Feb 13 2010

Upgrade a Domain Controller to a new Operating System version and keep the name

Published by under Active Directory

If you have the need to keep the name of a domain controller (DC) you have 2 options, an in place upgrade of the DC in question or choosing a “temporary” DC to free the name of it (only one DC exist in the domain).

The following applies only if the DC is NOT running additional applications, e.g. Microsoft Exchange server, Microsoft SQL server or any other one. For a Certification Authority (CA) see at the end.

I don’t prefer an in place upgrade, especially if there is a major change in the OS architecture like from Windows server 2003 to Windows server 2008.

Option 1:

Depending on the OS version, you can do in place upgrades:

+ Windows server NT4 (SP6a) to Windows server 2000 or Windows server 2003 is possible

+ Windows server 2000 to Windows server 2003 or Windows server 2003 R2 is possible

+ Windows server 2000 to Windows server 2008 or higher is NOT possible

+ Windows server 2003 SP1/SP2 or Windows server 2003 R2 SP1/SP2 to Windows server 2008 or Windows server 2008 R2 is possible, only if NO cluster services are installed

+ Windows server 2008 to Windows server 2008 R2 is possible

see this articles for a more detailed explanation of supported upgrade paths (http://support.microsoft.com/kb/810613/en-us) and  (http://support.microsoft.com/?kbid=951041)

Option 2:

If you must use different hardware depending on the OS requirements, the old one, let’s call it “DCKeep”, is over it’s lifetime or you have only one DC in the domain, you can work with a “temporary” DC, let’s call it “DCTemp”, either as VM or physical machine (even a laptop if the hardware is capable of the OS).

+ therefore install an additional DC “DCTemp” to the domain, make it DNS server (i prefer always Active directory integrated zones on DC’s), make it Global catalog server ([http://support.microsoft.com/?id=313994] applies also for 2008)

+ move all 5 FSMO roles to “DCTemp” (if the DC you like to keep the name is the FSMO roles holder). ([http://support.microsoft.com/kb/324801] applies also for 2008)

+ check replication with the support tools dcdiag /v, netdiag (not included in Windows server 2008, but works {not supported} if copied from the Windows server 2003 support tools [not on Windows server 2008 R2]) and repadmin /showrepl (or /showreps if Windows server 2000 support tools). Also replmon, Replication monitor GUI version, will help to check the correct replication between all DC’s.

+ if all steps above are error free you can demote “DCKeep” to a member server and rename it or remove it complete from the domain, that way the domain has still a running DC with all needed roles and you can now use the name “DCKeep” again on a new OS version server with the same ip address.

If “DCKeep” has the CA role installed you have to do a backup BEFORE demoting or removing, to restore it on the new server, therefore follow this articles depending on the OS version:

+ Windows server 2000 to Windows server 2003 (http://support.microsoft.com/kb/298138)

+ Windows server 2003 to Windows server 2008 (http://technet.microsoft.com/en-us/library/cc742515(WS.10).aspx)

+ upgrading a CA from Windows server 2000 to Windows server 2008 should be done in a 2 step way over Windows server 2003 to be supported from Microsoft

2 responses so far

Feb 13 2010

Upgrading an Active Directory Domain from Windows Server 2000 to Windows Server 2003 or Windows Server 2003 R2

!!!NEVER START BEFORE HAVING CREATED AND TESTED A BACKUP OF YOUR DATA/MACHINE!!!

– On the old server open DNS management console and check that you are running Active directory integrated zone (easier for replication, if you have more then one DNS server on Domain controller)

– run replmon (GUI version) from the run line or repadmin /showreps (only if more then one DC exist), dcdiag /v and netdiag from the command prompt on the old machine to check for errors. For this tools you have to install the support\tools\suptools.msi from the Windows server 2000 or Windows server 2003 installation disk.

– if the first installed DC in the domain should be removed or replaced with another one, doesn’t matter if new or same OS version, then make sure that you export the recovery agents EFS certificate private key from the DC BEFORE you demote/retire it. Details how to do this are listed in (http://support.microsoft.com/kb/241201) and (http://technet.microsoft.com/en-us/library/cc755157(WS.10).aspx) if you do not save the it, you will not be able to encrypt data in case of problems.

