Archive for the 'Windows Server 2008 R2' Category

Aug 14 2014

Import Microsoft Custom Support Agreement updates into WSUS

Having a Custom Support Agreement (CSA) with Microsoft will give you the advantage for security updates for still used OS versions in your company that are out of support, as Windows XP for example. Of course this service is not for free and you have to pay for it.

If you have that agreement then you will be able to download the released updates from the Microsoft support page and can import them into your WSUS server and if required also add them into the System Center Configuration Manager.

In this article I will stick to the WSUS part itself, for System Center Configuration Manager I add some links at the end of this article, so you can follow them about required steps.

Having the agreement Microsoft will provide you the required tool, please do NOT ask me to give it to you, so you can import the CSA Updates. It is called WSUSImporttool.exe.

The tool must be used on the WSUS Server itself. Working with the tool requires a folder structure on the Server where the .cab file and the update files are stored. You may also create a working directory if you are not sure about the temp folder availability. For already used updates you can configure an archive but this is not a must for the WSUSImporttool.exe to work.

So basically this may look as shown here:

clip_image002

Microsoft will user the folder “Payload” for the update files, “ScanCab” for the catalog file, .cab, and “WorkingDir” if “TEMP” is not used. “_Archive” is created for already imported updates and is not required from the WSUSImporttool.

Inside the folders you will place the downloaded files from the Microsoft web site. The update files:

clip_image004

And the .CAB file.

clip_image006

The working directory will be empty.

clip_image008

With that preparation you can start importing the file with WSUSImporttool.exe.

The used syntax description is as follows:

WSUSImporttool.exe <WsusScan cab Location> <Payload Directory> [Working Directory]

clip_image010

So within my used folder structure from above it will be.

clip_image012

If you choose ENTER the following output will be displayed.

clip_image014

After a while, depending on the used Server hardware it will display this output. There may be, also shown here, an entry about missing files.

clip_image016

This may happen if the updates are not available yet and will be delivered later from Microsoft. So then you just have to wait and check the web site for the download files and import them later.

During the import from the updates the server will use high CPU for the sqlserver.exe for longer time, don’t worry about this, it should stop after importing. In my machine with Windows Server 2008 R2 it was roundabout 10-15 minutes for the above listed 13 updates.

clip_image018 clip_image020

There also will be a re-synchronization from the WSUS to the Microsoft download servers at the end of the process, so also nothing to care about. It will not again download all already existing updates; this just seems to compare the downloaded files with existing ones.

clip_image022

At the end the updates are shown in the WSUS Server as you already know in the unapproved updates view. You can identify them easy as CUSTOM SUPPORT is added at the end of the update name.

clip_image024

You will also see a Product group listed in the WSUS Server but I think that this is just created during the import process and will not download any files. But I have activated the option to control this and will update the article if it works.

clip_image026

If the sqlserver.exe will not stop using high CPU then you may run the “WsusDBMaintenance” (http://gallery.technet.microsoft.com/scriptcenter/6f8cde49-5c52-4abd-9820-f1d270ddea61) script within the SQL Server Management Studio or with sqlcmd, which must be installed/used on the WSUS Server.

Additional information:

http://kammaninfo.wordpress.com/category/microsoft/windows/windows-server-2012/

http://chadstech.net/microsoft-csa-patches/

One response so far

Jul 27 2012

Upgrading an Active Directory Domain from Windows Server 2008 or Windows Server 2008 R2 to Windows Server 2012 or Windows Server 2012 R2

!!!NEVER START BEFORE HAVING CREATED AND TESTED A BACKUP OF YOUR DOMAIN/DATA/MACHINE!!!


A new OS Domain Controller installation should always start with use from the support tools to check the Domain and Domain Controllers for errors that must be resolved before. The following command line tools and programs will help you to verify if some problems exist within your Domain and the Domain Controllers.


