, is demoting the existing domain controller and building a new one the only reliable option? I'm mainly trying to understand the correct procedure for situations where rebuilding a replacement DC may not be practical.
4 Answers
The Microsoft guidance is confusing because it contains both broad warnings against exporting DCs and newer guidance about Generation ID. On Windows Server 2012 and later, Hyper-V can detect that the VM was imported and treat it like a nonauthoritative restore. Even so, Export is not my first choice for a production DC; use Live Migration or a clean shutdown and move instead, and verify AD replication, DNS, SYSVOL, and event logs afterward.
A normal shutdown followed by moving or copying the VM files to the new host is also commonly used. The important part is to shut the domain controller down cleanly and avoid snapshots or rolling back old disk images. Several environments have moved virtual DCs this way without problems.
Live Migration is generally the cleanest option. The VM keeps running, there’s no export or restore operation, and the virtualization Generation ID should remain consistent. Shared Nothing Live Migration can also be used when moving between hosts without shared storage, assuming the hosts and guest OS meet the normal Hyper-V requirements.
If you do have to recover from an export or backup, be careful about restoring multiple domain controllers from different points in time. That is where directory inconsistencies and USN rollback concerns become serious. In a multi-DC environment, it is often safer to restore one DC and rebuild the others, while making sure the remaining DCs have healthy DNS, replication, and SYSVOL before removing anything.
This should not depend on whether the hosts are in a cluster. Clustering makes migration more convenient, but a properly shut-down VM can still be moved between standalone Hyper-V hosts.