– run adprep /forestprep and adprep /domainprep from the 2003 installation disk against the Windows server 2000, with an account that is member of the Schema admins, to upgrade the schema to version 30

– if you upgrade to Windows server 2003 R2 use adprep from the second disk from the set and go to E:\CMPNENTS\R2\ADPREP, where E: is your disk drive, which will upgrade the schema to version 31

– see here about adprep in detail (http://technet.microsoft.com/en-us/library/cc755958(WS.10).aspx)

– In Windows server 2000 you have sometimes to enable the write access to the schema master (http://support.microsoft.com/default.aspx/kb/285172)

– Install the new machine as a member server in your existing domain and configure a fixed ip address and set the preferred DNS server to the old DNS server only

– run dcpromo and follow the wizard to add the Windows server 2003 to an existing domain

– if you are prompted for DNS configuration choose Yes (also possible that no DNS preparation occur), then install DNS after the reboot without configuration, just wait for AD replication

– for DNS give the server time for replication, at least 15 minutes. Because you use Active directory integrated zones it will automatically replicate the zones to the new server. Open DNS management console to check that they appear

– if the new machine is domain controller and DNS server run again replmon, dcdiag and netdiag on both domain controllers

– if you have no errors, make the new server Global catalog server, open Active directory Sites and Services and then double-click sitename, double-click Servers, click your domain controller, right-click NTDS Settings, and then click Properties, on the General tab, click to select the Global catalog check box (http://support.microsoft.com/?id=313994)

– Transfer, NOT seize the 5 FSMO roles to the new Domain controller (http://support.microsoft.com/kb/324801)

– after transfer of the PDCEmulator role, configure the NEW PDCEmulator to an external time source and reconfigure the old PDCEmulator to use the domainhierarchie now. Therefore run on the NEW “w32tm /config /manualpeerlist:PEERS /syncfromflags:manual /reliable:yes /update” where PEERS will be filled with the ip address or server(time.windows.com) and on the OLD one modify the registry key value “Type” to “Nt5Ds” :  HKLM\ SYSTEM\ CurrentControlSet\ Services\ W32Time\ Parameters\  as w32tm wan’t run with Windows 2000 and stop/start the time service on the old one.

– you can see in the event viewer (Directory service) that the roles are transferred, also give it some time

– reconfigure the DNS configuration on your NIC of the 2003 server, preferred DNS itself, secondary the old one

– if you use DHCP do not forget to reconfigure the scope settings to point to the new installed DNS server

– export and import of DHCP database (if needed) (http://support.microsoft.com/kb/325473)

– backup WINS (http://technet.microsoft.com/en-us/library/cc727901.aspx)

– restore WINS (http://technet.microsoft.com/en-us/library/cc727960.aspx)

Demoting the old DC (if needed)

– reconfigure domain machines, that they not longer use to the old DNS server on the NIC

– to be sure that everything runs fine, disconnect the old DC from the network for one or two days and check with clients and servers the connectivity, logon and also with one client a restart to see that everything is ok

– then run dcpromo to demote the old DC, if it works fine the machine will move from the DC’s OU to the computers container, where you can delete it by hand. Can be that you got an error during demoting at the beginning, then uncheck the Global catalog on that DC and try again

– check the DNS management console, that all entries from the machine are disappeared or delete them by hand if the machine is off the network for ever

– also you have to open AD sites and services and delete the old server name under the site, this will not be done during demotion

No responses yet

Feb 10 2010

Upgrading an Active Directory Domain from Windows Server 2003 to Windows Server 2008 or Windows Server 2008 R2

!!!NEVER START BEFORE HAVING CREATED AND TESTED A BACKUP OF YOUR DATA/MACHINE!!!

If you have installed Exchange 2003 in the domain see the following article first, Exchange requirements otherwise follow the steps below

– On the old server open DNS management console and check that you are running Active directory integrated zone (easier for replication, if you have more then one DNS server)

– run replmon from the run line or repadmin /showrepl(only if more then one DC exist), dcdiag and netdiag from the command prompt on the old machine to check for errors, if you have some solve them first. For this tools you have to install the support\tools\suptools.msi from the 2003 installation disk.

– run adprep /forestprep and adprep /domainprep and adprep /rodcprep from the 2008 installation disk against the 2003 schema master(forestprep) / infrastructure master(domainprep/rodcprep), with an account that is member of the Schema/Enterprise/Domain admins, to upgrade the schema to the new version (44) or 2008 R2 (47). On the Windows Server 2008 R2 disk are adprep32.exe (32bit) and adprep.exe (64bit) located, so make sure to use the correct version.

– see here about adprep in detail (http://technet.microsoft.com/en-us/library/cc731728(WS.10).aspx)

– you can check the schema version with “schupgr” or “dsquery * cn=schema,cn=configuration,dc=domainname,dc=local -scope base -attr objectVersion” without the quotes in a command prompt

– if the first installed DC in the domain should be removed or replaced with another one, doesn’t matter if new or same OS version, then make sure that you export the recovery agents EFS certificate private key from the DC BEFORE you demote/retire it. Details how to do this are listed in (http://support.microsoft.com/kb/241201) and (http://technet.microsoft.com/en-us/library/cc755157(WS.10).aspx) if you do not save the it, you will not be able to encrypt data in case of problems.

