AD Upgrade from server 2000 to server 2012
We currently have an old 2000 server that functions as a domain controller. Finally got a new server running Server 2012 standard. Since I don't want to change the the IP address range and subnet. I thought i should first dis join all computers and the other server( Server 2008 Standard running remote desk top services, print service) and just bring up the new server with the existing ip range and same settings for DHCP,DNS and rejoin all the existing machines to the new domain. I'm trying to avoid having to re setup router and switches, wireless access point and printers and vpn tunnels(sonic walls at other sites.. Do you foresee any problems I might face by taking this approach? the current domain controller(server 2000) is the only server handling authentication, DHCP, DNS. and remote access..
ASKER
that's what I figured, thanks
Not entirely sure what you're planning on or concerned about... but there are many issues you should be aware of.
Windows domains are not "simple" - every domain and every object (user account, computer account, group, etc) has it's own unique ID (GUID). The security settings are based on these IDs, NOT the names. So you MUST disjoin and rejoin all workstations - but if you do that, all your users will also need to be recreated. And all your file security will need to be reset. And all your group policies will need to be reconfigured. And all your user profiles will be lost (until/unless migrated with a third party tool). Basically, doing what you describe, and from what I interpret, would be a HUGE mess and potentially very time consuming.
Instead, a better solution in my opinion, is to migrate. You can even keep the same name and IP (though if you designed your network well, you wouldn't have to). You cannot go directly from 2000 to 2012, so you'd have to migrate to a temporary server running 2003 or 2008 (I think 2008 is ok, but probably not R2) and then migrate that temporary server to 2012.
To illustrate, if your current DC is 192.168.1.100 and named "DC1" then:
Add DC2 as a second DC with IP 192.168.1.101 to the network running 2003/2008
Demote DC1 from being a DC and remove from the network.
Install 2012 as DC1 with the old IP and join it to the domain now handled by DC2 as a second DC. Demote DC2 and remove from the network.
You SHOULD understand what FSMO roles are, the importance of DNS, how to use ADPREP, how to add DCs to a network and how to properly use DCDIAG. If you don't - If you aren't looking at the summarized instruction above and knowing when and where to use/modify the above tools/commands/services, then you would VERY unwise to try to do this yourself and instead should hire a pro with experience to assist in this migration. Learn from them. Or go take a few classes on AD... Expecting a question or two here to solve your issues on a potentially complicated setup/upgrade when there are multi-volume books on the topics above is unrealistic.
Windows domains are not "simple" - every domain and every object (user account, computer account, group, etc) has it's own unique ID (GUID). The security settings are based on these IDs, NOT the names. So you MUST disjoin and rejoin all workstations - but if you do that, all your users will also need to be recreated. And all your file security will need to be reset. And all your group policies will need to be reconfigured. And all your user profiles will be lost (until/unless migrated with a third party tool). Basically, doing what you describe, and from what I interpret, would be a HUGE mess and potentially very time consuming.
Instead, a better solution in my opinion, is to migrate. You can even keep the same name and IP (though if you designed your network well, you wouldn't have to). You cannot go directly from 2000 to 2012, so you'd have to migrate to a temporary server running 2003 or 2008 (I think 2008 is ok, but probably not R2) and then migrate that temporary server to 2012.
To illustrate, if your current DC is 192.168.1.100 and named "DC1" then:
Add DC2 as a second DC with IP 192.168.1.101 to the network running 2003/2008
Demote DC1 from being a DC and remove from the network.
Install 2012 as DC1 with the old IP and join it to the domain now handled by DC2 as a second DC. Demote DC2 and remove from the network.
You SHOULD understand what FSMO roles are, the importance of DNS, how to use ADPREP, how to add DCs to a network and how to properly use DCDIAG. If you don't - If you aren't looking at the summarized instruction above and knowing when and where to use/modify the above tools/commands/services, then you would VERY unwise to try to do this yourself and instead should hire a pro with experience to assist in this migration. Learn from them. Or go take a few classes on AD... Expecting a question or two here to solve your issues on a potentially complicated setup/upgrade when there are multi-volume books on the topics above is unrealistic.
ASKER
I have no plans to migrate anything, Al user will have new IDS. The cool thing is on the PC front, there are probably only 10 computers on the Domain out of 40 users. The rest are only using mapped drives.. Group policy was a concern but I figure I would have to recreate the policy.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
You can do it however you like, but you should understand the consequences of both methods and if you're not sure, then you should be hiring a professional. Getting it right the first time is cheaper than messing it up and having to redo it. And to be clear, I'm not trying to suggest that you don't have the capacity to do it right or learn to do it right - just making sure you understand the consequences of both options. In most cases a migration would be preferred. And strictly speaking, an UPGRADE is to maintain the basic data - typically through a migration. What you're talking about is, apparently, KILLING what you have and starting offer from scratch.
DFWTECH, did you ever resolve this issue?
ASKER
I've requested that this question be closed as follows:
Accepted answer: 500 points for lazarus98's comment #a39843321
Assisted answer: 0 points for DFWTECH's comment #a39843351
for the following reason:
the answer makes the most sense to me.
Accepted answer: 500 points for lazarus98's comment #a39843321
Assisted answer: 0 points for DFWTECH's comment #a39843351
for the following reason:
the answer makes the most sense to me.
ASKER
good answer
All in all just treat it like its a new domain server and start from there.