Re: 2003 Server: Changing from 2000 mixed mode to 2003 mode

Hello hretif,

The DNS root servers aren't up to date or can't be updated. The server tries
to use them for accessing werbsites outside your domain if intert connectivity
is given, If not ignore them. You can try to update them(if youhave intrnet
connectivity) on the DNS server properties in the DNS management console,
Root Hints Tab and there use the "copy from server" button and choose your
ISPs DNS server or any other one from the internet.

The system state backup is the minimum to restore AD on the server, so this
is ok. The different size is ok, as the ntds.dit file containing the AD database
isn't the same size on DCs, only the content is the same, but there is also
a called white space, deleted objects for example, that block some space
but is not really used.

Raising the functional level can be done either with the GUI or with ntdsutil,
no need to do it twice and if you compare after the raise with either way,
you will see it show already the new level. So choose one option and you
will be fine. Keep in mind that this of course has to replicate to the other
DC, sgive some time if you don't see it directly on the other DC.

Different SPs aren't a problem, personal i would install SP2 and all latest
patches on the DCs. This is also the recommendation from Microsoft.

The raise you can do on the DC via RDC or directly on the server just where
you are. For updating with SP/patches i prefer to have at least somebody
at the location in case of problems so someone can have a look. Until now
i don't have any problem with updating servers.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Hello Meinolf,
>
> Thanks a lot for your answers.
>
> I have run all commands as recommended. I don't see failures except
> with DNS (end of KRZ\dcdiag.txt). I am wondering why it tries to
> resolve these adresses...
>
> AD Backup has been done, with ntbackup.exe / Sytem State. Is it
> enough? I have done it on both DCs and file size is slightly
> different.
>
> To raise the functional level you write:
> This has to be done through AD UC, AD domains and trusts and the
> Schema
> management console if you use the GUI way
> Is it not enough to use the GUI way? (the snapshot in "test and raise
> DC.pdf"). Must I do it on both DC?
> I have one Server 2003 Standard SP1 and the other is Server 2003 R2
> Standard SP2. Could it be a problem?
>
> And last question: may I do this remotely or would it be better to be
> on site?
>
> Best regards
> Hubert
> "Meinolf Weber [MVP-DS]" <meiweb@(nospam)gmx.de> schrieb im
> Newsbeitrag news: .com...
>
>> Hello hretif,
>>
>> Before starting use the support tools to check that the domain is
>> healhty:
>> dcdiag /v /c /d /e /s:dcname >c:\dcdiag.txt
>> netdiag /v >c:\netdiag.txt [from each DC, netdiag may work but isn't
>> supported
>> with Windows server 2008 and higher]
>> repadmin /showrepl dc* /verbose /all /intersite >c:\repl.txt (if more
>> then
>> one DC exists)
>> dnslint /ad /s "DCipaddress" (http://support.microsoft.com/kb/321045)
>> If everything is error free make sure you have an up-to date- AD
>> aware
>> backup
>> and then you can raise the functional levels. This has to be done
>> through
>> AD UC, AD domains and trusts and the Schema management console if you
>> use
>> the GUI way. For command line it can be done with ntdsutil:
>> http://support.microsoft.com/kb/322692/en-us
>> Best regards
>>
>> Meinolf Weber
>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>> confers
>> no rights.
>> ** Please do NOT email, only reply to Newsgroups
>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>> Hello,
>>>
>>> In the same domain, 2 DCs with replication. Both are currently in
>>> 2000 mixed mode and I have to raise them to 2003 mode.
>>>
>>> 1/ is it enough that I do it only on one of them and through
>>> replication the second will be automatically raised?
>>>
>>> 2/ As I must do it on a production server, is there something to
>>> consider before, to be sure that all goes well?
>>>
>>> Thanks. Hubert
>>>

Hi Meinolf,

Thus, that looks good...

> The DNS root servers aren't up to date or can't be updated. The server
> tries to use them for accessing werbsites outside your domain if intert
> connectivity is given, If not ignore them.
I think I can ignore this. Accessing Internet currently works for those
users which are allowed to.

> Different SPs aren't a problem, personal i would install SP2 and all
> latest patches on the DCs. This is also the recommendation from Microsoft.
If it's ok, I would rather not install SP2 + patches. The danger is to high
that something is not working afterwards (already made the experience...),
with printers or with the main App (16 bit! the reason why we are doing all
new). This server has still to run about 2 months and I want to change as
less as possible.

> The raise you can do on the DC via RDC
Then I will do it via RDC. Will I be ask to restart?

Thanks a lot Meinolf. I have now gain the necessary confidence to do it...

