Pepuri Server world Eng Version

This time, we will cover the topic of ADFS & WAP Upgrade & Migration.

As indicated in the title, the upgrade and migration will be performed from Windows Server 2022 to 2025.

For reference, the ADFS configured on Windows Server 2022 will be referred to as ADFS2022, and the WAP configured on Windows Server 2025 will be called WAP2025.

 

Youtube: https://youtu.be/BYR4fl7o29o

 

 

Step 1. Installing ADFS 2025

 

First, join the server where you will install ADFS to the Active Directory.

 

 

Go to Server Manager -> Add Roles and Features.

 

 

Proceed with installing the Active Directory Federation Services role.

 

 

Click Install.

 

 

Next, select Configure the federation service on this server.

 

 

Choose Add a federation server to a federation server farm.

 

 

Click Change and enter the credentials of a Domain Admin account.

 

 

Enter the information of the existing ADFS server.

 

 

Specify the certificate (ensure the certificate installation has been completed beforehand).

 

 

Provide the ADFS service account details.

 

 

Proceed with the installation process.

 

 

Close

 

 

Once the installation is complete, launch AD FS Management.

 

 

You will see that the current server is set as Secondary. A switch between Primary and Secondary needs to be performed.

 

 

On the newly installed 2025 server, run the following command to switch it to Primary:

Set-AdfsSyncProperties -Role PrimaryComputer

 

 

To change the existing ADFS 2022 server to Secondary, run this command on the 2022 server:

Set-AdfsSyncProperties -Role SecondaryComputer -PrimaryComputerName <2025서버>

 

 

When you open the management console on ADFS 2022, you will see it is now set as Secondary.

 

 

On ADFS 2025, confirm that it has switched to Primary.

 

 

Finally, update the internal DNS to point the ADFS address to the new server’s IP.

 

 

Step 2. Remove the Existing ADFS 2022

 

 

From the Roles installation menu, start the Remove Roles and Features Wizard.

 

 

Uncheck the Active Directory Federation Services role and proceed with the removal.

 

 

Close

 

 

Once the removal is complete, change the server’s membership from the domain to a Workgroup.

 

 

Step 3. Install WAP2025

 

 

Open the hosts file on the existing WAP2022 server with Notepad, copy its contents, and save it to the WAP2025 server.

 

 

Note that while published configurations are migrated, certificates are not included, so make sure to back up and import each certificate separately.

 

 

On WAP2025, proceed to install the Remote Access Role.

 

 

Check Web Application Proxy and continue with the installation.

 

 

Open the Web Application Proxy Wizard

 

 

Enter the ADFS service URL and credentials.

 

 

Select the pre-installed certificate.

 

 

Configure

 

 

Close

 

 

The interface will display as if a cluster is configured.

 

 

You can verify the current connected servers with the command:

 

 

Similar to 2019 and 2022 versions, the Configuration Version remains as Windows Server 2016.

 

Step 4. Remove WAP2022

 

 

On WAP2022, start the Remove Roles and Features Wizard.

 

 

Uncheck the Remote Access – Web Application Proxy role and proceed with removal.

 

 

Update the currently connected server information using the following command on WAP2025:

Set-WebApplicationProxyConfiguration -ConnectedServersName <WAP2025>

 

 

Confirm that the connection information has been updated correctly.

 

 

Successful login was also confirmed via Office.com, indicating that no additional action is required in Entra ID Connect and no major issues are expected.

https://youtu.be/TDQl9q3wMk0

 

 

Taking advantage of the release of Windows Server 2025, I’m planning to rewrite my previously posted test environment configuration. This time, I’ll pay more attention to creating a YouTube video as well.

Since Windows Server 2016, the methods and UI for configuring a Domain Controller (DC) have remained almost the same. However, engineers who are just starting out often prefer to work with the latest version, and there’s a tendency to assume that if the version numbers differ, the configuration steps might differ too. To address this, I’ve written a configuration guide for Windows Server 2025, even though the content is essentially the same.

 

This time, I’ll focus on Domain Controller (DC) configuration, and if time permits, I’ll proceed with an Exchange setup as well.

For the virtual machine (VM) specifications, I’ve allocated 4 cores for the CPU and 4GB of RAM. In the past, 2GB used to suffice, but it seems insufficient for recent demands.

 

 

Please refer to my previous posts or videos for instructions on installing Windows Server 2025 and performing Sysprep.

Navigate to Server Manager -> Local Server -> Click on Computer Name.

 

 

Change

 

 

Change the computer name to something that clearly identifies it as a Domain Controller. -> The system will reboot.

 

 

Local Server -> Ethernet

 

 

Right-click on Network Adapter -> Select Properties.

