Solved

Have an NT4 domain still and need to move to AD asap

Posted on 2006-06-22
9
132 Views
Last Modified: 2010-04-13
I understand that this is not a light issue and we cannot migrate our entire network overnight.
First, the reason I am asking is that we are implementing an application that offers SSO and can integrate with Active Directory.
What I am hoping is this, can I setup a Windows 2003 server and run in mixed mode to allow me time to plan the eventual network migration to Active Directory, but at the same time allow our SSO product to access the W2003 server for Active Directory authentication?
0
Comment
Question by:harlemit
  • 4
  • 3
9 Comments
 
LVL 82

Accepted Solution

by:
oBdA earned 250 total points
ID: 16963257
You can NOT use a W2k3 machine as DC in an NT4 domain. The only way to do that would be a separate AD domain, then create a trust to your NT4 domain.
You could then use the ADMT to move your users over to the new domain.
Active Directory Migration Tool v3.0
http://www.microsoft.com/downloads/details.aspx?FamilyId=6F86937B-533A-466D-A8E8-AFF85AD3D212&displaylang=en

But the easiest way is usually to just upgrade your NT4 domain. You can keep your NT4 BDCs, you can keep your NT4 domain members, basically nobody will notice what happened.
Install DNS on the new W2k3 machine, create a zone with the future DNS domain name you're using; enable dynamic updates on the zone, and let the machine point *only* to itself for DNS resolution.
Install NT4 as BDC in your current domain on an NT4 compatible machine (can be a virtual machine!), let the machine point to the W2k3 machine for DNS.
Do a full replication of your DCs.
Promote your new BDC to PDC, then shutdown your old PDC (now BDC) as a backup. If you have domain members running W2k or later, you might want to set the "NT4Emulator" registry entry (as described below) *before* you run the upgrade; not (only) to prevent the overloading, but also to prevent your W2k/XP machines to recognize the domain as AD domain and change their logon behaviour (just in case you want to go back to NT4). If you do so, set the value on the W2k3 machine as well, and set the "NeutralizeNT4Emulator" on both machines, too (they have to recognize each other as DCs).
Upgrade the NT4 PDC to Server 2003.
Promote the W2k3 machine to DC, make it a global catalog.
Transfer the FSMO roles to the W2k3 machine, then depromote the ugraded server (never, ever, simply remove a DC in an AD domain!).
As usual: Make sure you have working backups, and try the method that's best for you in a lab environment before starting in your production domain.

If you already have W2k/XP clients, you might have a look at this article before starting the upgrade:
How to prevent overloading on the first domain controller during domain upgrade
http://support.microsoft.com/?kbid=298713

How To View and Transfer FSMO Roles in Windows Server 2003
http://support.microsoft.com/?kbid=324801

How to promote a domain controller to a global catalog server
http://support.microsoft.com/?kbid=296882

And you want to make sure your DNS settings are correct:
Frequently Asked Questions About Windows 2000 DNS and Windows Server 2003 DNS
http://support.microsoft.com/?kbid=291382

Best practices for DNS client settings in Windows 2000 Server and in Windows Server 2003
http://support.microsoft.com/?kbid=825036

And some other links that might be useful:
Tools and Documentation for Upgrading to Windows Server 2003
http://www.microsoft.com/windowsserver2003/upgrading/nt4/tooldocs/default.mspx

Background Information for Upgrading to Windows Server 2003 Active Directory
http://www.microsoft.com/resources/documentation/windowsserv/2003/all/deployguide/en-us/dssbe_upnt_huxa.asp

Migrating Windows NT Server 4.0 Domains to Windows Server 2003 Active Directory
http://www.microsoft.com/windowsserver2003/evaluation/whyupgrade/nt4/nt4domtoad.mspx

Microsoft Virtual Server 2005
http://www.microsoft.com/windowsserversystem/virtualserver/default.mspx
0
 

Author Comment

by:harlemit
ID: 16964172
Wow, that was quick and complete.
Thank you.
I do have one additional question.
Our current NT4 PDC is also our file and print server, can I demote it to a BDC and leave it online rather than shutting it down and take another BDC and shut it down for DR sake?
0
 
LVL 82

Expert Comment

by:oBdA
ID: 16964226
Sure; any BDC will do. This one is just in case something goes really bad, but that shouldn't happen; the upgrade from NT4 to 2003 is not the mess it was with Win9x. If you're using hardware (instead of a virtual machine) to do the upgrade, install it as a member server first and do a regular upgrade to 2003, just to make sure the OS upgrade will work properly. Then reinstall as BDC and continue as described.
You can use Virtual Server as well to test the upgrade to AD and the FSMO move in general, without endangering your production environment; some desktop hardware with 2GB RAM and plenty of HD space will do.
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 

Author Comment

by:harlemit
ID: 17195626
We do have a handful of w95 machines out there still for assorted reasons which I know will make this more difficult.
Is there any benefit to moving to W2000 server first and once on AD then upgrade to 2003?
0
 
LVL 82

Expert Comment

by:oBdA
ID: 17195720
Nope. Not to mention that the upgrade from NT4 to W2k3 has been improved as compared to the upgrade from NT4 to W2k.
If you still hav Win9x clients, don't forget that you'll still need a WINS server.
0
 

Author Comment

by:harlemit
ID: 17196038
One last question and the points are awarded.
Just to clarify:
I am building a new server as an NT BDC and taking it offline.
I will then upgrade the NT4 PDC to W2003.
Make it a global catalog server.
At this point my old NT4 domain is still in tact acting as it was and I will have LDAP connectivity to the W2003 server to access the user NT4 domain user accounts.

The last line is what I am not sure of.
Will the W2003 machine keep in sync with the NT4 domain?
0
 
LVL 82

Expert Comment

by:oBdA
ID: 17196129
Hm? Earlier, you said that you wanted to keep your current PDC online.
Again: If you're using hardware (the upgrade works fine on a virtual machine) as the "Upgrade DC", start with building a new server as NT4 stand-alone, upgrade it to W2k3 to make sure the upgrade from NT4 works okay. You don't want to find out during the "real" upgrade that the hardware is giving you trouble.
Once you're sure the upgrade will work, install the new server again, this time as BDC. Replicate, upgrade it to PDC (which will automatically downgrade the current PDC to BDC). Take any BDC offline during the upgrade, just in case.
Continue as described above.
And, yes, the W2k3 machine will behave just like an NT4 PDC as far as your NT4 BDCs are concerned.
 
0

Featured Post

Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

Join & Write a Comment

Suggested Solutions

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
A procedure for exporting installed hotfix details of remote computers using powershell
This video discusses moving either the default database or any database to a new volume.
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now