Best regards
Hubert

"Meinolf Weber [MVP-DS]" <meiweb@(nospam)gmx.de> schrieb im Newsbeitrag
news: .com...
> Hello hretif,
>
> The DNS root servers aren't up to date or can't be updated. The server
> tries to use them for accessing werbsites outside your domain if intert
> connectivity is given, If not ignore them. You can try to update them(if
> youhave intrnet connectivity) on the DNS server properties in the DNS
> management console, Root Hints Tab and there use the "copy from server"
> button and choose your ISPs DNS server or any other one from the internet.
>
> The system state backup is the minimum to restore AD on the server, so
> this is ok. The different size is ok, as the ntds.dit file containing the
> AD database isn't the same size on DCs, only the content is the same, but
> there is also a called white space, deleted objects for example, that
> block some space but is not really used.
>
> Raising the functional level can be done either with the GUI or with
> ntdsutil, no need to do it twice and if you compare after the raise with
> either way, you will see it show already the new level. So choose one
> option and you will be fine. Keep in mind that this of course has to
> replicate to the other DC, sgive some time if you don't see it directly on
> the other DC.
>
> Different SPs aren't a problem, personal i would install SP2 and all
> latest patches on the DCs. This is also the recommendation from Microsoft.
>
> The raise you can do on the DC via RDC or directly on the server just
> where you are. For updating with SP/patches i prefer to have at least
> somebody at the location in case of problems so someone can have a look.
> Until now i don't have any problem with updating servers.
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>> Hello Meinolf,
>>
>> Thanks a lot for your answers.
>>
>> I have run all commands as recommended. I don't see failures except
>> with DNS (end of KRZ\dcdiag.txt). I am wondering why it tries to
>> resolve these adresses...
>>
>> AD Backup has been done, with ntbackup.exe / Sytem State. Is it
>> enough? I have done it on both DCs and file size is slightly
>> different.
>>
>> To raise the functional level you write:
>> This has to be done through AD UC, AD domains and trusts and the
>> Schema
>> management console if you use the GUI way
>> Is it not enough to use the GUI way? (the snapshot in "test and raise
>> DC.pdf"). Must I do it on both DC?
>> I have one Server 2003 Standard SP1 and the other is Server 2003 R2
>> Standard SP2. Could it be a problem?
>>
>> And last question: may I do this remotely or would it be better to be
>> on site?
>>
>> Best regards
>> Hubert
>> "Meinolf Weber [MVP-DS]" <meiweb@(nospam)gmx.de> schrieb im
>> Newsbeitrag news: .com...
>>
>>> Hello hretif,
>>>
>>> Before starting use the support tools to check that the domain is
>>> healhty:
>>> dcdiag /v /c /d /e /s:dcname >c:\dcdiag.txt
>>> netdiag /v >c:\netdiag.txt [from each DC, netdiag may work but isn't
>>> supported
>>> with Windows server 2008 and higher]
>>> repadmin /showrepl dc* /verbose /all /intersite >c:\repl.txt (if more
>>> then
>>> one DC exists)
>>> dnslint /ad /s "DCipaddress" (http://support.microsoft.com/kb/321045)
>>> If everything is error free make sure you have an up-to date- AD
>>> aware
>>> backup
>>> and then you can raise the functional levels. This has to be done
>>> through
>>> AD UC, AD domains and trusts and the Schema management console if you
>>> use
>>> the GUI way. For command line it can be done with ntdsutil:
>>> http://support.microsoft.com/kb/322692/en-us
>>> Best regards
>>>
>>> Meinolf Weber
>>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>>> confers
>>> no rights.
>>> ** Please do NOT email, only reply to Newsgroups
>>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>>> Hello,
>>>>
>>>> In the same domain, 2 DCs with replication. Both are currently in
>>>> 2000 mixed mode and I have to raise them to 2003 mode.
>>>>
>>>> 1/ is it enough that I do it only on one of them and through
>>>> replication the second will be automatically raised?
>>>>
>>>> 2/ As I must do it on a production server, is there something to
>>>> consider before, to be sure that all goes well?
>>>>
>>>> Thanks. Hubert
>>>>
>
>

Hello hretif,

Raising functional levels do not require a reboot.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Hi Meinolf,
>
> Thus, that looks good...
>
>> The DNS root servers aren't up to date or can't be updated. The
>> server tries to use them for accessing werbsites outside your domain
>> if intert connectivity is given, If not ignore them.
>>
> I think I can ignore this. Accessing Internet currently works for
> those users which are allowed to.
>
>> Different SPs aren't a problem, personal i would install SP2 and all
>> latest patches on the DCs. This is also the recommendation from
>> Microsoft.
>>
> If it's ok, I would rather not install SP2 + patches. The danger is to