Dcdiag /v /c /d /e /s:DCName >c:\dcdiag.log [please replace DCName with your Domain Controller name]


Repadmin /showrepl dc* /verbose /all /intersite >c:\repl.log ["dc* is a place holder for the starting name of the DCs if they all begin the same (if more than one DC exists)]


Dnslint /ad /s “DCipaddress” [use http://support.microsoft.com/kb/321045 for download and instructions]


ADREPLSTATUS: http://www.microsoft.com/en-us/download/details.aspx?id=30005


——————————————–


On the old server open DNS management console and check that you are running Active directory integrated zones, which is recommended also from Microsoft.


——————————————–


The Schema must be updated for the new OS Domain Controller, so even if the update is done automatically you may check it before. Therefore you can use the following command:


“Dsquery * cn=schema,cn=configuration,dc=domain,dc=local -scope base -attr objectVersion” without the quotes in a command prompt [please replace “dc=domain,dc=local” with your Domain Name]. The output number is the Schema objectVersion:


13 = Windows 2000 Server


30 = Windows Server 2003


31 = Windows Server 2003 R2


44 = Windows Server 2008


47 = Windows Server 2008 R2


56 = Windows Server 2012


69 = Windows Server 2012 R2


——————————————–


If the first installed Domain Controller in the domain should be removed or replaced with another one, doesn’t matter if new or same OS version, assure that you export the recovery agents EFS certificate private key from the Domain Controller BEFORE you demote/retire it. Details on how to do this are listed in (http://support.microsoft.com/kb/241201) and (http://technet.microsoft.com/en-us/library/cc755157(WS.10).aspx). If you don’t save it, you will not be able to encrypt data in case of problems.


——————————————–


I recommend installing the new machine as a member server in your existing domain before promoting to Domain Controller. Configure a fixed ip address and set the preferred DNS server to one existing DC/DNS server only. Do not change anything with IPv6, as also recommended from Microsoft in http://technet.microsoft.com/en-us/magazine/2009.07.cableguy.aspx
Do NOT use the new server as DNS server on the NIC until all DNS information is replicated from one existing DC/DNS. If you do it with other DNS servers on the NIC I often have seen that the SYSVOL and NETLOGON shares are not correct created.


——————————————–


As this article applies in most steps to Windows Server 2008 32bit/64bit and Windows Server 2008 R2, I’ll start with the difference on Windows Server 2008 32bit preparation.


To install a new OS Domain Controller adprep is required and located in the Windows server 2012 or Windows server 2012 R2 installation disk …\support\adprep folder. Here you can also find the schema files. You will realize that there is ONLY adprep.exe and not adprep32.exe anymore. This belongs to the reason that adprep process on earlier OS domains is done automatically during promotion to DC.


If you run adprep.exe on the 32bit OS Domain Controller you will see an error message:


clip_image002


So on Windows Server 2008 32bit you have to prepare the forest/domain with the new way remote from Windows Server 2012 or Windows server 2012 R2.


With the 64bit version from adprep you can still work on Windows Server 2008 64bit and Windows Server 2008 R2 DCs for the Schema update.


clip_image004


So both options are possible, from the command line on Windows Server 2008 R2 or during promotion process from the Windows Server 2012 or Windows server 2012 R2.


——————————————–


The minimum functional level must be at least Windows Server 2003, so NO lower functional levels are allowed anymore.


Please control that the Domain functional level is set to Windows Server 2003, in AD Domains and Trusts right click the “Domain Name”.


clip_image006


Also control that the Forest functional level is set to Windows Server 2003, in AD Domains and Trusts right click “Active Directory Domains and Trusts”.


clip_image008


——————————————–


If you run as known before DCPROMO on a new Windows Server 2012 or Windows server 2012 R2 you will get an error message as this is not longer the way to promote a DC. Now the promotion to Domain Controller is done via Server Manager.


clip_image010


——————————————–


In this article I will focus on the new remote way with using the Windows Server 2012 or Windows server 2012 R2, as this is much more error free and comfortable to use.


