Solved

New PDC Emulator for NT Domain

Posted on 2004-11-01
1,380 Views
Last Modified: 2008-03-04
Hi people, hopefully this won't be too tricky a question for the expert in the know.

My situation is as follows:

approx 5 NT4 servers, 5 Win2k servers, 10 Win2k3 servers.
We are currently running a NON-Active Directory environment. We will stay this way for another 3 months before a project is launched and we migrate to AD.
In the meantime, my current predicament is this:

I have a new box that I would like to install W2k3 on to take over the role of the NT4 PDC. This box will essentially become the PDC emulator, dishing out logon scripts and requests to both NT4 servers/workstations and Win2k clients/servers.

Will my PDC Emulator successfully perform this task as the new PDC? Will it also still run DHCP and WINS?
Any issues you can think of?

I know that I need to migrate to AD, but we will not be using this for the time being. I know very little about AD and our I.T dept is not ready for it.

Thanks in advance
Bel
0
Question by:belfusion
    13 Comments
     
    LVL 95

    Expert Comment

    by:Lee W, MVP
    Sorry, 2000/2003 DCs cannot be DCs in a Windows NT 4 network.  Simply won't work.
    0
     
    LVL 95

    Expert Comment

    by:Lee W, MVP
    You can run WINS, DHCP, DNS from the 2003 server, but cannot make it a Domain Controller.  The process for upgrading to Active Directory requires upgrading the PDC first.
    0
     
    LVL 95

    Assisted Solution

    by:Lee W, MVP
    0
     
    LVL 95

    Expert Comment

    by:Lee W, MVP
    0
     

    Author Comment

    by:belfusion
    leew, in the first comment you say that you cannot make a 2003 servers DC's.
    Yes you can. Isn't this what PDC emulation is for? The existing NT4 BDC's see the 2k3 box as a NT4 PDC, while the 2K and 2k3 servers see it as a 2k3 box.

    In the third comment, you reference a document which clearly tells you that you can. But what this or the subsequent URL's don't do, is answer my original question.

    Will my PDC Emulator successfully perform this task as the new PDC? Will it also still run DHCP and WINS?
    Any issues you can think of?

    To clarify, I'm really interested in the repercussions of running AD when we aren't setup or ready for it. (we will not be wanting to utilise this yet, so hence the PDC emulator).

    Thanks for trying though
    0
     
    LVL 5

    Assisted Solution

    by:idyllicsys
    Your biggest problem is that User Manager for Domains cannot be used as your primary domain user management interface.
    See http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/techref/en-us/Default.asp?url=/resources/documentation/windowsServ/2003/all/techref/en-us/usrmgr.asp

    While your BDC are able to read from the PDC emulator running AD, no changes can be made from the BDC's. Realistically, this is no different than a normal NT4 domain, but you will not be able to use User Manager. Everything will have to be done from Active Directory Users and Computers.

    There are a ton of other issues. Do you run a trusts or trusts? Do you have multiple locations? etc...

    Your best bet is to wait until you are ready to make the jump to AD and migrate logically. If your IT department is not ready and you do this, they will have to be very quickly.

    If you do decide to do this, follow the article from leew. That is the only way to migrate the same domain up to AD.

    You can run DHCP and WINS off of the server. Not highly recommended in a larger network, but it will work. Remember, with AD, the server will already be running DNS.
    0
     

    Author Comment

    by:belfusion
    Thanks idyllicsys.
    These are exactly the issues i'm looking for. I didn't realise we wouldn't be able to use User manager for domains any longer. Is this a certainty?
    Also, we aren't currently enabled with any trust relationships and as yet, no multiple sites.
    Why do you mention this?

    Cheers
    Bel

    0
     
    LVL 95

    Assisted Solution

    by:Lee W, MVP
    Understand - You CANNOT have a 2003 server WITHOUT Active Directory but ACTING as a PDC.  Mixed Mode will retain communications with the NT4 BDCs, but you WILL have ALMOST all the functionality of Active Directory - you WILL be running Active Directory.
    0
     
    LVL 5

    Assisted Solution

    by:idyllicsys
    Bel,

    If you look at the article I listed, you can only use User Manager to view info, but not change it. If you use it to change infomation, you run the risk of corrupting the AD and then you get to start over from scratch. Not worth it.

    The reason I mention trusts and sites is that AD separates that out into two other management consoles. They are actually easier to manage overall, but there is a definate learning curve.

    If you have not used AD at all, do yourself a favor and setup a test lab. If you would like to use live data, setup a BDC and then move it over to your test lab. Then remove it from the actual domain. This will give you some familiar data to work with and who cares if you mess up.