> high that something is not working afterwards (already made the
> experience...), with printers or with the main App (16 bit! the reason
> why we are doing all new). This server has still to run about 2 months
> and I want to change as less as possible.
>
>> The raise you can do on the DC via RDC
>>
> Then I will do it via RDC. Will I be ask to restart?
>
> Thanks a lot Meinolf. I have now gain the necessary confidence to do
> it...
>
> Best regards
> Hubert
> "Meinolf Weber [MVP-DS]" <meiweb@(nospam)gmx.de> schrieb im
> Newsbeitrag news: .com...
>
>> Hello hretif,
>>
>> The DNS root servers aren't up to date or can't be updated. The
>> server tries to use them for accessing werbsites outside your domain
>> if intert connectivity is given, If not ignore them. You can try to
>> update them(if youhave intrnet connectivity) on the DNS server
>> properties in the DNS management console, Root Hints Tab and there
>> use the "copy from server" button and choose your ISPs DNS server or
>> any other one from the internet.
>>
>> The system state backup is the minimum to restore AD on the server,
>> so this is ok. The different size is ok, as the ntds.dit file
>> containing the AD database isn't the same size on DCs, only the
>> content is the same, but there is also a called white space, deleted
>> objects for example, that block some space but is not really used.
>>
>> Raising the functional level can be done either with the GUI or with
>> ntdsutil, no need to do it twice and if you compare after the raise
>> with either way, you will see it show already the new level. So
>> choose one option and you will be fine. Keep in mind that this of
>> course has to replicate to the other DC, sgive some time if you don't
>> see it directly on the other DC.
>>
>> Different SPs aren't a problem, personal i would install SP2 and all
>> latest patches on the DCs. This is also the recommendation from
>> Microsoft.
>>
>> The raise you can do on the DC via RDC or directly on the server just
>> where you are. For updating with SP/patches i prefer to have at least
>> somebody at the location in case of problems so someone can have a
>> look. Until now i don't have any problem with updating servers.
>>
>> Best regards
>>
>> Meinolf Weber
>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>> confers no rights.
>> ** Please do NOT email, only reply to Newsgroups
>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>> Hello Meinolf,
>>>
>>> Thanks a lot for your answers.
>>>
>>> I have run all commands as recommended. I don't see failures except
>>> with DNS (end of KRZ\dcdiag.txt). I am wondering why it tries to
>>> resolve these adresses...
>>>
>>> AD Backup has been done, with ntbackup.exe / Sytem State. Is it
>>> enough? I have done it on both DCs and file size is slightly
>>> different.
>>>
>>> To raise the functional level you write:
>>> This has to be done through AD UC, AD domains and trusts and the
>>> Schema
>>> management console if you use the GUI way
>>> Is it not enough to use the GUI way? (the snapshot in "test and
>>> raise
>>> DC.pdf"). Must I do it on both DC?
>>> I have one Server 2003 Standard SP1 and the other is Server 2003 R2
>>> Standard SP2. Could it be a problem?
>>> And last question: may I do this remotely or would it be better to
>>> be on site?
>>>
>>> Best regards
>>> Hubert
>>> "Meinolf Weber [MVP-DS]" <meiweb@(nospam)gmx.de> schrieb im
>>> Newsbeitrag
>>> news: .com...
>>>> Hello hretif,
>>>>
>>>> Before starting use the support tools to check that the domain is
>>>> healhty:
>>>> dcdiag /v /c /d /e /s:dcname >c:\dcdiag.txt
>>>> netdiag /v >c:\netdiag.txt [from each DC, netdiag may work but
>>>> isn't
>>>> supported
>>>> with Windows server 2008 and higher]
>>>> repadmin /showrepl dc* /verbose /all /intersite >c:\repl.txt (if
>>>> more
>>>> then
>>>> one DC exists)
>>>> dnslint /ad /s "DCipaddress"
>>>> (http://support.microsoft.com/kb/321045)
>>>> If everything is error free make sure you have an up-to date- AD
>>>> aware
>>>> backup
>>>> and then you can raise the functional levels. This has to be done
>>>> through
>>>> AD UC, AD domains and trusts and the Schema management console if
>>>> you
>>>> use
>>>> the GUI way. For command line it can be done with ntdsutil:
>>>> http://support.microsoft.com/kb/322692/en-us
>>>> Best regards
>>>> Meinolf Weber
>>>> Disclaimer: This posting is provided "AS IS" with no warranties,
>>>> and
>>>> confers
>>>> no rights.
>>>> ** Please do NOT email, only reply to Newsgroups
>>>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>>>> Hello,
>>>>>
>>>>> In the same domain, 2 DCs with replication. Both are currently in
>>>>> 2000 mixed mode and I have to raise them to 2003 mode.
>>>>>
>>>>> 1/ is it enough that I do it only on one of them and through
>>>>> replication the second will be automatically raised?
>>>>>
>>>>> 2/ As I must do it on a production server, is there something to
>>>>> consider before, to be sure that all goes well?
>>>>>
>>>>> Thanks. Hubert
>>>>>