Assure to use an account that is member of the Enterprise Admins and install the new Windows Server 2012 or Windows server 2012 R2 as Domain Member Server if not done already. Now start the Server Manager and choose “Add roles and features”, in “Before you begin” click next, in the “Installation Type” use “Role-based or feature-based installation” and click Next.


clip_image012


Choose the required Server and click Next


clip_image014


Now check the Active Directory Domain Services and in the upcoming window click the “Add features” button.


clip_image016


Choose Next and add additional features if required.


clip_image018


Click Next.


clip_image020


Click Next and then choose Install.


clip_image022


clip_image024


It may take some time, depending on the hardware.


clip_image026


If the installation is done be aware of the “Promote this server to a domain controller” option in the result pane


clip_image028


Again a new window opens to configure the DC with all requirements


clip_image030


Here choose Select and provide the domain credentials or use the already shown account. If you have the need using a smart card, then the server MUST be joined to the domain BEFORE.


clip_image032


Select the domain from the list and click OK.


clip_image034


Click Next.


clip_image036


The Domain controller Options appear and here choose DNS and GC and fill in the DSRM Restore mode password. Then choose Next.


clip_image038


In this step the DNS delegation warning can be ignored, as the Domain Controller is for the already existing domain.


clip_image040


Choose Next and either use the default or select a preferred DC to replicate from. Even IFM (Install from media) is possible at this step.


clip_image042


Do NOT store the Active Directory database, log files, or SYSVOL on a data volume formatted with Resilient File System (ReFS), this is new with Windows Server 2012 or Windows server 2012 R2 Database, Log file and SYSVOL folder paths must be stored on NTFS data volumes in this window and then choose Next.


clip_image044


Information about forest, schema and domain update is shown where you also choose Next.


clip_image046


Review your settings, even possible to export as Windows PowerShell script for future use and click Next.


clip_image048


Prerequisite checks will be done.


clip_image050


Review the Check and click Install.


clip_image052


clip_image054


Results are listed/shown


clip_image056


clip_image058


The server automatically reboots after installation/promotion.


——————————————–


After adding a Windows Server 2012 or Windows server 2012 R2 Domain Controller to an existing domain you should also transfer the FSMO roles to the newest Domain Controller


In this case 6 new security groups are created in the BUILTIN container in AD UC:


- Access Control Assistance Operators


- Hyper-V Administrators


- RDS Endpoint Servers


- RDS Management Servers


- RDS Remote Access Servers


- Remote Management Users


And 1 new security group in the Users container in AD UC:


- Cloneable Domain Controllers


——————————————–


You can see in the event viewer (Directory service log) that the FSMO roles are transferred, EVENT ID 1458 with the source ActiveDirectory_DomainService for each FSMO role.


——————————————–


After the transfer from the PDCEmulator FSMO it is required to reconfigure the time service on the old and new PDCEmulator, so a recommended external time source is used:


“w32tm /config /manualpeerlist:PEERS /syncfromflags:manual /reliable:yes /update”


where PEERS will be filled with the ip address or server (time.windows.com) and on the OLD PDCEmulator run:


“w32tm /config /syncfromflags:domhier /reliable:no /update”


and stop/start the time service on the old one. All commands run in an elevated command prompt without the quotes.


——————————————–


If not done on earlier OS version upgrades run ONLY the adprep /domainprep /gpprep, to enable the RSOP planning mode, manual as this is NOT involved in the automated process.


——————————————–


Reconfigure the DNS configuration on your NIC of the Windows Server 2012 or Windows server 2012 R2 machine, preferred DNS itself, secondary another Domain DNS server and as recommended from DNS BPA the loopback ip address (127.0.0.1) as 3rd entry.


——————————————–


Related documents:


Adprep in Windows Server 2012 http://technet.microsoft.com/en-us/library/hh472161.aspx


View and transfer from FSMO Roles http://support.microsoft.com/kb/324801 this article still applies for Windows Server 2012.