 

 

Select IPv4.

 

 

Enter the IP address according to your environment. Set the DNS to point to the IP address of the Domain Controller itself.

 

 

Server Manager -> Dashboard -> Add roles and features

 

 

Next

 

 

Next

 

 

Next

 

 

Check Active Directory Domain Services.

 

 

Add Features

 

 

Next

 

 

Next

 

 

Next

 

 

Install

 

 

Promote Domain Controller

 

 

Add a new forest -> Root domain name 입력 -> Next

 

 

For reference, the reason for adding "Corp" before the domain name is based on Microsoft's Best Practices. From a personal perspective, adding "corp" has the following advantages:

1. It allows for separation of internal and external DNS, as the root domain might serve as the homepage in browsers.

2. Using ".local" in domains like "contoso.local" prevents the use of public certificates.

After creating the DSRM Password, proceed to Next. Until Windows Server 2022, the functional level was set to 2016, but it has now been upgraded to 2025 in Windows Server 2025.

 

 

Next

 

 

Next

 

 

Next

 

 

Next

 

 

Install

 

 

DC configuration is complete.

 

 

Click Close, and the system will reboot shortly after.

 

 

Log in using the Domain account as shown below.

 

 

Active Directory Domains and Trusts

 

 

Right-click on Active Directory Domains and Trusts -> Select Properties.

 

 

Enter the domain to be used for user accounts -> Click Add -> Click OK.

 

 

Run Active Directory Users and Computers (ADUC).

 

 

Right-click on the Domain -> Select New -> Choose Organizational Unit (OU).

 

 

Create an Organizational Unit (OU) for service accounts.

 

 

Right-click on the newly created OU -> Select New -> Choose User.

 

 

Create an Admin account to be used on the DC as shown below. (It is recommended not to use the default Administrator account for security purposes.)

 

 

Enter the password -> Click Next.

 

 

Finish

 

 

Right-click on the newly created account -> Select Properties.

 

 

Go to the Member Of tab -> Click Add -> Search for and add the following groups:

 

 

Sign out and verify if you can log in using the newly created account.

 

 

Proceed with setting up a Secondary DC. While not mandatory in a test environment, having at least two Domain Controllers is essential in a production environment for redundancy and reliability.

 

 

As before, change the Computer Name.

 

 

Set the DNS of the Network Adapter to point to the Main DC.

 

 

Server Manager -> Local Server -> WORKGROUP

 

 

Change

 

 

Enter the Domain -> Click OK.

 

 

Enter the DC Service Account that was previously created.

 

 

Sign in

 

 

Add roles and features

 

 

Proceed with the installation of Active Directory Domain Services Roles in the same manner as on the Main DC.

 

 

Unlike before, select Add a domain controller to an existing domain and proceed with the configuration.

 

 

Enter the DSRM Password -> Click Next.

 

 

Next

 

 

Next

 

 

Next

 

 

Next

 

 

Click Install -> Once the installation is complete, the system will reboot.

 

 

For the Secondary DC, update the DNS settings so that the Primary DNS points to itself.

 

 

In Active Directory Users and Computers (ADUC), you can verify that both Domain Controllers are listed.

 

This concludes the post.

Windows Server 2025 has been released.

To take advantage of the new OS, I'll upgrade the AD Domain Controllers DC01 and DC02 to Windows Server 2025.

In a real-world environment, many factors would need to be considered, but since this is a test environment, I will only cover the basic upgrade process.

 

The Windows Server 2025 installation image created earlier using Sysprep was utilized.

Test Environment

 

https://youtu.be/YcF0ztnJJ8A

 

 

The process was carried out in the following steps:

1. DC02: Windows Server 2022 Demote

2. DC02: Windows Server 2025 Promote

3. Change the Master role to DC02.

4. DC01: Windows Server 2022 Demote

5. DC01: Windows Server 2025 Promote

6. Change the Master role back to DC01.

 

 

Step 1. Remove DC02

 

 

Add roles and features

 

 

Start the Remove Roles and Features Wizard

 

 

Next

 

 

Next

 

 

Active Directory Domain Services

 

 

Remove Features

 

 

Demote this domain controller

 

 

Next

 

 

Proceed with removal -> Next

 

 

Next

 

 

Next

 

 

Demote

 

 

Close

 

 

Close

 

 

Verify that the Domain Controller (DC) has been successfully removed.

 

 

After rebooting, proceed with removing the roles again.

 

 

Switch the machine to WORKGROUP mode.

 

 

Remove DC02 from Active Directory Users and Computers (ADUC).

 

 

Yes

 

 

Step 2. Install the Domain Controller (DC) role on Windows Server 2025.

 

 

Proceed with joining the server to the Active Directory (AD).