    The other thing to take into consideration is policies. This is a whole different issue. AD introduces Group Polcies, but they will onyl work on Win2K Pro and Server, Win XP Pro and Win2K3.
    0
     
    LVL 95

    Accepted Solution

    by:
    I think we misunderstood each other.  You cannot have a 2000/2003 server running as a DC in an NT 4 environment without upgrading to Active Directory.  This is what you are doing.  Whether you are ready or not, if you want a 2000/2003 server as your PDC Emulator, it must be running AD.  You can choose not to use numerous features of AD, but you ARE upgrading to AD by installing that server and running DC Promo on it.  That is what I meant when I said "2000/2003 DCs cannot be DCs in a Windows NT 4 network".

    Stepping from Mixed mode to Native mode has a load of other issues.

    Yes, User Manager will be an issue - but Active Directory Users and Computers can be used.  You can also group accounts into OUs and setup Policies without affecting the ability of the NT4 DCs to authenticate.

    The links I provided were intended to describe the upgrade process.  Because again, if you make a 2000/2003 a DC you are in effect upgrading to Active Directory.

    When I did my migration I found very little in the way of issues (1000 nodes/users, 35+ servers, 2 sites)
    0
     

    Author Comment

    by:belfusion
    leew, I learnt many things since posting the original question, and of course, many more have been raised!
    I understand what you meant now, I guess not knowing too much about AD, I had hopes that I could run a PDC emulator without actually utilising AD.
    From my understanding it seems that in order to do this, I would have to utilise Active Directory users and computers and in doing so, would need to begin strategic planning on OU's etc as a result.

    It seems to me that the overall answer would be that in fact, I cannot do this without launching into AD territory.

    My best course of action is to build this new box as an NT4 box as the new PDC (the eixsting one is suffering old age), start planning my migration to AD and learning the ins and outs before I migrate. Then and only then, migrate using the steps as outlined in leew's link above.

    Would this best describe the scenario?

    Bel
    0
     
    LVL 95

    Expert Comment

    by:Lee W, MVP
    Obviously, and I'd say you seem to know this already, read up on the Active Directory upgrade process.  

    In the mean time, if you have more than one BDC, consider just promoting one of the BDCs to PDC if you are having issues with your current BDC.  

    While it's always a good idea to learn as much as you can, from my experience, the upgrade is generally painless - as long as you don't go to Native mode.  AND you can use Group Policies (VERY handy) and various other AD features.

    When I did my upgrade, we bought a server to act as the first DC in the 2000 active directory.  In doing so, I had to install NT4 on it and then upgrade to 2000 - I would recommend this course of action, it was as clean an upgrade as it could be because the NT4 box was upgraded within a week of being installed, meaning no time for registry crap and misc. files getting corrupt, improper shutdowns, etc.  And of course, I pulled a BDC offline prior to upgrading.  This way, if there were any problems, I could yank the AD DC off the network and recover it with a promotion for my offline BDC to PDC.  

    In a smaller domain we had, I actually imaged the hard drive of the PDC before doing the upgrade.  This allowed me to recover the system if things didn't go well.

    I'd suggest setting up a small test network and run through the process a few times.  Get comfortable with it.  The first couple times I did an upgrade, I was scared something would go horribly wrong (and I'd have 800-1000 users to recreate if that were the case, not to mention permissions nightmares).  But things went pretty smooth and other later domains I upgraded also went smooth and I got more comfortable (running a test network at home helped too).

    One other note: The 2000/2003 server running a PDC emulator MUST always be the PDC for other NT4 DCs.  You could NOT, for example, make an NT4 box the PDC once you've got a 2000/2003 DC acting as the PDC emulator - there is no BDC emulator.

    0
     

    Author Comment

    by:belfusion
    Thanks guys, i've given you split points as I felt you both provided the points that led to me finally understanding the solution.

    Cheers and good work!
    Bel
    0

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone. Privacy Policy Terms of Use

    Featured Post

    Looking for New Ways to Advertise?

    Engage with tech pros in our community with native advertising, as a Vendor Expert, and more.

    I have never ceased to be amazed how many problems you can encounter on a fresh install of a Windows operating system.  This is certainly case in point& Unable to complete ANY MSI installation.  This means Windows Updates are failing and I can't …
    Numerous times I have been asked this questions that what is it that makes my machine log on so slow, there have been cases where computers took 23 minute exactly after taking password and getting to the desktop. Interesting thing was the fact th…
    This video Micro Tutorial is the first in a two-part series that shows how to create and use custom scanning profiles in Nuance's PaperPort 14.5 (http://www.experts-exchange.com/articles/17490/). But the ability to create custom scanning profiles al…
    Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…

    875 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    11 Experts available now in Live!

    Get 1:1 Help Now