Time configuration in a domain http://msmvps.com/blogs/mweber/archive/2010/06/27/time-configuration-in-a-windows-domain.aspx


ReFS in Windows Server 2012 http://blogs.msdn.com/b/b8/archive/2012/01/16/building-the-next-generation-file-system-for-windows-refs.aspx

9 responses so far

Feb 07 2011

Possible Error messages on Windows Server 2008 and Windows Server 2008 R2 Domain Controllers

Until now I have seen multiple error messages that are shown on Domain Controllers with the new OS versions. For some of them exist already a Hotfix from Microsoft and some belong to configuration settings, that have to be done manual.


Also the by default enabled built-in firewall requires additional configuration settings. Of course the firewall can be disabled but in case you are ordered to run them this maybe helps you. Some articles about the Windows Firewall within Domains you will find at the end of this article.


So starting with the major Active Directory support tool DCDIAG. The output can show the following error, especially on a fresh installed Domain Controller:


———————————————–


Starting test: Connectivity
* Active Directory LDAP Services Check
Message 0×621 not found.
Got error while checking LDAP and RPC connectivity. Please check your firewall settings.
……………………. <DC Name> failed test Connectivity


FIX: The connectivity test that is run by the Dcdiag.exe tool fails together with error code 0×621


http://support.microsoft.com/kb/978387


———————————————–


Also the test VerifyEnterpriseReferences in the DCDIAG output fails, if not complete removed Domain Controllers exist or they are not correct registered.


Then the output always points to the highlighted Knowledge Base Article.


Update for the mentioned Knowledge Base Article: Q312862 is DONE on 14.03.2011 to contain also the replication technology DFS-R.


You can use the TechNet article “Update the FRS or DFS Replication Member Object” to verify or change or remove the Value.


Problem: Missing Expected Value
              Base Object: CN=NTSERVER,OU=Domain Controllers,DC=mw08,DC=loc
              Base Object Description: “DC Account Object”
              Value Object Attribute Name: frsComputerReferenceBL
              Value Object Description: “SYSVOL FRS Member Object”
              Recommended Action: See Knowledge Base Article: Q312862


failed test VerifyEnterpriseReferences


———————————————–


Another shown message in the DCDIAG output is:


WIN32_OWN_PROCESS, expected value WIN32_SHARE_PROCESS


Update 13.02.2011: As explained more detailed in the Friday MailSack from “Ask the Dicectory Services Team” use the following option not always:


This can be resolved with the following command in an elevated command prompt(RUNAS):


sc config rpcss type= share


You can run this command also against a remote located Domain Controller:


sc \\Servername config rpcss type= share


Really important is, that you take care about the space between (type= share)!!!


———————————————–


Update 11.05.2011: The KB Article 2512643 “DCDIAG.EXE /E or /A or /C expected errors” explains also some possible reason for here mentioned errors, so do not ignore them, because of the KB article, just compare them carefully to be sure it is safe to ignore them.


———————————————–


Your Active Directory forest has multiple Domain Controllers that are located at different sites. Because of this you use some switches to reduce the discovery scope of DCDIAG you realize that it takes a long time to run until the result is shown.


FIX: The Dcdiag.exe tool takes a long time to run in Windows Server 2008 R2 and in Windows 7


———————————————–


DCDIAG may show for the FRS, KCC and System Event log test the following error, when you run it against the Enterprise with “/e” from one Domain Controller:


0x6ba The RPC server is unavailable


The by default enabled firewall in Windows Server 2008 or higher is the reason. You can either disable the firewall complete (maybe not allowed in your network) or configure the Windows Firewall with Advanced Security as shown here for “Remote Administration” (RPC):


Open the console and choose the “Inbound Rules” and in the right pane scroll down to “Remote Administration” (RPC), which you set to enabled on the “General” tab


image


Add on the “Scope” tab the local and remote ip addresses of the Domain Controllers in the forest/domain where you need to have access


image


On the “Advanced” tab specify the profiles to that the rule will apply


image


allow the “Remote Administration” (RPC) in the firewall on the involved 2008 R2 DCs, the error is not shown


———————————————–


You use the command line tool DSGET together with Windows Server 2008 R2 and Windows 7 you will have incorrect results if used together with the –memberof switch and together with the –expand.


