Re: samba to windows 2008 AD migration

In news:370f6d98-25fa-44cf-8126-,
tgor <>, posted the following:
> I am setting up a test windows 2008 server with AD in a current Samba
> network. I am not going to enable dhcp on the windows 2008 server for
> obvious reasons. I want to test some migration options.
> By installing and setting up AD on this Samba network, can anyone tell
> me if I am going run into any network issues? the original DHCP server
> will still hand out the samba dns info.
> Also, the company that I work for is going to migrate from samba to a
> total windows 2008 AD environment. If anyone has any info on the
> migration, could you please pass it on.


Samba allows a *nix machine to look and act like a Windows machine on the
network. Therefore, you can use ADMT to migrate accounts from a Samba
installed host to AD. ADMT will simply copy accounts to a target domain. If
you are not happy with the results, you can delete them and run it again,
matter of fact over and over until satisfied and understand the process.

More info here:
Chapter 8. Updating Samba-3
Part II. Domain Members, Updating Samba and Migration
http://www.samba.org/samba/docs/man/.../upgrades.html

Also, I'm not what the "obvious reasons" are that you stated concerning not
wanting to use Windows 2008's DHCP service. Part of the first steps towards
migrating to a target, is to stup,configure and begin using the target's
resources, including DNS, DHCP, and possibly WINS, if required. Keep in
mind, AD requires DNS, and Microsoft DNS is best suited for its
requirements. Microsoft DNS also works hand in hand communicating with DHCP
for secure dynamic updates using Kerberos (Samba or others do not support
this security feature), as well as Option 081. Basically it's plug and play.

Keep in mind with AD, it must only use the DNS server that is hosting the AD
zone. Using an ISPs or any other DNS that does not host the zone, even
mixing them in a NIC's properties, will cause numerous issues. It is ok to
forward to an ISP's DNS or some other for external resolution, or
conditional forwarding, but for AD, the DNS servers listed in IP properties
must have some sort of direct reference to the AD zone. This is true for all
domain members (DCs, clients, etc). This is one good reason in such a
migration to use Windows DNS to simplify it and reduce factors that can
cause issues during the migration or down the line.

In addition, a complete understanding of AD would be helpful to know what to
expect. If I may suggest to possibly attend an AD class, it will be
beneficial.

Here are some links to get familiar with ADMT and the migration process, and
what to expect.

---

ADMT to migrate into a new forest/domain:

For Windows 2008:

ADMT v3.1 Guide: Migrating and Restructuring Active Directory Domains
http://www.microsoft.com/downloads/d...displaylang=en

Active Directory Migration Tool version 3.1
http://www.microsoft.com/downloads/d...displaylang=en

Password Export Server version 3.1 (x86)
http://www.microsoft.com/downloads/d...displaylang=en

Password Export Server version 3.1 (x64)
http://www.microsoft.com/downloads/d...displaylang=en

Domain Migration Cookbook - Index and Cover:
http://www.microsoft.com/technet/pro.../cookintr.mspx


--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSA Messaging, MCT
Microsoft Certified Trainer


For urgent issues, you may want to contact Microsoft PSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

In news:a849ea54-2cce-4ec5-b96f-,
tgor <>, posted the following:
> Ace,
>
> Thanks for the reply. I didn't enable dhcp because there is currently
> a dhcp server on the network. So I don't want to deploy the windows
> dhcp until I am ready. I have already a pretty good understanding of
> AD.
>
> One issue that we are running into, I was hoping to keep the same
> domain name. If the current samba domain is "Domain", netbios give me
> "Domain0" when I setup AD. Because "Domain" is already in use.
> "Domain.local" works for the setup for AD.
>
> Thanks,
> Tim

Good to hear you have it all planned out.

As far as the same NetBIOS domain name, that is a difficult one. NetBIOS
broadcasts is discovering that. Also, if you do manage to keep the name,
ADMT won't work because it sees it as a dupe. And you can't even promote a
DC into the Samba realm to try to keep the name. Maybe an LDIFDE or CSVDE
export and import them into a new domain off network? And unfortunately the
new system will have to be off network because of the name collision.

Ace