Feb 10 2010

Upgrading an Active Directory Domain from Windows Server 2003 to Windows Server 2008 or Windows Server 2008 R2


If you have installed Exchange 2003 in the domain see the following article first, Exchange requirements otherwise follow the steps below

- On the old server open DNS management console and check that you are running Active directory integrated zone (easier for replication, if you have more then one DNS server)

- run replmon from the run line or repadmin /showrepl(only if more then one DC exist), dcdiag and netdiag from the command prompt on the old machine to check for errors, if you have some solve them first. For this tools you have to install the support\tools\suptools.msi from the 2003 installation disk.

- run adprep /forestprep and adprep /domainprep and adprep /rodcprep from the 2008 installation disk against the 2003 schema master(forestprep) / infrastructure master(domainprep/rodcprep), with an account that is member of the Schema/Enterprise/Domain admins, to upgrade the schema to the new version (44) or 2008 R2 (47). On the Windows Server 2008 R2 disk are adprep32.exe (32bit) and adprep.exe (64bit) located, so make sure to use the correct version.

- see here about adprep in detail (http://technet.microsoft.com/en-us/library/cc731728(WS.10).aspx)

- you can check the schema version with “schupgr” or “dsquery * cn=schema,cn=configuration,dc=domainname,dc=local -scope base -attr objectVersion” without the quotes in a command prompt

- if the first installed DC in the domain should be removed or replaced with another one, doesn’t matter if new or same OS version, then make sure that you export the recovery agents EFS certificate private key from the DC BEFORE you demote/retire it. Details how to do this are listed in (http://support.microsoft.com/kb/241201) and (http://technet.microsoft.com/en-us/library/cc755157(WS.10).aspx) if you do not save the it, you will not be able to encrypt data in case of problems.

- Install the new machine as a member server in your existing domain

- configure a fixed ip and set the preferred DNS server to the old DNS server only, if you think about disabling IPv6 as you are not using it or it was recommended to you, keep attention to the UPDATE. Follow (http://blogs.dirteam.com/blogs/paulbergson/archive/2009/03/19/disabling-ipv6-on-windows-2008.aspx) to disable it, if really required

UPDATE for IPv6 02.06.2011: Keep in mind that IPv6 will become the future protocol and you should get familiar with it. Also the recommendation from Microsoft is to let IPv6 enabled, as some new features/services or applications already require IPv6 to be enabled. Exchange 2010 and DirectAccess are some examples.

- run dcpromo and follow the wizard to add the 2008 server to an existing domain, make it also Global catalog and DNS server.

- for DNS give the server time for replication, at least 15 minutes. Because you use Active directory integrated zones it will automatically replicate the zones to the new server. Open DNS management console to check that they appear

- if the new machine is domain controller and DNS server run again replmon, dcdiag and netdiag (copy the netdiag from the 2003 to 2008, will work) on both domain controllers

- Transfer, NOT seize the 5 FSMO roles to the new Domain controller (http://support.microsoft.com/kb/324801) applies also for 2008), FSMO should always be on the newest OS DC

- after transfer of the PDCEmulator role, configure the NEW PDCEmulator to an external timesource and reconfigure the old PDCEmulator to use the domainhierarchie now. Therefore run on the NEW “w32tm /config /manualpeerlist:PEERS /syncfromflags:manual /reliable:yes /update” where PEERS will be filled with the ip address or server(time.windows.com) and on the OLD one run “w32tm /config /syncfromflags:domhier /reliable:no /update” and stop/start the time service on the old one. All commands run in an elevated command prompt without the quotes.

- you can see in the event viewer (Directory service) that the roles are transferred, also give it some time

- reconfigure the DNS configuration on your NIC of the 2008 server, preferred DNS itself, secondary the old one

- if you use DHCP do not forget to reconfigure the scope settings to point to the new installed DNS server

- if needed move the DHCP database to the Windows server 2008 machine, follow (http://support.microsoft.com/kb/962355), for more details see (http://technet.microsoft.com/en-us/library/cc772372.aspx)

Demoting the old DC (if needed)

- reconfigure your clients/servers that they not longer point to the old DC/DNS server on the NIC

- to be sure that everything runs fine, disconnect the old DC from the network and check with clients and servers the connectivity, logon and also with one client a restart to see that everything is ok

- then run dcpromo to demote the old DC, if it works fine the machine will move from the DC’s OU to the computers container, where you can delete it by hand. Can be that you got an error during demoting at the beginning, then uncheck the Global catalog on that DC and try again

- check the DNS management console, that all entries from the machine are disappeared or delete them by hand if the machine is off the network for ever

- also you have to start AD sites and services and delete the old servername under the site, this will not be done during demotion

10 responses so far

10 Responses to “Upgrading an Active Directory Domain from Windows Server 2003 to Windows Server 2008 or Windows Server 2008 R2”

  1.   Master Techon 18 Feb 2011 at 15:44

    Hi MWeber

    Great article that I just used and upgraded my network from 2003 to 2008 R2. One thing, I followed your instructions to the “T” but didn’t know that time.windows.com is no longer a good url for a time server. But I see you now have other articles about that subject that state to use pool.ntp.org. So I got that little problem fixed.

    I think I’m going to have to start reading all of your articles!!!

    Thanks a $1,000,000.


  2.   kediron 11 Mar 2013 at 07:43



  3.   Jeffon 04 Apr 2013 at 16:46

    This guide is worth a million for sure…a pure lifesaver just to make sure nothing is missed. I couldn’t thank you more for writing it. Many thanks!


  4.   Judeon 05 Apr 2013 at 07:43

    This is excellent – thank you! I have successfully added my 2008 domain controller to my environment (2003 domain controller). Eventually I will transfer the FSMO roles to the 2008 server, but to begin with I only added the ADDS roles. My question is should I wait until I’m ready to transfer FMSO roles to add other server roles like ADFS, ADLDS, ADRMS etc?

    Thanks very much!


  5.   Smithg76on 24 May 2014 at 21:43

    Normally I do not read post on blogs, but I wish to say that this writeup very compelled me to try and do it! Your writing style has been surprised me. Thanks, quite great article. caeeddegfdfkdebf


Trackback URI | Comments RSS

Leave a Reply