Upgrade Order ADDS and ADCS

Hi Wai Yan Oo,

Has your issue been resolved yet? If it has, please consider accepting the answer as it helps others sharing the same problem benefit too. Thank you :)

VPHAN

Wai Yan Oo there is no article explicitly titled "Upgrade AD before CA," this sequence is the mandatory architectural standard derived directly from two official Microsoft document sets: the "Active Directory Certificate Services Migration Guide" and the "Upgrade Domain Controllers to a newer version of Windows Server" documentation. Microsoft's infrastructure framework operates on a strict dependency hierarchy where the foundational identity layer must be fully modernized before updating the tier-one security applications that rely on it.

The official Active Directory Certificate Services Migration Guide explicitly states that an Enterprise Certificate Authority requires a functioning Active Directory environment because it writes its core operational data directly into the Active Directory Configuration partition. When you follow the official deployment and migration steps for a Certificate Authority, Microsoft assumes the underlying directory is already stable and running at your target functional level. Attempting to migrate the Certificate Authority to Windows Server 2022 first violates this dependency chain because the legacy 2012 R2 directory schema lacks the updated definitions required to securely support a Server 2022 Public Key Infrastructure.

Also, the Microsoft documentation for upgrading domain controllers highlights that introducing Windows Server 2022 domain controllers fundamentally alters the forest via the adprep.exe utility. Microsoft emphasizes that schema extensions and domain functional level raises introduce significant backend changes, such as deprecating older cryptographic protocols and enforcing stricter Kerberos authentication defaults. Because your Certificate Authority is deeply integrated into the domain infrastructure, Microsoft's architectural best practice dictates that these directory-level changes must be completed and fully replicated before deploying a new Enterprise CA, ensuring your certificate services are not unpredictably disrupted by underlying directory shifts.

Hi Wai Yan Oo,

Upgrading your Active Directory Domain Services before migrating your Active Directory Certificate Services is the definitively correct approach. Introducing Windows Server 2022 domain controllers requires extending the directory schema, governed by the adprep.exe utility, which updates the dictionary of objects your network understands. Your Certificate Authority stores crucial components like Certificate Templates and Revocation Lists within the Configuration partition, specifically located at the LDAP path CN=Public Key Services,CN=Services,CN=Configuration. By upgrading the domain first, you ensure this central, forest-wide registry operates on modern code with up-to-date security defaults before you introduce a new two-tier infrastructure.

Deploying a Server 2022 PKI onto a 2012 R2 directory risks severe architectural instability. Subsequent domain controller upgrades will introduce stricter cryptographic standards, such as the deprecation of older encryption types and stricter Kerberos ticketing enforcement. These structural changes could unpredictably break your established certificate enrollment and authentication workflows if the PKI is built before the directory is fully modernized.

Your most reliable strategy is to introduce the new 2022 domain controllers, transfer the Flexible Single Master Operations roles, and completely decommission the 2012 R2 servers to successfully raise your functional levels. Once directory replication is fully stable, you can safely deploy your new offline Root CA and Enterprise Subordinate CA on Server 2022, publish the new PKI data into the modernized directory, and phase out the legacy infrastructure in a controlled manner.

Hope this answer has brought you some useful information. If it did, please hit “accept answer”. Should you have any questions, feel free to leave a comment.

VPHAN