Jul 30 2012

Upgrading an Active Directory Domain from Windows Server 2003 or Windows Server 2003 R2 to Windows Server 2012 or Windows Server 2012 R2

!!!NEVER START BEFORE HAVING CREATED AND TESTED A BACKUP OF YOUR DOMAIN/DATA/MACHINE!!!

A new OS Domain Controller installation should always start with the support tools, to check the Domain and Domain Controllers for errors that must be resolved before. The following command line tools and programs will help you to verify if some problems exist within your Domain and the Domain Controllers.

Dcdiag /v /c /d /e /s:DCName >c:\dcdiag.log [please replace DCName with your Domain Controller name]

Repadmin /showrepl dc* /verbose /all /intersite >c:\repl.log ["dc* is a place holder for the starting name of the DCs if they all begin the same (if more than one DC exists)]

Dnslint /ad /s “DCipaddress” [use http://support.microsoft.com/kb/321045 for download and instructions]

ADREPLSTATUS: http://www.microsoft.com/en-us/download/details.aspx?id=30005

——————————————-

On the old server open DNS management console and check that you are running Active directory integrated zones, which is recommended also from Microsoft.

——————————————-

The schema must be updated for the new OS Domain Controller, so even if the update is done automatically you may check it before. Therefore you can use the following command:

“Dsquery * cn=schema,cn=configuration,dc=domain,dc=local -scope base -attr objectVersion” without the quotes in a command prompt [please replace "dc=domain,dc=local" with your Domain Name]. The output number is the Schema objectVersion:

13 = Windows 2000 Server

30 = Windows Server 2003

31 = Windows Server 2003 R2

44 = Windows Server 2008

47 = Windows Server 2008 R2

56 = Windows Server 2012

69 = Windows Server 2012 R2

——————————————–

If the first installed Domain Controller in the domain should be removed or replaced with another one, doesn’t matter if new or same OS version, assure that you export the recovery agents EFS certificate private key from the Domain Controller BEFORE you demote/retire it. Details on how to do this are listed in (http://support.microsoft.com/kb/241201) and (http://technet.microsoft.com/en-us/library/cc755157(WS.10).aspx). If you don’t save it, you will not be able to encrypt data in case of problems.

——————————————–

I recommend installing the new machine as a member server in your existing domain before promoting to Domain Controller. Configure a fixed ip address and set the preferred DNS server to one existing DC/DNS server only. Do not change anything with IPv6, as also recommended from Microsoft in http://technet.microsoft.com/en-us/magazine/2009.07.cableguy.aspx
Do NOT use the new server as DNS server on the NIC until all DNS information is replicated from one existing DC/DNS. If you do it with other DNS servers on the NIC I often have seen that the SYSVOL and NETLOGON shares are not correct created.

——————————————–

To install a new OS Domain Controller running adprep is required and it is located in the Windows server 2012 or Windows Server 2012 R2 installation disk …\support\adprep folder. Here you can also find the schema files. You will realize that there is ONLY adprep.exe and not adprep32.exe anymore. This belongs to the reason that adprep process on earlier OS domains is done automatically during promotion to a Domain Controller.

If you run adprep.exe on 32bit OS Domain Controllers you will see an error message:

clip_image002

——————————————–

The minimum functional level must be at least Windows Server 2003, so NO lower functional levels are allowed anymore.

Please control that the Domain functional level is set to Windows Server 2003, in AD Domains and Trusts right click the “Domain Name”.

clip_image003

Also control that the Forest functional level is set to Windows Server 2003, in AD Domains and Trusts right click “Active Directory Domains and Trusts”.

clip_image004

——————————————–

If you run as known before DCPROMO on a new Windows Server 2012 or Windows Server 2012 R2 you will get an error message, as this is not longer the way to promote a DC. Now the promotion to Domain Controller is done via Server Manager.

clip_image006

——————————————–

Assure to use an account that is member of the Enterprise Admins and install the new Windows Server 2012 or Windows Server 2012 R2 as Domain Member Server if not done already. Now start the Server Manager and choose “Add roles and features”, in “Before you begin” click next, in the “Installation Type” use “Role-based or feature-based installation” and click Next.

clip_image008

Choose the required Server and click Next.

clip_image010

Now check the Active Directory Domain Services and in the upcoming window click the “Add features” button.

clip_image012

Choose Next and add additional features if required.

clip_image014

Click Next.

clip_image016

Click Next and then choose Install.

clip_image018

clip_image020

It may take some time, depending on the hardware.

clip_image022

If the installation is done be aware of the “Promote this server to a domain controller” option in the result pane.

clip_image024

Again a new window opens to configure the DC with all requirements.

clip_image026

Here choose Select and provide the domain credentials or use the already shown account.

clip_image027

Select the domain from the list and click OK.

clip_image028

Click Next.

clip_image030

The Domain controller Options appear and here choose DNS and GC and fill in the DSRM Restore mode password. Also see the Information on top in the yellow line (here already shown as pop up in the left down corner) and then choose Next.

clip_image032

In this step the DNS delegation warning can be ignored, as the Domain Controller is for the already existing domain.

clip_image034

Choose Next and either use the default or select a preferred DC to replicate from. Even IFM (Install from media) is possible at this step.

clip_image036

Do NOT store the Active Directory database, log files, or SYSVOL on a data volume formatted with Resilient File System (ReFS), this is new with Windows Server 2012 or Windows Server 2012 R2. Database, Log file and SYSVOL folder paths must be stored on NTFS data volumes in this window and then choose Next.

clip_image038

Information about forest, schema and domain update is shown where you also choose Next.

clip_image040

Review your settings, even possible to export as Windows PowerShell script for future use, and click Next.

clip_image042

Prerequisite checks will be done.

clip_image044

Review the Check and click Install.

clip_image046

clip_image048

clip_image050

Results are listed/shown.

clip_image052

The server will automatically reboot after installation/promotion.