You expect only the output from the Group Information but also the User Information is shown. This is corrected with the following Hotfix:


FIX: The “dsget user -memberof -expand” command returns incorrect results in Windows Server 2008 R2 and in Windows 7


———————————————–


After the installation of the DHCP Server Role on a Windows Server 2008 R2 you see in the Application event log “Event ID 8193” from Source “VSS”.


image


This belongs to a permission change, the “NT AUTHORITY\NETWORK SERVICE” Security Principal is removed, on the following registry key and all sub keys during the DHCP Server role installation:


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\VSS\Diag


To resolve the error message you can use this KB article .


———————————————–


Using a Firewall in a Domain environment


Active Directory and Active Directory Domain Services Port Requirements


How to configure a firewall for domains and trusts


Active Directory in Networks Segmented by Firewalls


Active Directory Replication over Firewalls

2 responses so far

Mar 25 2010

Migrating Active Directory to a new Forest

When you have the need to migrate Windows Domains to a new named Domain or into a different forest, you can use the free Microsoft Active Directory Migration Tool, which exist in multiple versions.


When the source Domain is built with Windows NT4 (at least with SP4 on the PDC), Windows Server 2000 or Windows Server 2003, you have to use ADMT v3 which can migrate to a target Domain installed with Windows Server 2000 or Windows Server 2003.


ADMT v3 can be installed on any computer capable of running the Windows Server 2003 OS.


You can migrate the following OS versions with the ADMT agent:


  • Windows NT Server 4.0 (with SP4 or higher)
  • Windows 2000 Professional
  • Windows 2000 Server
  • Windows XP
  • Windows Server 2003

For a detailed description and how to use ADMT see the ADMT v3.0 Migration Guide.


————————————————————————————-


When the source Domain is built with Windows Server 2000, Windows Server 2003, or Windows Server 2008, you have to use ADMT v3.1 which can migrate to a target Domain installed with Windows Server 2000 or Windows Server 2003 or Windows Server 2008 or Windows Server 2008 R2. This version will be the last one that will support Windows Server 2000 source or target Domains or Windows Server 2000 Domain controllers.


ADMT v3.1 can be installed on any computer capable of running the Windows Server 2008 OS, unless they are Read-Only domain controllers (RODCs) or in a Server Core configuration.


You can migrate the following OS versions with the ADMT agent:



  • Windows 2000 Professional
  • Windows 2000 Server
  • Windows XP
  • Windows Server 2003
  • Windows Vista
  • Windows Server 2008
  • Windows 7
  • Windows Server 2008 R2

For a detailed description and how to use ADMT see the ADMT v3.1 and 3.2 Migration Guide.


Additional you maybe need the Password Export Server (PES) version 3.1, either for 32bit or 64bit.


————————————————————————————-


When the source Domain is built with Windows Server 2003, or Windows Server 2008, you have to use ADMT v3.2 which can migrate to a target Domain installed with Windows Server 2003 or Windows Server 2008 or Windows Server 2008 R2.


ADMT v3.2 can be installed on any computer capable of running the Windows Server 2008 R2 OS, unless they are Read-Only domain controllers (RODCs) or in a Server Core configuration.


You can migrate the following OS versions with the ADMT agent:


  • Windows XP
  • Windows Server 2003
  • Windows Vista
  • Windows Server 2008
  • Windows 7
  • Windows Server 2008 R2

For a detailed description and how to use ADMT see the ADMT v3.1 and 3.2 Migration Guide


Additional you maybe need the Password Export Server (PES) version 3.1 for 64bit.