– Install the new machine as a member server in your existing domain

– configure a fixed ip and set the preferred DNS server to the old DNS server only, if you think about disabling IPv6 as you are not using it or it was recommended to you, keep attention to the UPDATE. Follow (http://blogs.dirteam.com/blogs/paulbergson/archive/2009/03/19/disabling-ipv6-on-windows-2008.aspx) to disable it, if really required

UPDATE for IPv6 02.06.2011: Keep in mind that IPv6 will become the future protocol and you should get familiar with it. Also the recommendation from Microsoft is to let IPv6 enabled, as some new features/services or applications already require IPv6 to be enabled. Exchange 2010 and DirectAccess are some examples.

– run dcpromo and follow the wizard to add the 2008 server to an existing domain, make it also Global catalog and DNS server.

– for DNS give the server time for replication, at least 15 minutes. Because you use Active directory integrated zones it will automatically replicate the zones to the new server. Open DNS management console to check that they appear

– if the new machine is domain controller and DNS server run again replmon, dcdiag and netdiag (copy the netdiag from the 2003 to 2008, will work) on both domain controllers

– Transfer, NOT seize the 5 FSMO roles to the new Domain controller (http://support.microsoft.com/kb/324801) applies also for 2008), FSMO should always be on the newest OS DC

– after transfer of the PDCEmulator role, configure the NEW PDCEmulator to an external timesource and reconfigure the old PDCEmulator to use the domainhierarchie now. Therefore run on the NEW “w32tm /config /manualpeerlist:PEERS /syncfromflags:manual /reliable:yes /update” where PEERS will be filled with the ip address or server(time.windows.com) and on the OLD one run “w32tm /config /syncfromflags:domhier /reliable:no /update” and stop/start the time service on the old one. All commands run in an elevated command prompt without the quotes.

– you can see in the event viewer (Directory service) that the roles are transferred, also give it some time

– reconfigure the DNS configuration on your NIC of the 2008 server, preferred DNS itself, secondary the old one

– if you use DHCP do not forget to reconfigure the scope settings to point to the new installed DNS server

– if needed move the DHCP database to the Windows server 2008 machine, follow (http://support.microsoft.com/kb/962355), for more details see (http://technet.microsoft.com/en-us/library/cc772372.aspx)

Demoting the old DC (if needed)

– reconfigure your clients/servers that they not longer point to the old DC/DNS server on the NIC

– to be sure that everything runs fine, disconnect the old DC from the network and check with clients and servers the connectivity, logon and also with one client a restart to see that everything is ok

– then run dcpromo to demote the old DC, if it works fine the machine will move from the DC’s OU to the computers container, where you can delete it by hand. Can be that you got an error during demoting at the beginning, then uncheck the Global catalog on that DC and try again

– check the DNS management console, that all entries from the machine are disappeared or delete them by hand if the machine is off the network for ever

– also you have to start AD sites and services and delete the old servername under the site, this will not be done during demotion

5 responses so far

Feb 06 2010

Upgrading Active Directory to Windows server 2008, when Exchange server 2000 or Exchange server 2003 is installed

For more detailed information also about Exchange 2007 and Exchange 2010 see “Exchange Server and it’s relationship to Active Directory

To upgrade an Active directory forest/domain to a newer OS version you have to check some prerequisites.

If Exchange 2000 is running in the existing Windows domain, then first check with the following article that no mangled attributes exist, applies also to Windows Server 2008. http://support.microsoft.com/?id=314649

If Exchange 2000 Service pack 3 is installed, it can be used in an Active Directory Forest that contains Windows Server 2008 DCs but the Windows server 2008 DCs shouldn’t be in the same site as the Exchange 2000 server. If Windows Server 2008 DCs MUST run in an AD site that has Exchange 2000 servers, you have to configure the Directory Service Access (DSAccess) on the Exchange 2000 Server servers in the site, to use a DC that is running either Windows server 2003 or Windows server 2000. Configuring DSAccess manual will NOT provide any fallback to another Domain controller or Global catalog server. http://support.microsoft.com/kb/250570

UPDATE: Exchange 2000 isn’t supported to be used with Windows server 2008 DCs according to the “Exchange Server Supportability Matrix” but should work according to the article from the Exchange specialists “Exchange Server and Windows Server 2008“.

If Exchange 2003 is used, make sure that Exchange 2003 Service pack 2 is installed.

RODCs can be used without any problem in the forest but each Exchange server version requires a writeable Domain controller and a writeable Global catalog server.

UPDATE: According to the “Exchange Server Supportability Matrix” it is also supported to use Windows server 2008 R2 Dcs, when Exchange 2003 SP2 is installed.

No responses yet

Feb 06 2010

Upgrading an Active Directory Domain from Windows Server 2000 to Windows Server 2008 or Windows Server 2008 R2

!!!NEVER START BEFORE HAVING CREATED AND TESTED A BACKUP OF YOUR DATA/MACHINE!!!