Hello Meinolf,

Just a last question: I have just discovered that we have still a Win2000
Client PC running in this environnement. If I raise the functional level to
2003, I will probably have a problem with it (?).

If yes, a quick solution for me would be to stop the replication (we change
nothing any more in current AD) until we have replaced that PC. Thus I would
raise to 2003 only by one DC to be able to go on in the project.

May I ask you which is the cleanest way to disable replication? Like this?:
repadmin /options <DC NAME> -DISABLE_OUTBOUND_REPL
repadmin /options <DC NAME> -DISABLE_INBOUND_REPL

Thanks and regards
Hubert

"Meinolf Weber [MVP-DS]" <meiweb@(nospam)gmx.de> schrieb im Newsbeitrag
news: .com...
> Hello hretif,
>
> Raising functional levels do not require a reboot.
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>> Hi Meinolf,
>>
>> Thus, that looks good...
>>
>>> The DNS root servers aren't up to date or can't be updated. The
>>> server tries to use them for accessing werbsites outside your domain
>>> if intert connectivity is given, If not ignore them.
>>>
>> I think I can ignore this. Accessing Internet currently works for
>> those users which are allowed to.
>>
>>> Different SPs aren't a problem, personal i would install SP2 and all
>>> latest patches on the DCs. This is also the recommendation from
>>> Microsoft.
>>>
>> If it's ok, I would rather not install SP2 + patches. The danger is to
>> high that something is not working afterwards (already made the
>> experience...), with printers or with the main App (16 bit! the reason
>> why we are doing all new). This server has still to run about 2 months
>> and I want to change as less as possible.
>>
>>> The raise you can do on the DC via RDC
>>>
>> Then I will do it via RDC. Will I be ask to restart?
>>
>> Thanks a lot Meinolf. I have now gain the necessary confidence to do
>> it...
>>
>> Best regards
>> Hubert
>> "Meinolf Weber [MVP-DS]" <meiweb@(nospam)gmx.de> schrieb im
>> Newsbeitrag news: .com...
>>
>>> Hello hretif,
>>>
>>> The DNS root servers aren't up to date or can't be updated. The
>>> server tries to use them for accessing werbsites outside your domain
>>> if intert connectivity is given, If not ignore them. You can try to
>>> update them(if youhave intrnet connectivity) on the DNS server
>>> properties in the DNS management console, Root Hints Tab and there
>>> use the "copy from server" button and choose your ISPs DNS server or
>>> any other one from the internet.
>>>
>>> The system state backup is the minimum to restore AD on the server,
>>> so this is ok. The different size is ok, as the ntds.dit file
>>> containing the AD database isn't the same size on DCs, only the
>>> content is the same, but there is also a called white space, deleted
>>> objects for example, that block some space but is not really used.
>>>
>>> Raising the functional level can be done either with the GUI or with
>>> ntdsutil, no need to do it twice and if you compare after the raise
>>> with either way, you will see it show already the new level. So
>>> choose one option and you will be fine. Keep in mind that this of
>>> course has to replicate to the other DC, sgive some time if you don't
>>> see it directly on the other DC.
>>>
>>> Different SPs aren't a problem, personal i would install SP2 and all
>>> latest patches on the DCs. This is also the recommendation from
>>> Microsoft.
>>>
>>> The raise you can do on the DC via RDC or directly on the server just
>>> where you are. For updating with SP/patches i prefer to have at least
>>> somebody at the location in case of problems so someone can have a
>>> look. Until now i don't have any problem with updating servers.
>>>
>>> Best regards
>>>
>>> Meinolf Weber
>>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>>> confers no rights.
>>> ** Please do NOT email, only reply to Newsgroups
>>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>>> Hello Meinolf,
>>>>
>>>> Thanks a lot for your answers.
>>>>
>>>> I have run all commands as recommended. I don't see failures except
>>>> with DNS (end of KRZ\dcdiag.txt). I am wondering why it tries to
>>>> resolve these adresses...
>>>>
>>>> AD Backup has been done, with ntbackup.exe / Sytem State. Is it
>>>> enough? I have done it on both DCs and file size is slightly
>>>> different.
>>>>
>>>> To raise the functional level you write:
>>>> This has to be done through AD UC, AD domains and trusts and the
>>>> Schema
>>>> management console if you use the GUI way
>>>> Is it not enough to use the GUI way? (the snapshot in "test and
>>>> raise
>>>> DC.pdf"). Must I do it on both DC?
>>>> I have one Server 2003 Standard SP1 and the other is Server 2003 R2
>>>> Standard SP2. Could it be a problem?
>>>> And last question: may I do this remotely or would it be better to
>>>> be on site?
>>>>
>>>> Best regards
>>>> Hubert
>>>> "Meinolf Weber [MVP-DS]" <meiweb@(nospam)gmx.de> schrieb im
>>>> Newsbeitrag
>>>> news: .com...
>>>>> Hello hretif,
>>>>>
>>>>> Before starting use the support tools to check that the domain is
>>>>> healhty:
>>>>> dcdiag /v /c /d /e /s:dcname >c:\dcdiag.txt
>>>>> netdiag /v >c:\netdiag.txt [from each DC, netdiag may work but
>>>>> isn't
>>>>> supported
>>>>> with Windows server 2008 and higher]
>>>>> repadmin /showrepl dc* /verbose /all /intersite >c:\repl.txt (if
>>>>> more
>>>>> then
>>>>> one DC exists)
>>>>> dnslint /ad /s "DCipaddress"
>>>>> (http://support.microsoft.com/kb/321045)
>>>>> If everything is error free make sure you have an up-to date- AD
>>>>> aware
>>>>> backup
>>>>> and then you can raise the functional levels. This has to be done
>>>>> through
>>>>> AD UC, AD domains and trusts and the Schema management console if
>>>>> you
>>>>> use
>>>>> the GUI way. For command line it can be done with ntdsutil:
>>>>> http://support.microsoft.com/kb/322692/en-us
>>>>> Best regards
>>>>> Meinolf Weber
>>>>> Disclaimer: This posting is provided "AS IS" with no warranties,
>>>>> and
>>>>> confers
>>>>> no rights.
>>>>> ** Please do NOT email, only reply to Newsgroups
>>>>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>>>>> Hello,
>>>>>>
>>>>>> In the same domain, 2 DCs with replication. Both are currently in
>>>>>> 2000 mixed mode and I have to raise them to 2003 mode.
>>>>>>
>>>>>> 1/ is it enough that I do it only on one of them and through
>>>>>> replication the second will be automatically raised?
>>>>>>
>>>>>> 2/ As I must do it on a production server, is there something to
>>>>>> consider before, to be sure that all goes well?
>>>>>>
>>>>>> Thanks. Hubert
>>>>>>
>
>

Hello hretif,

Functional levels only apply to Domain controllers, not to member servers
or client machines even if a lower OS version is used.

Why will you disable the replication, it is important that all DCs can repliate
always, if they are not able to replicate you run into trouble.