Here you’ll find some common installation issues from ADMT v3.2 listed from Ned Pyle at “Ask the Directory Services Team


 


Related Documents about ADMT:


Restructuring Windows NT 4.0 Domains to an Active Directory Forest


Restructuring Active Directory Domains Within a Forest


Restructuring Active Directory Domains Between Forests


Error message when you use ADMT version 3 to migrate computer accounts from one Windows Server 2003 domain to another: “ERR3:7075 Failed to change domain affiliation” KB929493


How to use a SID mapping file with the ADMT tool to perform a resource domain migration to Windows Server 2003 KB835991


Known issues that may occur when you use ADMT 3.1 to migrate to a domain that contains Windows Server 2008 R2 domain controllers KB976659


You cannot uninstall ADMT 3.1 after you perform an in-place upgrade to Windows Server 2008 R2 KB974625


How To Use Visual Basic Script to Clear SidHistory KB295758

One response so far

Feb 13 2010

System cleanup after an in place upgrade from Windows Server 2008 / Vista to Windows Server 2008 R2 / Windows 7

After an in place upgrade some folders are still on the system, which are needed for rollback in case of problems. Also you can copy needed data to the system if needed from the old installation.

The folders are $WINDOWS.~Q and $INPLACE.~TR which will be shown if you enable “Show hidden files folders and drives”.

If you choose  disk cleanup from Start, All Programs, Accessories, System tools and choose the disk drive

image

the normal view of disk cleanup will be shown.

image

If you now choose “Clean up system files” (only Windows 7) and after choosing again the disk drive you will see additional options in disk cleanup window, e.g.:

- Files discarded by Windows update
- Previous Windows installation files

and some more.

If you also choose them for cleanup the folders above will also be removed. Using the way with disk cleanup for removing also prevents you from take over permissions on each folder as these are protected from the system.

One response so far

Feb 10 2010

Upgrading an Active Directory Domain from Windows Server 2003 to Windows Server 2008 or Windows Server 2008 R2

!!!NEVER START BEFORE HAVING CREATED AND TESTED A BACKUP OF YOUR DATA/MACHINE!!!


If you have installed Exchange 2003 in the domain see the following article first, Exchange requirements otherwise follow the steps below


- On the old server open DNS management console and check that you are running Active directory integrated zone (easier for replication, if you have more then one DNS server)


- run replmon from the run line or repadmin /showrepl(only if more then one DC exist), dcdiag and netdiag from the command prompt on the old machine to check for errors, if you have some solve them first. For this tools you have to install the support\tools\suptools.msi from the 2003 installation disk.


- run adprep /forestprep and adprep /domainprep and adprep /rodcprep from the 2008 installation disk against the 2003 schema master(forestprep) / infrastructure master(domainprep/rodcprep), with an account that is member of the Schema/Enterprise/Domain admins, to upgrade the schema to the new version (44) or 2008 R2 (47). On the Windows Server 2008 R2 disk are adprep32.exe (32bit) and adprep.exe (64bit) located, so make sure to use the correct version.


- see here about adprep in detail (http://technet.microsoft.com/en-us/library/cc731728(WS.10).aspx)


- you can check the schema version with “schupgr” or “dsquery * cn=schema,cn=configuration,dc=domainname,dc=local -scope base -attr objectVersion” without the quotes in a command prompt


- if the first installed DC in the domain should be removed or replaced with another one, doesn’t matter if new or same OS version, then make sure that you export the recovery agents EFS certificate private key from the DC BEFORE you demote/retire it. Details how to do this are listed in (http://support.microsoft.com/kb/241201) and (http://technet.microsoft.com/en-us/library/cc755157(WS.10).aspx) if you do not save the it, you will not be able to encrypt data in case of problems.