If you have installed Exchange 2000 or Exchange 2003 in the domain see the following article first, Exchange requirements otherwise follow the steps below

– On the old server open DNS management console and check that you are running Active directory integrated zone (easier for replication, if you have more then one DNS server installed on a DC)

– run replmon from the run line or repadmin /showreps(only if more then one DC exist), dcdiag and netdiag from the command prompt on the old machine to check for errors, if you have some post the complete output from the command here or solve them first. For this tools you have to install the support\tools\suptools.msi from the 2000 installation disk.

– run adprep /forestprep and adprep /domainprep and adprep /domainprep /gpprep and adprep /rodcprep from the 2008 installation disk against the 2000 schema master(/forestprep) / infrastructure master(/domainprep/rodcprep), with an account that is member of the Schema/Enterprise/Domain admins, to upgrade the schema to the 2008 version (44) or 2008 R2 (47). On the Windows Server 2008 R2 disk are adprep32.exe (32bit) and adprep.exe (64bit) located, so make sure to use the correct version.

– In Windows server 2000 you have sometimes to enable the write access to the schema master (http://support.microsoft.com/default.aspx/kb/285172)

– you can check the schema version with “schupgr” or “dsquery * cn=schema,cn=configuration,dc=domainname,dc=local -scope base -attr objectVersion” without the quotes in a command prompt

– if the first installed DC in the domain should be removed or replaced with another one, doesn’t matter if new or same OS version, then make sure that you export the recovery agents EFS certificate private key from the DC BEFORE you demote/retire it. Details how to do this are listed in (http://support.microsoft.com/kb/241201) and (http://technet.microsoft.com/en-us/library/cc755157(WS.10).aspx) if you do not save the it, you will not be able to encrypt data in case of problems.

– Install the new machine as a member server in your existing domain

– configure a fixed ip and set the preferred DNS server to the old DNS server only, if you think about disabling IPv6 as you are not using it or it was recommended to you, keep attention to the UPDATE. Follow (http://blogs.dirteam.com/blogs/paulbergson/archive/2009/03/19/disabling-ipv6-on-windows-2008.aspx) to disable it, if really required

UPDATE for IPv6 02.06.2011: Keep in mind that IPv6 will become the future protocol and you should get familiar with it. Also the recommendation from Microsoft is to let IPv6 enabled, as some new features/services or applications already require IPv6 to be enabled. Exchange 2010 and DirectAccess are some examples.

– run dcpromo and follow the wizard to add the 2008 server to an existing domain, make it also Global catalog and DNS server.

– for DNS give the server time for replication, at least 15 minutes. Because you use Active directory integrated zones it will automatically replicate the zones to the new server. Open DNS management console to check that they appear

– if the new machine is domain controller and DNS server run again replmon, dcdiag on both domain controllers. For using netdiag.exe on 2008, NOT 2008 R2, you have to download and install (http://www.microsoft.com/downloads/details.aspx?familyid=96A35011-FD83-419D-939B-9A772EA2DF90&displaylang=en), ignore the compatibility warning, or extract netdiag.exe only

– Transfer, NOT seize the 5 FSMO roles to the new Domain controller (http://support.microsoft.com/kb/324801) applies also for 2008/2008R2), FSMO should always be on the newest OS DC

– after transfer of the PDCEmulator role, configure the NEW PDCEmulator to an external timesource and reconfigure the old PDCEmulator to use the domainhierarchie now. Therefore run on the NEW “w32tm /config /manualpeerlist:PEERS /syncfromflags:manual /reliable:yes /update” where PEERS will be filled with the ip address or server (time.windows.com) and on the OLD one modify the registry key value “Type” to “Nt5Ds” :  HKLM\ SYSTEM\ CurrentControlSet\ Services\ W32Time\ Parameters\  as w32tm wan’t run with Windows 2000 and stop/start the time service on the old one.

– you can see in the event viewer (Directory service) that the roles are transferred, also give it some time

– reconfigure the DNS configuration on your NIC of the 2008 server, preferred DNS itself, secondary the old one

– if you use DHCP do not forget to reconfigure the scope settings to point to the new installed DNS server

Demoting the old DC(if needed)

– reconfigure your clients/servers that they not longer point to the old DC/DNS server on the NIC

– to be sure that everything runs fine, disconnect the old DC from the network and check with clients and servers the connectivity, logon and also with one client a restart to see that everything is ok

– then run dcpromo to demote the old DC, if it works fine the machine will move from the DC’s OU to the computers container, where you can delete it by hand. Can be that you got an error during demoting at the beginning, then uncheck the Global catalog on that DC and try again

– check the DNS management console, that all entries from the machine are disappeared or delete them by hand if the machine is off the network for ever

– also you have to start AD sites and services and delete the old servername under the site, this will not be done during demotion

4 responses so far

« Prev