You can disable replication with the repadmin commands.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Hello Meinolf,
>
> Just a last question: I have just discovered that we have still a
> Win2000 Client PC running in this environnement. If I raise the
> functional level to 2003, I will probably have a problem with it (?).
>
> If yes, a quick solution for me would be to stop the replication (we
> change nothing any more in current AD) until we have replaced that PC.
> Thus I would raise to 2003 only by one DC to be able to go on in the
> project.
>
> May I ask you which is the cleanest way to disable replication? Like
> this?:
> repadmin /options <DC NAME> -DISABLE_OUTBOUND_REPL
> repadmin /options <DC NAME> -DISABLE_INBOUND_REPL
> Thanks and regards
> Hubert
> "Meinolf Weber [MVP-DS]" <meiweb@(nospam)gmx.de> schrieb im
> Newsbeitrag news: .com...
>
>> Hello hretif,
>>
>> Raising functional levels do not require a reboot.
>>
>> Best regards
>>
>> Meinolf Weber
>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>> confers no rights.
>> ** Please do NOT email, only reply to Newsgroups
>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>> Hi Meinolf,
>>>
>>> Thus, that looks good...
>>>
>>>> The DNS root servers aren't up to date or can't be updated. The
>>>> server tries to use them for accessing werbsites outside your
>>>> domain if intert connectivity is given, If not ignore them.
>>>>
>>> I think I can ignore this. Accessing Internet currently works for
>>> those users which are allowed to.
>>>
>>>> Different SPs aren't a problem, personal i would install SP2 and
>>>> all latest patches on the DCs. This is also the recommendation from
>>>> Microsoft.
>>>>
>>> If it's ok, I would rather not install SP2 + patches. The danger is
>>> to high that something is not working afterwards (already made the
>>> experience...), with printers or with the main App (16 bit! the
>>> reason why we are doing all new). This server has still to run about
>>> 2 months and I want to change as less as possible.
>>>
>>>> The raise you can do on the DC via RDC
>>>>
>>> Then I will do it via RDC. Will I be ask to restart?
>>>
>>> Thanks a lot Meinolf. I have now gain the necessary confidence to do
>>> it...
>>>
>>> Best regards
>>> Hubert
>>> "Meinolf Weber [MVP-DS]" <meiweb@(nospam)gmx.de> schrieb im
>>> Newsbeitrag
>>> news: .com...
>>>> Hello hretif,
>>>>
>>>> The DNS root servers aren't up to date or can't be updated. The
>>>> server tries to use them for accessing werbsites outside your
>>>> domain if intert connectivity is given, If not ignore them. You can
>>>> try to update them(if youhave intrnet connectivity) on the DNS
>>>> server properties in the DNS management console, Root Hints Tab and
>>>> there use the "copy from server" button and choose your ISPs DNS
>>>> server or any other one from the internet.
>>>>
>>>> The system state backup is the minimum to restore AD on the server,
>>>> so this is ok. The different size is ok, as the ntds.dit file
>>>> containing the AD database isn't the same size on DCs, only the
>>>> content is the same, but there is also a called white space,
>>>> deleted objects for example, that block some space but is not
>>>> really used.
>>>>
>>>> Raising the functional level can be done either with the GUI or
>>>> with ntdsutil, no need to do it twice and if you compare after the
>>>> raise with either way, you will see it show already the new level.
>>>> So choose one option and you will be fine. Keep in mind that this
>>>> of course has to replicate to the other DC, sgive some time if you
>>>> don't see it directly on the other DC.
>>>>
>>>> Different SPs aren't a problem, personal i would install SP2 and
>>>> all latest patches on the DCs. This is also the recommendation from
>>>> Microsoft.
>>>>
>>>> The raise you can do on the DC via RDC or directly on the server
>>>> just where you are. For updating with SP/patches i prefer to have
>>>> at least somebody at the location in case of problems so someone
>>>> can have a look. Until now i don't have any problem with updating
>>>> servers.
>>>>
>>>> Best regards
>>>>
>>>> Meinolf Weber
>>>> Disclaimer: This posting is provided "AS IS" with no warranties,
>>>> and
>>>> confers no rights.
>>>> ** Please do NOT email, only reply to Newsgroups
>>>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>>>> Hello Meinolf,
>>>>>
>>>>> Thanks a lot for your answers.
>>>>>
>>>>> I have run all commands as recommended. I don't see failures
>>>>> except with DNS (end of KRZ\dcdiag.txt). I am wondering why it
>>>>> tries to resolve these adresses...
>>>>>
>>>>> AD Backup has been done, with ntbackup.exe / Sytem State. Is it
>>>>> enough? I have done it on both DCs and file size is slightly
>>>>> different.
>>>>>
>>>>> To raise the functional level you write:
>>>>> This has to be done through AD UC, AD domains and trusts and the
>>>>> Schema
>>>>> management console if you use the GUI way
>>>>> Is it not enough to use the GUI way? (the snapshot in "test and
>>>>> raise
>>>>> DC.pdf"). Must I do it on both DC?
>>>>> I have one Server 2003 Standard SP1 and the other is Server 2003
>>>>> R2
>>>>> Standard SP2. Could it be a problem?
>>>>> And last question: may I do this remotely or would it be better to
>>>>> be on site?
>>>>> Best regards
>>>>> Hubert
>>>>> "Meinolf Weber [MVP-DS]" <meiweb@(nospam)gmx.de> schrieb im
>>>>> Newsbeitrag
>>>>> news: .com...
>>>>>> Hello hretif,
>>>>>>
>>>>>> Before starting use the support tools to check that the domain is
>>>>>> healhty:
>>>>>> dcdiag /v /c /d /e /s:dcname >c:\dcdiag.txt
>>>>>> netdiag /v >c:\netdiag.txt [from each DC, netdiag may work but
>>>>>> isn't
>>>>>> supported
>>>>>> with Windows server 2008 and higher]
>>>>>> repadmin /showrepl dc* /verbose /all /intersite >c:\repl.txt (if
>>>>>> more
>>>>>> then
>>>>>> one DC exists)
>>>>>> dnslint /ad /s "DCipaddress"
>>>>>> (http://support.microsoft.com/kb/321045)
>>>>>> If everything is error free make sure you have an up-to date- AD
>>>>>> aware
>>>>>> backup
>>>>>> and then you can raise the functional levels. This has to be done
>>>>>> through
>>>>>> AD UC, AD domains and trusts and the Schema management console if
>>>>>> you
>>>>>> use
>>>>>> the GUI way. For command line it can be done with ntdsutil:
>>>>>> http://support.microsoft.com/kb/322692/en-us
>>>>>> Best regards
>>>>>> Meinolf Weber
>>>>>> Disclaimer: This posting is provided "AS IS" with no warranties,
>>>>>> and
>>>>>> confers
>>>>>> no rights.
>>>>>> ** Please do NOT email, only reply to Newsgroups
>>>>>> ** HELP us help YOU!!!
>>>>>> http://www.blakjak.demon.co.uk/mul_crss.htm
>>>>>>> Hello,
>>>>>>>
>>>>>>> In the same domain, 2 DCs with replication. Both are currently
>>>>>>> in 2000 mixed mode and I have to raise them to 2003 mode.
>>>>>>>
>>>>>>> 1/ is it enough that I do it only on one of them and through
>>>>>>> replication the second will be automatically raised?
>>>>>>>
>>>>>>> 2/ As I must do it on a production server, is there something to
>>>>>>> consider before, to be sure that all goes well?
>>>>>>>
>>>>>>> Thanks. Hubert
>>>>>>>

> Why will you disable the replication, it is important that all DCs can
> repliate always, if they are not able to replicate you run into trouble.
I wanted to do this so that level raising will not be replicated to that DC
(subsidiary where the 2000 Client is). But as you have confirmed that this
2000 Client will continue to work normally after the level raising, I have
no reasons any more to do this.