 

 

Server Manager -> Add roles and features

 

 

Next

 

 

Next

 

 

Next

 

 

Active Directory Domain Services

 

 

Add Features

 

 

Next

 

 

Next

 

 

Next

 

 

Install

 

 

Promote this server to a domain controller

 

 

Add a domain controller to an existing domain -> Next

 

 

Enter the Password and click Next.

 

 

Next

 

 

Next

 

 

Next

 

 

Next

 

 

Next

 

 

Install

 

 

Once completed, the system will reboot.

 

 

Enter the following command to change the DC Master role to DC02:

Move-ADDirectoryServerOperationMasterRole -Identity DC02 -OperationMasterRole SchemaMaster, DomainNamingMaster, PDCEmulator, RIDMaster, InfrastructureMaster

 

 

Netdom query fsmo

 

 

Step 3. Remove DC01

 

 

Update the DNS Address to point to DC02.

 

 

Server Manager -> Add roles and features

 

 

Start the Remove Roles and Features Wizard

 

 

Next

 

 

Active Directory Domain Services

 

 

Remove Features

 

 

Demote this domain controller

 

 

Next

 

 

Proceed with removal -> Next

 

 

Next

 

 

Enter the Password and click Next.

 

 

Demote

 

 

Close

 

 

After rebooting, navigate back to the Roles and Features removal menu and proceed with the Active Directory Domain Services (AD DS) removal process.

 

 

Click Close and proceed with the system reboot.

 

 

Switch the machine to Workgroup mode.

 

 

Remove DC01 from Active Directory Users and Computers (ADUC).

 

 

Step 4.. Install DC01

 

 

On the new VM for DC01, configure the IP address and set the DNS server to DC02.

 

 

Domain Join

 

 

Add Roles and features

 

 

Next

 

 

Next

 

 

Next

 

 

Active Directory Domain Services -> Next

 

 

Promote this server to a domain controller

 

 

Next

 

 

Enter the Password and click Next.

 

 

Next

 

 

Next

 

 

Next

 

 

Next

 

 

Install

 

 

Click Close, and the system will reboot.

 

 

Set DC01 as the Primary DNS and DC02 as the Alternate DNS.

S and DC02 as the Alternate DNS.

 

 

Run the following command to change the Master role back to DC01:

Move-ADDirectoryServerOperationMasterRole -Identity DC01 -OperationMasterRole SchemaMaster, DomainNamingMaster, PDCEmulator, RIDMaster, InfrastructureMaster

 

 

Netdom query fsmo

 

 

Step 5. Raise Forest Functional Level

Active Directory Domains and Trusts

 

 

In Active Directory Domains and Trusts, right-click and select Raise Forest Functional Level to upgrade the forest functional level.

 

 

Raise

 

 

OK

 

 

Use the following command to verify the current functional level:

Get-ADDomain |fl name, DomainMode
Get-ADForest |fl Name, ForestMode

Windows Server 2025 has been released.

Whenever a new OS is launched, I create a disk image of the installed system using Sysprep to facilitate testing in a Hyper-V environment.

This method is highly convenient because, when creating a new VM, I can simply copy the disk image file to immediately load the OS.

Although I’ve covered this topic before, I’m writing it again as part of a renewal for a YouTube video.

This is based on Windows Server 2025 and Hyper-V.

 

https://youtu.be/snj74akjzCA

 

 

Hyper-V -> New -> Virtual Machine

 

 

Name specification -> Set Default Location -> Next

 

 

Name specification -> Set Default Location -> Next

 

 

Confirm Generation 2 -> Next

(From 2025, Generation 2 is set as the default.)

 

 

Set RAM -> Next

 

 

Specify Network Adapter -> Next

 

 

Confirm Disk Location -> Next

 

 

Specify Installation Disk -> Finish

 

 

Double-click on the created VM

 

 

Start

 

 

Enter the key to proceed with the installation process.

 

 

Select Language -> Next

 

 

Next

 

 

Agree -> Next

 

 

Enter Product Key -> Next (I entered an AVMA key as I am using it in a Hyper-V environment.)

 

 

Accept

 

 

Next

 

 

Install

 

 

Proceed with Installation

 

 

The system will automatically reboot.

 

 

Once the installation is complete, the screen will appear as shown. At this point, press Shift + Ctrl + F3 simultaneously.

 

 

The system will reboot, and the screen will appear as shown. Select OOBE, Generalize, and Shutdown, then click OK.

 

 

Sysprep will run, and once completed, the system will shut down.

 

 

Back up the created VHDX disk image. This disk can be used to streamline the OS installation process.

 

 

You can select the disk image from the menu below to create a new VM.