To add first 2008 R2 64bit Server as DC in 2003 AD Dimaon

Discussion in 'Active Directory' started by Ferg, Jan 15, 2010.

  1. Ferg

    Ferg Guest

    G'Day List,
    Greetings and best wishes.

    In my 2003 AD Domain, I have a Win2008 R2 64bit server running in a VM in my
    Oracle Virtualization environment.

    I would like to promote this new 2008 server to a DC and have it do all the
    DC FSMO roles with the ultimate intent of demoting all 2003 DC and adding
    another 2008 DC.

    I am looking for any and all worthwhile documentation on the subject but
    would more so appreciate feedback from "you" the "experts"
    who reside here. I would like to hear your experiences on this matter.

    Many thanks, and warm regards.
     
    Ferg, Jan 15, 2010
    #1
    1. Advertisements

  2. Ferg

    Ferg Guest

    Thanks. I found answers on the windows.server.migration list.

    Cheers.
     
    Ferg, Jan 15, 2010
    #2
    1. Advertisements

  3. Hello Ferg,

    !!!NEVER START BEFORE HAVING CREATED AND TESTED A BACKUP OF YOUR DATA/MACHINE!!!

    - Do you use any kind of Exchange in the 2003 domain? If yes, which one?

    - On the old server open DNS management console and check that you are running
    Active directory integrated zone (easier for replication, if you have more
    then one DNS server)

    - run replmon from the run line or repadmin /showrepl(only if more then one
    DC exist), dcdiag and netdiag from the command prompt on the old machine
    to check for errors, if you have some post the complete output from the command
    here or solve them first. For this tools you have to install the support\tools\suptools.msi
    from the 2003 installation disk.

    - run adprep /forestprep and adprep /domainprep and adprep /rodcprep from
    the 2008 installation disk against the 2003 schema master(forestprep) / infrastructure
    master(domainprep/rodcprep), with an account that is member of the Schema/Enterprise/Domain
    admins, to upgrade the schema to the new version (44) or 2008 R2 (47)

    - you can check the schema version with "schupgr" or "dsquery * cn=schema,cn=configuration,dc=domainname,dc=local
    -scope base -attr objectVersion" without the quotes in a command prompt

    - Install the new machine as a member server in your existing domain

    - configure a fixed ip and set the preferred DNS server to the old DNS server
    only, think about disabling IPv6 if you are not using it, some known problems
    exist with it. Follow (http://blogs.dirteam.com/blogs/paulbergson/archive/2009/03/19/disabling-ipv6-on-windows-2008.aspx)
    to disable it

    - run dcpromo and follow the wizard to add the 2008 server to an existing
    domain, make it also Global catalog and DNS server.

    - for DNS give the server time for replication, at least 15 minutes. Because
    you use Active directory integrated zones it will automatically replicate
    the zones to the new server. Open DNS management console to check that they
    appear

    - if the new machine is domain controller and DNS server run again replmon,
    dcdiag and netdiag (copy the netdiag from the 2003 to 2008, will work) on
    both domain controllers

    - Transfer, NOT seize the 5 FSMO roles to the new Domain controller (http://support.microsoft.com/kb/324801
    applies also for 2008), FSMO should always be on the newest OS DC

    - after transfer of the PDCEmulator role, configure the NEW PDCEmulator to
    an external timesource and reconfigure the old PDCEmulator to use the domainhierarchie
    now. Therefore run on the NEW "w32tm /config /manualpeerlist:pEERS /syncfromflags:manual
    /reliable:yes /update" where PEERS will be filled with the ip address or
    server(time.windows.com) and on the OLD one run "w32tm /config /syncfromflags:domhier
    /reliable:no /update" and stop/start the time service on the old one. All
    commands run in an elevated command prompt without the quotes.

    - you can see in the event viewer (Directory service) that the roles are
    transferred, also give it some time

    - reconfigure the DNS configuration on your NIC of the 2008 server, preferred
    DNS itself, secondary the old one

    - if you use DHCP do not forget to reconfigure the scope settings to point
    to the new installed DNS server

    - if needed export and import of DHCP database for 2008 choose "netshell
    dhcp backup" and "netshell dhcp restore" command (http://technet.microsoft.com/en-us/library/cc772372.aspx)



    Demoting the old DC (keep in mind that it is recommended to have at least
    2 DC/DNS/GC per domain)

    - reconfigure your clients/servers that they not longer point to the old
    DC/DNS server on the NIC

    - to be sure that everything runs fine, disconnect the old DC from the network
    and check with clients and servers the connectivity, logon and also with
    one client a restart to see that everything is ok

    - then run dcpromo to demote the old DC, if it works fine the machine will
    move from the DC's OU to the computers container, where you can delete it
    by hand. Can be that you got an error during demoting at the beginning, then
    uncheck the Global catalog on that DC and try again

    - check the DNS management console, that all entries from the machine are
    disappeared or delete them by hand if the machine is off the network for ever

    - also you have to start AD sites and services and delete the old servername
    under the site, this will not be done during demotion

    Best regards

    Meinolf Weber
     
    Meinolf Weber [MVP-DS], Jan 16, 2010
    #3
  4. Check out an article I have on upgrading your forest at:
    http://www.pbbergs.com/windows/articles.htm

    --
    Paul Bergson
    MVP - Directory Services
    MCTS, MCT, MCSE, MCSA, Security+, BS CSci
    2008, 2003, 2000 (Early Achiever), NT4
    Microsoft's Thrive IT Pro of the Month - June 2009

    http://www.pbbergs.com

    Please no e-mails, any questions should be posted in the NewsGroup This
    posting is provided "AS IS" with no warranties, and confers no rights.
     
    Paul Bergson [MVP-DS], Jan 18, 2010
    #4
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.