Thanks again and have a nice day.
Hubert

<Meinolf Weber [MVP-DS]> schrieb im Newsbeitrag
news: .com...
> Hello hretif,
>
> Functional levels only apply to Domain controllers, not to member servers
> or client machines even if a lower OS version is used.
>
> Why will you disable the replication, it is important that all DCs can
> repliate always, if they are not able to replicate you run into trouble.
>
> You can disable replication with the repadmin commands.
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>> Hello Meinolf,
>>
>> Just a last question: I have just discovered that we have still a
>> Win2000 Client PC running in this environnement. If I raise the
>> functional level to 2003, I will probably have a problem with it (?).
>>
>> If yes, a quick solution for me would be to stop the replication (we
>> change nothing any more in current AD) until we have replaced that PC.
>> Thus I would raise to 2003 only by one DC to be able to go on in the
>> project.
>>
>> May I ask you which is the cleanest way to disable replication? Like
>> this?:
>> repadmin /options <DC NAME> -DISABLE_OUTBOUND_REPL
>> repadmin /options <DC NAME> -DISABLE_INBOUND_REPL
>> Thanks and regards
>> Hubert
>> "Meinolf Weber [MVP-DS]" <meiweb@(nospam)gmx.de> schrieb im
>> Newsbeitrag news: .com...
>>
>>> Hello hretif,
>>>
>>> Raising functional levels do not require a reboot.
>>>
>>> Best regards
>>>
>>> Meinolf Weber
>>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>>> confers no rights.
>>> ** Please do NOT email, only reply to Newsgroups
>>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>>> Hi Meinolf,
>>>>
>>>> Thus, that looks good...
>>>>
>>>>> The DNS root servers aren't up to date or can't be updated. The
>>>>> server tries to use them for accessing werbsites outside your
>>>>> domain if intert connectivity is given, If not ignore them.
>>>>>
>>>> I think I can ignore this. Accessing Internet currently works for
>>>> those users which are allowed to.
>>>>
>>>>> Different SPs aren't a problem, personal i would install SP2 and
>>>>> all latest patches on the DCs. This is also the recommendation from
>>>>> Microsoft.
>>>>>
>>>> If it's ok, I would rather not install SP2 + patches. The danger is
>>>> to high that something is not working afterwards (already made the
>>>> experience...), with printers or with the main App (16 bit! the
>>>> reason why we are doing all new). This server has still to run about
>>>> 2 months and I want to change as less as possible.
>>>>
>>>>> The raise you can do on the DC via RDC
>>>>>
>>>> Then I will do it via RDC. Will I be ask to restart?
>>>>
>>>> Thanks a lot Meinolf. I have now gain the necessary confidence to do
>>>> it...
>>>>
>>>> Best regards
>>>> Hubert
>>>> "Meinolf Weber [MVP-DS]" <meiweb@(nospam)gmx.de> schrieb im
>>>> Newsbeitrag
>>>> news: .com...
>>>>> Hello hretif,
>>>>>
>>>>> The DNS root servers aren't up to date or can't be updated. The
>>>>> server tries to use them for accessing werbsites outside your
>>>>> domain if intert connectivity is given, If not ignore them. You can
>>>>> try to update them(if youhave intrnet connectivity) on the DNS
>>>>> server properties in the DNS management console, Root Hints Tab and
>>>>> there use the "copy from server" button and choose your ISPs DNS
>>>>> server or any other one from the internet.
>>>>>
>>>>> The system state backup is the minimum to restore AD on the server,
>>>>> so this is ok. The different size is ok, as the ntds.dit file
>>>>> containing the AD database isn't the same size on DCs, only the
>>>>> content is the same, but there is also a called white space,
>>>>> deleted objects for example, that block some space but is not
>>>>> really used.
>>>>>
>>>>> Raising the functional level can be done either with the GUI or
>>>>> with ntdsutil, no need to do it twice and if you compare after the
>>>>> raise with either way, you will see it show already the new level.
>>>>> So choose one option and you will be fine. Keep in mind that this
>>>>> of course has to replicate to the other DC, sgive some time if you
>>>>> don't see it directly on the other DC.
>>>>>
>>>>> Different SPs aren't a problem, personal i would install SP2 and
>>>>> all latest patches on the DCs. This is also the recommendation from
>>>>> Microsoft.
>>>>>
>>>>> The raise you can do on the DC via RDC or directly on the server
>>>>> just where you are. For updating with SP/patches i prefer to have
>>>>> at least somebody at the location in case of problems so someone
>>>>> can have a look. Until now i don't have any problem with updating
>>>>> servers.
>>>>>
>>>>> Best regards
>>>>>
>>>>> Meinolf Weber
>>>>> Disclaimer: This posting is provided "AS IS" with no warranties,
>>>>> and
>>>>> confers no rights.
>>>>> ** Please do NOT email, only reply to Newsgroups
>>>>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>>>>> Hello Meinolf,
>>>>>>
>>>>>> Thanks a lot for your answers.
>>>>>>
>>>>>> I have run all commands as recommended. I don't see failures
>>>>>> except with DNS (end of KRZ\dcdiag.txt). I am wondering why it
>>>>>> tries to resolve these adresses...
>>>>>>
>>>>>> AD Backup has been done, with ntbackup.exe / Sytem State. Is it
>>>>>> enough? I have done it on both DCs and file size is slightly
>>>>>> different.
>>>>>>
>>>>>> To raise the functional level you write:
>>>>>> This has to be done through AD UC, AD domains and trusts and the
>>>>>> Schema
>>>>>> management console if you use the GUI way
>>>>>> Is it not enough to use the GUI way? (the snapshot in "test and
>>>>>> raise
>>>>>> DC.pdf"). Must I do it on both DC?
>>>>>> I have one Server 2003 Standard SP1 and the other is Server 2003
>>>>>> R2
>>>>>> Standard SP2. Could it be a problem?
>>>>>> And last question: may I do this remotely or would it be better to
>>>>>> be on site?
>>>>>> Best regards
>>>>>> Hubert
>>>>>> "Meinolf Weber [MVP-DS]" <meiweb@(nospam)gmx.de> schrieb im
>>>>>> Newsbeitrag
>>>>>> news: .com...
>>>>>>> Hello hretif,
>>>>>>>
>>>>>>> Before starting use the support tools to check that the domain is
>>>>>>> healhty:
>>>>>>> dcdiag /v /c /d /e /s:dcname >c:\dcdiag.txt
>>>>>>> netdiag /v >c:\netdiag.txt [from each DC, netdiag may work but
>>>>>>> isn't
>>>>>>> supported
>>>>>>> with Windows server 2008 and higher]
>>>>>>> repadmin /showrepl dc* /verbose /all /intersite >c:\repl.txt (if
>>>>>>> more
>>>>>>> then
>>>>>>> one DC exists)
>>>>>>> dnslint /ad /s "DCipaddress"
>>>>>>> (http://support.microsoft.com/kb/321045)
>>>>>>> If everything is error free make sure you have an up-to date- AD
>>>>>>> aware
>>>>>>> backup
>>>>>>> and then you can raise the functional levels. This has to be done
>>>>>>> through
>>>>>>> AD UC, AD domains and trusts and the Schema management console if
>>>>>>> you
>>>>>>> use
>>>>>>> the GUI way. For command line it can be done with ntdsutil:
>>>>>>> http://support.microsoft.com/kb/322692/en-us
>>>>>>> Best regards
>>>>>>> Meinolf Weber
>>>>>>> Disclaimer: This posting is provided "AS IS" with no warranties,
>>>>>>> and
>>>>>>> confers
>>>>>>> no rights.
>>>>>>> ** Please do NOT email, only reply to Newsgroups
>>>>>>> ** HELP us help YOU!!!
>>>>>>> http://www.blakjak.demon.co.uk/mul_crss.htm
>>>>>>>> Hello,
>>>>>>>>
>>>>>>>> In the same domain, 2 DCs with replication. Both are currently
>>>>>>>> in 2000 mixed mode and I have to raise them to 2003 mode.
>>>>>>>>
>>>>>>>> 1/ is it enough that I do it only on one of them and through
>>>>>>>> replication the second will be automatically raised?
>>>>>>>>
>>>>>>>> 2/ As I must do it on a production server, is there something to
>>>>>>>> consider before, to be sure that all goes well?
>>>>>>>>
>>>>>>>> Thanks. Hubert
>>>>>>>>
>
>

