Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win


Have an NT4 domain still and need to move to AD asap

Posted on 2006-06-22
Medium Priority
Last Modified: 2010-04-13
I understand that this is not a light issue and we cannot migrate our entire network overnight.
First, the reason I am asking is that we are implementing an application that offers SSO and can integrate with Active Directory.
What I am hoping is this, can I setup a Windows 2003 server and run in mixed mode to allow me time to plan the eventual network migration to Active Directory, but at the same time allow our SSO product to access the W2003 server for Active Directory authentication?
Question by:harlemit
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
LVL 85

Accepted Solution

oBdA earned 1000 total points
ID: 16963257
You can NOT use a W2k3 machine as DC in an NT4 domain. The only way to do that would be a separate AD domain, then create a trust to your NT4 domain.
You could then use the ADMT to move your users over to the new domain.
Active Directory Migration Tool v3.0

But the easiest way is usually to just upgrade your NT4 domain. You can keep your NT4 BDCs, you can keep your NT4 domain members, basically nobody will notice what happened.
Install DNS on the new W2k3 machine, create a zone with the future DNS domain name you're using; enable dynamic updates on the zone, and let the machine point *only* to itself for DNS resolution.
Install NT4 as BDC in your current domain on an NT4 compatible machine (can be a virtual machine!), let the machine point to the W2k3 machine for DNS.
Do a full replication of your DCs.
Promote your new BDC to PDC, then shutdown your old PDC (now BDC) as a backup. If you have domain members running W2k or later, you might want to set the "NT4Emulator" registry entry (as described below) *before* you run the upgrade; not (only) to prevent the overloading, but also to prevent your W2k/XP machines to recognize the domain as AD domain and change their logon behaviour (just in case you want to go back to NT4). If you do so, set the value on the W2k3 machine as well, and set the "NeutralizeNT4Emulator" on both machines, too (they have to recognize each other as DCs).
Upgrade the NT4 PDC to Server 2003.
Promote the W2k3 machine to DC, make it a global catalog.
Transfer the FSMO roles to the W2k3 machine, then depromote the ugraded server (never, ever, simply remove a DC in an AD domain!).
As usual: Make sure you have working backups, and try the method that's best for you in a lab environment before starting in your production domain.

If you already have W2k/XP clients, you might have a look at this article before starting the upgrade:
How to prevent overloading on the first domain controller during domain upgrade

How To View and Transfer FSMO Roles in Windows Server 2003

How to promote a domain controller to a global catalog server

And you want to make sure your DNS settings are correct:
Frequently Asked Questions About Windows 2000 DNS and Windows Server 2003 DNS

Best practices for DNS client settings in Windows 2000 Server and in Windows Server 2003

And some other links that might be useful:
Tools and Documentation for Upgrading to Windows Server 2003

Background Information for Upgrading to Windows Server 2003 Active Directory

Migrating Windows NT Server 4.0 Domains to Windows Server 2003 Active Directory

Microsoft Virtual Server 2005

Author Comment

ID: 16964172
Wow, that was quick and complete.
Thank you.
I do have one additional question.
Our current NT4 PDC is also our file and print server, can I demote it to a BDC and leave it online rather than shutting it down and take another BDC and shut it down for DR sake?
LVL 85

Expert Comment

ID: 16964226
Sure; any BDC will do. This one is just in case something goes really bad, but that shouldn't happen; the upgrade from NT4 to 2003 is not the mess it was with Win9x. If you're using hardware (instead of a virtual machine) to do the upgrade, install it as a member server first and do a regular upgrade to 2003, just to make sure the OS upgrade will work properly. Then reinstall as BDC and continue as described.
You can use Virtual Server as well to test the upgrade to AD and the FSMO move in general, without endangering your production environment; some desktop hardware with 2GB RAM and plenty of HD space will do.
Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.


Author Comment

ID: 17195626
We do have a handful of w95 machines out there still for assorted reasons which I know will make this more difficult.
Is there any benefit to moving to W2000 server first and once on AD then upgrade to 2003?
LVL 85

Expert Comment

ID: 17195720
Nope. Not to mention that the upgrade from NT4 to W2k3 has been improved as compared to the upgrade from NT4 to W2k.
If you still hav Win9x clients, don't forget that you'll still need a WINS server.

Author Comment

ID: 17196038
One last question and the points are awarded.
Just to clarify:
I am building a new server as an NT BDC and taking it offline.
I will then upgrade the NT4 PDC to W2003.
Make it a global catalog server.
At this point my old NT4 domain is still in tact acting as it was and I will have LDAP connectivity to the W2003 server to access the user NT4 domain user accounts.

The last line is what I am not sure of.
Will the W2003 machine keep in sync with the NT4 domain?
LVL 85

Expert Comment

ID: 17196129
Hm? Earlier, you said that you wanted to keep your current PDC online.
Again: If you're using hardware (the upgrade works fine on a virtual machine) as the "Upgrade DC", start with building a new server as NT4 stand-alone, upgrade it to W2k3 to make sure the upgrade from NT4 works okay. You don't want to find out during the "real" upgrade that the hardware is giving you trouble.
Once you're sure the upgrade will work, install the new server again, this time as BDC. Replicate, upgrade it to PDC (which will automatically downgrade the current PDC to BDC). Take any BDC offline during the upgrade, just in case.
Continue as described above.
And, yes, the W2k3 machine will behave just like an NT4 PDC as far as your NT4 BDCs are concerned.

Featured Post

[Webinar] Lessons on Recovering from Petya

Skyport is working hard to help customers recover from recent attacks, like the Petya worm. This work has brought to light some important lessons. New malware attacks like this can take down your entire environment. Learn from others mistakes on how to prevent Petya like worms.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Working from home is a dream for many people who aren’t happy about getting up early, going to the office, and spending long hours at work. There are lots of benefits of remote work for employees.
In this video you will find out how to export Office 365 mailboxes using the built in eDiscovery tool. Bear in mind that although this method might be useful in some cases, using PST files as Office 365 backup is troublesome in a long run (more on t…
In a question here at Experts Exchange (https://www.experts-exchange.com/questions/29062564/Adobe-acrobat-reader-DC.html), a member asked how to create a signature in Adobe Acrobat Reader DC (the free Reader product, not the paid, full Acrobat produ…

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question