——————————————–

After adding a Windows Server 2012 or Windows Server 2012 R2 Domain Controller to an existing domain you should also transfer the FSMO roles to the Domain Controller with the newest OS version.

In this case up to 10 new security groups are created/shown in the BUILTIN container in AD UC:
  • Access Control Assistance Operators
  • Certificate Service DCOM Access
  • Cryptographic Operators
  • Event Log Readers
  • Hyper-V Administrators
  • IIS_IUSRS
  • RDS Endpoint Servers
  • RDS Management Servers
  • RDS Remote Access Servers
  • Remote Management Users

And up to 6 new security group in the Users container in AD UC:
  • Allowed RODC Password Replication Group
  • Cloneable Domain Controllers
  • Denied RODC Password Replication Group
  • Enterprise Read-Only Domain Controllers
  • Protected Users
  • Read-Only Domain Controllers

——————————————–

You can see in the event viewer (Directory service log) that the FSMO roles are transferred, EVENT ID 1458 with the source ActiveDirectory_DomainService for each FSMO role.

——————————————–

After the transfer from the PDCEmulator FSMO it is required to reconfigure the time service on the old and new PDCEmulator, so a recommended external time source is used:

“w32tm /config /manualpeerlist:PEERS /syncfromflags:manual /reliable:yes /update”

where PEERS will be filled with the ip address or server name (time.windows.com) and on the OLD PDCEmulator run:

“w32tm /config /syncfromflags:domhier /reliable:no /update”

and stop/start the time service on the old one. All commands run in an elevated command prompt without the quotes.

——————————————–

If not done on earlier OS version upgrades ONLY the adprep /domainprep /gpprep, to enable the RSOP planning mode, should be run manual as this is NOT involved in the automated process.

——————————————–

Reconfigure the DNS configuration on your NIC of the Windows Server 2012 or Windows Server 2012 R2 machine, preferred DNS to a partner DNS Server, secondary to its own ip address and as recommended from DNS BPA the loopback ip address(127.0.0.1) as 3rd entry.

——————————————–

Related documents:

Adprep in Windows Server 2012 http://technet.microsoft.com/en-us/library/hh472161.aspx

View and transfer from FSMO Roles http://support.microsoft.com/kb/324801 this article still applies for Windows Server 2012 and higher.

Time configuration in a domain http://msmvps.com/blogs/mweber/archive/2010/06/27/time-configuration-in-a-windows-domain.aspx

ReFS in Windows Server 2012 http://blogs.msdn.com/b/b8/archive/2012/01/16/building-the-next-generation-file-system-for-windows-refs.aspx

67 responses so far




67 Responses to “Upgrading an Active Directory Domain from Windows Server 2003 or Windows Server 2003 R2 to Windows Server 2012 or Windows Server 2012 R2”

  1.   Elioon 20 Mar 2013 at 09:33

    I had a BlueScreen during the upgrade of the Windows Server 2003 Machine by the PowerShell-Script. So I recommend to do it beside office hours.

    Reply

  2.   Tiloon 11 Apr 2013 at 12:03

    Thanks for the info.

    Set the IP to static and DNS to the existing DC is key otherwise it will hang forever in “replicating critical information”

    cheers

    Reply

  3.   Gaganon 06 May 2013 at 01:03

    what about users roaming profiles and folders redirections do I need to edit each user profile manually. or it will be done automatically done. please advice

    Reply

  4.   Shariqon 14 May 2013 at 01:02

    Dear Meinolf,

    I have seen your post on technet forum and also posted my query regarding the migration but didnt got replies. thats why posting here.

    http://social.technet.microsoft.com/Forums/en-US/winserverMigration/thread/4d543351-ae92-4a27-a3e9-8ccefd8a9d67

    1. Is Windows 2012 Active Directory stable now can i move towards it after testing it in Lab

    2. What is the best practice for migrating to Windows 2012 from Windows 2003 in Lab Environment and then to Production environment
    3. What support tools test are prerequistist before migration
    4. suggest any links for migration
    5. Migration from Windows 2003 to 2012 is better or Win 2003 -> 2008 -> 2012 which scenario is better and more reliable.
    Before upgrading my existing environment i want to test the same on vm player. My plan is to move my physical machine to virtual and use that virtual machine to migrate to 2012 in lab environment. by this my production machine will be running as its working now.
    Any other suggestions are welcomed

    Reply

  5.   M. Akeron 31 Jul 2013 at 08:40

    I dont see these security groups . Which machine should I try to extend the schema. on 2003 or 2012 .

    Access Control Assistance Operators
    Hyper-V Administrators
    RDS Endpoint Servers
    RDS Management Servers
    RDS Remote Access Servers
    Remote Management Users

    Reply

  6.   Jim Smarton 11 Oct 2013 at 14:10

    M
    We have three 2003 DC servers in our AD domain, one server being the PDC. Id like to replace this PDC (called dc3 with a new Server 2012. And would like to maintain the same server name and IP address for this PDC. Any steps I need to add to your GREAT blog?
    Thx
    Jim @ jim.smart@p2c.com

    Reply

  7.   Mitchell Earlon 25 Nov 2013 at 18:44

    Please clarify the statement “Here you can also find the schema files. You will realize that there is ONLY adprep.exe and not adprep32.exe anymore. This belongs to the reason that adprep process on earlier OS domains is done automatically during promotion to a Domain Controller.”

    Can the 32-bit version of Server 2003 have the schema upgraded to allow server 2012 to be a DC or not? If so, is adprep ran on this machine or domes the 2012 DC deployment do this automatically?

    Reply

Trackback URI | Comments RSS

Leave a Reply