- Install the new machine as a member server in your existing domain


- configure a fixed ip and set the preferred DNS server to the old DNS server only, if you think about disabling IPv6 as you are not using it or it was recommended to you, keep attention to the UPDATE. Follow (http://blogs.dirteam.com/blogs/paulbergson/archive/2009/03/19/disabling-ipv6-on-windows-2008.aspx) to disable it, if really required


UPDATE for IPv6 02.06.2011: Keep in mind that IPv6 will become the future protocol and you should get familiar with it. Also the recommendation from Microsoft is to let IPv6 enabled, as some new features/services or applications already require IPv6 to be enabled. Exchange 2010 and DirectAccess are some examples.


- run dcpromo and follow the wizard to add the 2008 server to an existing domain, make it also Global catalog and DNS server.


- for DNS give the server time for replication, at least 15 minutes. Because you use Active directory integrated zones it will automatically replicate the zones to the new server. Open DNS management console to check that they appear


- if the new machine is domain controller and DNS server run again replmon, dcdiag and netdiag (copy the netdiag from the 2003 to 2008, will work) on both domain controllers


- Transfer, NOT seize the 5 FSMO roles to the new Domain controller (http://support.microsoft.com/kb/324801) applies also for 2008), FSMO should always be on the newest OS DC


- after transfer of the PDCEmulator role, configure the NEW PDCEmulator to an external timesource and reconfigure the old PDCEmulator to use the domainhierarchie now. Therefore run on the NEW “w32tm /config /manualpeerlist:PEERS /syncfromflags:manual /reliable:yes /update” where PEERS will be filled with the ip address or server(time.windows.com) and on the OLD one run “w32tm /config /syncfromflags:domhier /reliable:no /update” and stop/start the time service on the old one. All commands run in an elevated command prompt without the quotes.


- you can see in the event viewer (Directory service) that the roles are transferred, also give it some time


- reconfigure the DNS configuration on your NIC of the 2008 server, preferred DNS itself, secondary the old one


- if you use DHCP do not forget to reconfigure the scope settings to point to the new installed DNS server


- if needed move the DHCP database to the Windows server 2008 machine, follow (http://support.microsoft.com/kb/962355), for more details see (http://technet.microsoft.com/en-us/library/cc772372.aspx)


Demoting the old DC (if needed)


- reconfigure your clients/servers that they not longer point to the old DC/DNS server on the NIC


- to be sure that everything runs fine, disconnect the old DC from the network and check with clients and servers the connectivity, logon and also with one client a restart to see that everything is ok


- then run dcpromo to demote the old DC, if it works fine the machine will move from the DC’s OU to the computers container, where you can delete it by hand. Can be that you got an error during demoting at the beginning, then uncheck the Global catalog on that DC and try again


- check the DNS management console, that all entries from the machine are disappeared or delete them by hand if the machine is off the network for ever


- also you have to start AD sites and services and delete the old servername under the site, this will not be done during demotion

10 responses so far

Feb 06 2010

Upgrading an Active Directory Domain from Windows Server 2000 to Windows Server 2008 or Windows Server 2008 R2

!!!NEVER START BEFORE HAVING CREATED AND TESTED A BACKUP OF YOUR DATA/MACHINE!!!


If you have installed Exchange 2000 or Exchange 2003 in the domain see the following article first, Exchange requirements otherwise follow the steps below


- On the old server open DNS management console and check that you are running Active directory integrated zone (easier for replication, if you have more then one DNS server installed on a DC)


- run replmon from the run line or repadmin /showreps(only if more then one DC exist), dcdiag and netdiag from the command prompt on the old machine to check for errors, if you have some post the complete output from the command here or solve them first. For this tools you have to install the support\tools\suptools.msi from the 2000 installation disk.


- run adprep /forestprep and adprep /domainprep and adprep /domainprep /gpprep and adprep /rodcprep from the 2008 installation disk against the 2000 schema master(/forestprep) / infrastructure master(/domainprep/rodcprep), with an account that is member of the Schema/Enterprise/Domain admins, to upgrade the schema to the 2008 version (44) or 2008 R2 (47). On the Windows Server 2008 R2 disk are adprep32.exe (32bit) and adprep.exe (64bit) located, so make sure to use the correct version.


