wiki: Prairie Schooner server migration state (paused, resume after UniFi swap)

wiki/clients/the-prairie-schooner.md

@@ -32,6 +32,51 @@ GPS client (Syncro cid 3664974). Contact: Tina Coalter, Tucson AZ.
   dead). No current backup anywhere. Pays for backup, nothing is backing up. Do not provision
   off the billing count — per-client decision ([[feedback_backup_targets_never_guessed]]).
 
+## Server migration IN PROGRESS (2026-07-07, paused — resume 2026-07-08 night)
+
+Replacing aging **TPS-SERVER** (Server 2016 Essentials, Lenovo TS140, 3.8 GB RAM, disk
+87% full, sole DC/CA/DNS/file/QuickBooks host) with **TPS-SVR** (Server 2019 Standard,
+HPE MicroServer Gen10+ v2, 32 GB RAM, 5.3 TB). Domain `TPS.local`.
+
+**Done so far:**
+- Full data pre-seed TPS-SERVER -> TPS-SVR `\\TPS-SVR\Share` (`C:\Share`): Quickbooks
+  144 GB + Deployment 22 GB + **clean company file** `schoonerQB2025.QBW` (3 GB, copied
+  with QB service stopped, verified byte-for-byte). QBWebConnector = no real integration.
+- **TPS-SVR promoted to DC** (2nd DC, GC, DNS). AD/DNS **fully replicated** (17 users,
+  11 computers, 6 GPOs, zones), repl **0 errors both ways**. Static IP **192.168.1.135/24**
+  gw .1, DNS = .125 + 127.0.0.1, forwarders 1.1.1.1/8.8.8.8 (dead Norton removed).
+- **OLD TPS-SERVER remains PRIMARY**: holds all 5 FSMO, QB host, file server, the DNS
+  clients use. Users unaffected. Schema was v87 -> promotion adprep'd to v88.
+
+**Key constraints / decisions:**
+- **No SonicWall access.** SonicWall (192.168.1.1) = gateway + DHCP, hands clients
+  DNS=**192.168.1.125** (old DC). Howard replacing it with a **UniFi gateway 2026-07-08**
+  to regain DHCP/DNS control. Until then, retiring old DC would break client DNS.
+- QB references host by **IP in the `.ND`** (`ServerIp=192.168.1.125`) but the `.ND`/`.DSN`
+  regenerate when the hosting server changes — delete stale `.ND` at cutover, verify it
+  shows the new host IP before letting clients in.
+- Q: drive map + deploy GPOs are all keyed to name `\\tps-server` -> keep the name via a
+  DNS+SPN **alias** on the new box (netdom computername /add). No printers/redirection/roaming
+  to migrate. Legacy GPOs (IP SEC, NeT Communication, LT Deployment) defunct -> prune.
+
+**Remaining (resume tomorrow after UniFi swap):**
+1. Transfer 5 FSMO roles to TPS-SVR (briefly re-enable Administrator, then re-disable).
+2. Migrate the **Enterprise Root CA** `TPS-TPS-SERVER-CA` — TEST the non-exportable key
+   export (`Backup-CARoleService`) BEFORE committing; CA still auto-enrolls DC certs.
+3. Configure QB Database Server Manager on TPS-SVR (host `C:\Share\Quickbooks`, service
+   Automatic, regen `.ND`, firewall ports); recreate shares with ACLs (pre-seed was
+   data-only); re-enable Shadow Copies.
+4. With UniFi: point DHCP DNS at the new DC (removes the forced ".125 takeover"); decide
+   final IP (keep .135 + alias, or assume .125). Reserve the DC IP in UniFi DHCP.
+5. Cutover (brief, users out of QB): stop QB on old, final `.QBW` delta copy, verify a
+   workstation opens QB from new server.
+6. Demote + power off old TPS-SERVER; activate TPS-SERVER name alias; clean multi-homing
+   (.120/10.10.10.5 records) + remove unused DHCP/Print roles on new box.
+7. **Stand up a real backup on the new server** (original reason: nothing was backed up).
+
+Creds vaulted: `clients/prairie-schooner/tps-domain-admin` (guru), `.../tps-administrator`
+(built-in Admin, reset to provided pw, now DISABLED again), `.../tps-svr-dsrm` (DSRM).
+
 ## Backlinks
 
 - [[projects/gps-rmm-audit]] — GPS -> GuruRMM coverage audit