Hello Meinolf,

I will do this FLR next week, but before I wan't to be quite sure about this
Windows2000 Client.

Is it not so that it must have SP4 to be able to communicate with Server
2003? (SMB signing?)

This client is using network shared drives and I want to be sure that after
the FLR no rights problems occur...

Best regards
Hubert

<Meinolf Weber [MVP-DS]> schrieb im Newsbeitrag
news: .com...
> Hello hretif,
>
> Functional levels only apply to Domain controllers, not to member servers
> or client machines even if a lower OS version is used.
>
> Why will you disable the replication, it is important that all DCs can
> repliate always, if they are not able to replicate you run into trouble.
>
> You can disable replication with the repadmin commands.
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>> Hello Meinolf,
>>
>> Just a last question: I have just discovered that we have still a
>> Win2000 Client PC running in this environnement. If I raise the
>> functional level to 2003, I will probably have a problem with it (?).
>>
>> If yes, a quick solution for me would be to stop the replication (we
>> change nothing any more in current AD) until we have replaced that PC.
>> Thus I would raise to 2003 only by one DC to be able to go on in the
>> project.
>>
>> May I ask you which is the cleanest way to disable replication? Like
>> this?:
>> repadmin /options <DC NAME> -DISABLE_OUTBOUND_REPL
>> repadmin /options <DC NAME> -DISABLE_INBOUND_REPL
>> Thanks and regards
>> Hubert
>> "Meinolf Weber [MVP-DS]" <meiweb@(nospam)gmx.de> schrieb im
>> Newsbeitrag news: .com...
>>
>>> Hello hretif,
>>>
>>> Raising functional levels do not require a reboot.
>>>
>>> Best regards
>>>
>>> Meinolf Weber
>>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>>> confers no rights.
>>> ** Please do NOT email, only reply to Newsgroups
>>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>>> Hi Meinolf,
>>>>
>>>> Thus, that looks good...
>>>>
>>>>> The DNS root servers aren't up to date or can't be updated. The
>>>>> server tries to use them for accessing werbsites outside your
>>>>> domain if intert connectivity is given, If not ignore them.
>>>>>
>>>> I think I can ignore this. Accessing Internet currently works for
>>>> those users which are allowed to.
>>>>
>>>>> Different SPs aren't a problem, personal i would install SP2 and
>>>>> all latest patches on the DCs. This is also the recommendation from
>>>>> Microsoft.
>>>>>
>>>> If it's ok, I would rather not install SP2 + patches. The danger is
>>>> to high that something is not working afterwards (already made the
>>>> experience...), with printers or with the main App (16 bit! the
>>>> reason why we are doing all new). This server has still to run about
>>>> 2 months and I want to change as less as possible.
>>>>
>>>>> The raise you can do on the DC via RDC
>>>>>
>>>> Then I will do it via RDC. Will I be ask to restart?
>>>>
>>>> Thanks a lot Meinolf. I have now gain the necessary confidence to do
>>>> it...
>>>>
>>>> Best regards
>>>> Hubert
>>>> "Meinolf Weber [MVP-DS]" <meiweb@(nospam)gmx.de> schrieb im
>>>> Newsbeitrag
>>>> news: .com...
>>>>> Hello hretif,
>>>>>
>>>>> The DNS root servers aren't up to date or can't be updated. The
>>>>> server tries to use them for accessing werbsites outside your
>>>>> domain if intert connectivity is given, If not ignore them. You can
>>>>> try to update them(if youhave intrnet connectivity) on the DNS
>>>>> server properties in the DNS management console, Root Hints Tab and
>>>>> there use the "copy from server" button and choose your ISPs DNS
>>>>> server or any other one from the internet.
>>>>>
>>>>> The system state backup is the minimum to restore AD on the server,
>>>>> so this is ok. The different size is ok, as the ntds.dit file
>>>>> containing the AD database isn't the same size on DCs, only the
>>>>> content is the same, but there is also a called white space,
>>>>> deleted objects for example, that block some space but is not
