How to Change IP address of Domain Controller (DC)

3.6K

Changing IP addresses on a corporate network may require to change IP address of domain controller (one or more). Responsible for authentication, authorization, DNS resolution on Windows networks, domain controllers are a critical part of the network infrastructure. Therefore, a change of IP address on a domain controller must be properly planned to avoid network problems.

Important! Changing the IP address of a DC is not a recommended operation in modern AD design. In most enterprise environments, the correct approach is to deploy a new DC with the required IP config and demote the old one. This minimizes the risk of breaking anything on your network.

Preparing for Domain Controller IP Address Change

There are a few preparatory steps you need to take before changing the static IP address of a DC:

• Make sure there are at least two AD domain controllers online on your network.
• Perform AD and replication health checks and fix any issues found.
• Check that the IP address of another DC is set as the preferred DNS server in the network adapter settings on all Domain Controllers. On DCs, you should config DNS servers to point to other DCs in the environment. You need to avoid using 127.0.0.1 in multi-DC environments, as it can reduce DNS redundancy and may cause inconsistent name resolution behavior during replication/service restarts.

  

• In the Active Directory Sites and Services console (dssite.msc), check that the new domain controller IP address has an IP subnet associated with the AD site. Create an IP subnet if required.
• After changing the IP address, you need to ensure that the DC is still mapped to the correct AD site. If the new IP belongs to a different subnet, you need to update AD Sites and Services accordingly.

Recommended Approach: Replace the Domain Controller Instead of Changing IP

In modern AD environments, IP address changes on DCs are considered a legacy/exception scenario. Here is the recommended approach:

• Deploy a new DC with the correct IP address
• Allow replication to complete
• Transfer FSMO roles if needed
• Demote the old DC

The approach mentioned above minimizes risk to DNS, Kerberos, and replication topology.

Pay attention that some apps and scripts may have hardcoded references to the DC’s IP address. You should update them after the change to avoid authentication/LDAP binding issues.

How to Change IP Address of a Domain Controller?

Warning. This procedure should only be used in emergency/constrained environments where replacing the DC is not possible.

Note that changing a DC IP address can temporarily disrupt:

• DNS registration (SRV records)
• Kerberos authentication
• LDAP queries
• AD replication topology
• domain join/logon processes

In this example, we are going to change the old static IP address of the domain controller 192.168.1.10 to a new one 192.168.158.10.

1. Connect to the domain controller host console. Depending on your infrastructure, this can be a VM console, iLO, iDRAC, IPMI remote console, etc. Do not use RDP to access the DC as the connection will be lost if the IP is changed.
2. Open the Network Connection Control Panel by running the command ncpa.cpl
3. Open the network connection properties > Internet Protocol Version 4 (TCP/IPv4) > Properties > specify the new IP address of the domain controller. If you change the subnet, change the default gateway IP.

   

4. Click OK > OK to save changes.
5. After changing the IP address, you should check AD replication status using:
   

   repadmin /replsummary
   repadmin /showrepl *

In case IP change is performed, you should update DNS records accordingly. Open a command prompt as an administrator and run the commands:

ipconfig /flushdns
ipconfig /registerdns

To force an update of all the resource records of the domain controller in the DNS (_msdcs, _sites, _tcp, _udp, etc.), run:

nltest /dsregdns

Restarting Netlogon service can help force immediate DNS SRV record update:

net stop netlogon
net start netlogon

Open the DNS Manager snap-in (dnsmgmt.msc) and check that the domain controller’s DNS records in the forward and reverse DNS zones have been updated.

Check the health of the domain controller and replication after 20-30 minutes:

dcdiag /test:replications /v
dcdiag /a

You can use /test:replications to specifically validate AD replication health, and /a to perform a full DC diagnostic check.

Updating Domain Controller IP Address on Clients

Once you have changed the IP address of the domain controller, you will need to update it on all the clients that have been using it. These could be other DCs, computers, network devices (printers, scanners, MFPs, etc).

• Update the preferred DNS server address on other domain controllers that were using the old IP.
  

  

• If you are assigning IP settings to client devices via DHCP, specify a new DNS address in the DHCP scope settings. In order for DHCP clients to receive new IP settings, you must reboot them or run the commands:
  

  ipconfig /renew
  ipconfig /flushdns

• Manually change DNS settings for devices with static IP settings.

Make sure your network clients are able to authenticate on the domain controller with the new IP address. Also, you need to check for stale DNS records associated with the old IP address and remove them if necessary. Make sure that DNS scavenging is enabled to prevent future record conflicts.