- In Windows server 2000 you have sometimes to enable the write access to the schema master (http://support.microsoft.com/default.aspx/kb/285172)


- you can check the schema version with “schupgr” or “dsquery * cn=schema,cn=configuration,dc=domainname,dc=local -scope base -attr objectVersion” without the quotes in a command prompt


- if the first installed DC in the domain should be removed or replaced with another one, doesn’t matter if new or same OS version, then make sure that you export the recovery agents EFS certificate private key from the DC BEFORE you demote/retire it. Details how to do this are listed in (http://support.microsoft.com/kb/241201) and (http://technet.microsoft.com/en-us/library/cc755157(WS.10).aspx) if you do not save the it, you will not be able to encrypt data in case of problems.


- Install the new machine as a member server in your existing domain


- configure a fixed ip and set the preferred DNS server to the old DNS server only, if you think about disabling IPv6 as you are not using it or it was recommended to you, keep attention to the UPDATE. Follow (http://blogs.dirteam.com/blogs/paulbergson/archive/2009/03/19/disabling-ipv6-on-windows-2008.aspx) to disable it, if really required


UPDATE for IPv6 02.06.2011: Keep in mind that IPv6 will become the future protocol and you should get familiar with it. Also the recommendation from Microsoft is to let IPv6 enabled, as some new features/services or applications already require IPv6 to be enabled. Exchange 2010 and DirectAccess are some examples.


- run dcpromo and follow the wizard to add the 2008 server to an existing domain, make it also Global catalog and DNS server.


- for DNS give the server time for replication, at least 15 minutes. Because you use Active directory integrated zones it will automatically replicate the zones to the new server. Open DNS management console to check that they appear


- if the new machine is domain controller and DNS server run again replmon, dcdiag on both domain controllers. For using netdiag.exe on 2008, NOT 2008 R2, you have to download and install (http://www.microsoft.com/downloads/details.aspx?familyid=96A35011-FD83-419D-939B-9A772EA2DF90&displaylang=en), ignore the compatibility warning, or extract netdiag.exe only


- Transfer, NOT seize the 5 FSMO roles to the new Domain controller (http://support.microsoft.com/kb/324801) applies also for 2008/2008R2), FSMO should always be on the newest OS DC


- after transfer of the PDCEmulator role, configure the NEW PDCEmulator to an external timesource and reconfigure the old PDCEmulator to use the domainhierarchie now. Therefore run on the NEW “w32tm /config /manualpeerlist:PEERS /syncfromflags:manual /reliable:yes /update” where PEERS will be filled with the ip address or server (time.windows.com) and on the OLD one modify the registry key value “Type” to “Nt5Ds” :  HKLM\ SYSTEM\ CurrentControlSet\ Services\ W32Time\ Parameters\  as w32tm wan’t run with Windows 2000 and stop/start the time service on the old one.


- you can see in the event viewer (Directory service) that the roles are transferred, also give it some time


- reconfigure the DNS configuration on your NIC of the 2008 server, preferred DNS itself, secondary the old one


- if you use DHCP do not forget to reconfigure the scope settings to point to the new installed DNS server


Demoting the old DC(if needed)


- reconfigure your clients/servers that they not longer point to the old DC/DNS server on the NIC


- to be sure that everything runs fine, disconnect the old DC from the network and check with clients and servers the connectivity, logon and also with one client a restart to see that everything is ok


- then run dcpromo to demote the old DC, if it works fine the machine will move from the DC’s OU to the computers container, where you can delete it by hand. Can be that you got an error during demoting at the beginning, then uncheck the Global catalog on that DC and try again


- check the DNS management console, that all entries from the machine are disappeared or delete them by hand if the machine is off the network for ever


- also you have to start AD sites and services and delete the old servername under the site, this will not be done during demotion

8 responses so far