>>>>> really used.
>>>>>
>>>>> Raising the functional level can be done either with the GUI or
>>>>> with ntdsutil, no need to do it twice and if you compare after the
>>>>> raise with either way, you will see it show already the new level.
>>>>> So choose one option and you will be fine. Keep in mind that this
>>>>> of course has to replicate to the other DC, sgive some time if you
>>>>> don't see it directly on the other DC.
>>>>>
>>>>> Different SPs aren't a problem, personal i would install SP2 and
>>>>> all latest patches on the DCs. This is also the recommendation from
>>>>> Microsoft.
>>>>>
>>>>> The raise you can do on the DC via RDC or directly on the server
>>>>> just where you are. For updating with SP/patches i prefer to have
>>>>> at least somebody at the location in case of problems so someone
>>>>> can have a look. Until now i don't have any problem with updating
>>>>> servers.
>>>>>
>>>>> Best regards
>>>>>
>>>>> Meinolf Weber
>>>>> Disclaimer: This posting is provided "AS IS" with no warranties,
>>>>> and
>>>>> confers no rights.
>>>>> ** Please do NOT email, only reply to Newsgroups
>>>>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>>>>> Hello Meinolf,
>>>>>>
>>>>>> Thanks a lot for your answers.
>>>>>>
>>>>>> I have run all commands as recommended. I don't see failures
>>>>>> except with DNS (end of KRZ\dcdiag.txt). I am wondering why it
>>>>>> tries to resolve these adresses...
>>>>>>
>>>>>> AD Backup has been done, with ntbackup.exe / Sytem State. Is it
>>>>>> enough? I have done it on both DCs and file size is slightly
>>>>>> different.
>>>>>>
>>>>>> To raise the functional level you write:
>>>>>> This has to be done through AD UC, AD domains and trusts and the
>>>>>> Schema
>>>>>> management console if you use the GUI way
>>>>>> Is it not enough to use the GUI way? (the snapshot in "test and
>>>>>> raise
>>>>>> DC.pdf"). Must I do it on both DC?
>>>>>> I have one Server 2003 Standard SP1 and the other is Server 2003
>>>>>> R2
>>>>>> Standard SP2. Could it be a problem?
>>>>>> And last question: may I do this remotely or would it be better to
>>>>>> be on site?
>>>>>> Best regards
>>>>>> Hubert
>>>>>> "Meinolf Weber [MVP-DS]" <meiweb@(nospam)gmx.de> schrieb im
>>>>>> Newsbeitrag
>>>>>> news: .com...
>>>>>>> Hello hretif,
>>>>>>>
>>>>>>> Before starting use the support tools to check that the domain is
>>>>>>> healhty:
>>>>>>> dcdiag /v /c /d /e /s:dcname >c:\dcdiag.txt
>>>>>>> netdiag /v >c:\netdiag.txt [from each DC, netdiag may work but
>>>>>>> isn't
>>>>>>> supported
>>>>>>> with Windows server 2008 and higher]
>>>>>>> repadmin /showrepl dc* /verbose /all /intersite >c:\repl.txt (if
>>>>>>> more
>>>>>>> then
>>>>>>> one DC exists)
>>>>>>> dnslint /ad /s "DCipaddress"
>>>>>>> (http://support.microsoft.com/kb/321045)
>>>>>>> If everything is error free make sure you have an up-to date- AD
>>>>>>> aware
>>>>>>> backup
>>>>>>> and then you can raise the functional levels. This has to be done
>>>>>>> through
>>>>>>> AD UC, AD domains and trusts and the Schema management console if
>>>>>>> you
>>>>>>> use
>>>>>>> the GUI way. For command line it can be done with ntdsutil:
>>>>>>> http://support.microsoft.com/kb/322692/en-us
>>>>>>> Best regards
>>>>>>> Meinolf Weber
>>>>>>> Disclaimer: This posting is provided "AS IS" with no warranties,
>>>>>>> and
>>>>>>> confers
>>>>>>> no rights.
>>>>>>> ** Please do NOT email, only reply to Newsgroups
>>>>>>> ** HELP us help YOU!!!
>>>>>>> http://www.blakjak.demon.co.uk/mul_crss.htm
>>>>>>>> Hello,
>>>>>>>>
>>>>>>>> In the same domain, 2 DCs with replication. Both are currently
>>>>>>>> in 2000 mixed mode and I have to raise them to 2003 mode.
>>>>>>>>
>>>>>>>> 1/ is it enough that I do it only on one of them and through
>>>>>>>> replication the second will be automatically raised?
>>>>>>>>
>>>>>>>> 2/ As I must do it on a production server, is there something to
>>>>>>>> consider before, to be sure that all goes well?
>>>>>>>>
>>>>>>>> Thanks. Hubert
>>>>>>>>
>
>