Have an NT4 domain still and need to move to AD asap

I understand that this is not a light issue and we cannot migrate our entire network overnight.
First, the reason I am asking is that we are implementing an application that offers SSO and can integrate with Active Directory.
What I am hoping is this, can I setup a Windows 2003 server and run in mixed mode to allow me time to plan the eventual network migration to Active Directory, but at the same time allow our SSO product to access the W2003 server for Active Directory authentication?
Who is Participating?
oBdAConnect With a Mentor Commented:
You can NOT use a W2k3 machine as DC in an NT4 domain. The only way to do that would be a separate AD domain, then create a trust to your NT4 domain.
You could then use the ADMT to move your users over to the new domain.
Active Directory Migration Tool v3.0

But the easiest way is usually to just upgrade your NT4 domain. You can keep your NT4 BDCs, you can keep your NT4 domain members, basically nobody will notice what happened.
Install DNS on the new W2k3 machine, create a zone with the future DNS domain name you're using; enable dynamic updates on the zone, and let the machine point *only* to itself for DNS resolution.
Install NT4 as BDC in your current domain on an NT4 compatible machine (can be a virtual machine!), let the machine point to the W2k3 machine for DNS.
Do a full replication of your DCs.
Promote your new BDC to PDC, then shutdown your old PDC (now BDC) as a backup. If you have domain members running W2k or later, you might want to set the "NT4Emulator" registry entry (as described below) *before* you run the upgrade; not (only) to prevent the overloading, but also to prevent your W2k/XP machines to recognize the domain as AD domain and change their logon behaviour (just in case you want to go back to NT4). If you do so, set the value on the W2k3 machine as well, and set the "NeutralizeNT4Emulator" on both machines, too (they have to recognize each other as DCs).
Upgrade the NT4 PDC to Server 2003.
Promote the W2k3 machine to DC, make it a global catalog.
Transfer the FSMO roles to the W2k3 machine, then depromote the ugraded server (never, ever, simply remove a DC in an AD domain!).
As usual: Make sure you have working backups, and try the method that's best for you in a lab environment before starting in your production domain.

If you already have W2k/XP clients, you might have a look at this article before starting the upgrade:
How to prevent overloading on the first domain controller during domain upgrade

How To View and Transfer FSMO Roles in Windows Server 2003

How to promote a domain controller to a global catalog server

And you want to make sure your DNS settings are correct:
Frequently Asked Questions About Windows 2000 DNS and Windows Server 2003 DNS

Best practices for DNS client settings in Windows 2000 Server and in Windows Server 2003

And some other links that might be useful:
Tools and Documentation for Upgrading to Windows Server 2003

Background Information for Upgrading to Windows Server 2003 Active Directory

Migrating Windows NT Server 4.0 Domains to Windows Server 2003 Active Directory

Microsoft Virtual Server 2005
harlemitAuthor Commented:
Wow, that was quick and complete.
Thank you.
I do have one additional question.
Our current NT4 PDC is also our file and print server, can I demote it to a BDC and leave it online rather than shutting it down and take another BDC and shut it down for DR sake?
Sure; any BDC will do. This one is just in case something goes really bad, but that shouldn't happen; the upgrade from NT4 to 2003 is not the mess it was with Win9x. If you're using hardware (instead of a virtual machine) to do the upgrade, install it as a member server first and do a regular upgrade to 2003, just to make sure the OS upgrade will work properly. Then reinstall as BDC and continue as described.
You can use Virtual Server as well to test the upgrade to AD and the FSMO move in general, without endangering your production environment; some desktop hardware with 2GB RAM and plenty of HD space will do.
Cloud Class® Course: C++ 11 Fundamentals

This course will introduce you to C++ 11 and teach you about syntax fundamentals.

harlemitAuthor Commented:
We do have a handful of w95 machines out there still for assorted reasons which I know will make this more difficult.
Is there any benefit to moving to W2000 server first and once on AD then upgrade to 2003?
Nope. Not to mention that the upgrade from NT4 to W2k3 has been improved as compared to the upgrade from NT4 to W2k.
If you still hav Win9x clients, don't forget that you'll still need a WINS server.
harlemitAuthor Commented:
One last question and the points are awarded.
Just to clarify:
I am building a new server as an NT BDC and taking it offline.
I will then upgrade the NT4 PDC to W2003.
Make it a global catalog server.
At this point my old NT4 domain is still in tact acting as it was and I will have LDAP connectivity to the W2003 server to access the user NT4 domain user accounts.

The last line is what I am not sure of.
Will the W2003 machine keep in sync with the NT4 domain?
Hm? Earlier, you said that you wanted to keep your current PDC online.
Again: If you're using hardware (the upgrade works fine on a virtual machine) as the "Upgrade DC", start with building a new server as NT4 stand-alone, upgrade it to W2k3 to make sure the upgrade from NT4 works okay. You don't want to find out during the "real" upgrade that the hardware is giving you trouble.
Once you're sure the upgrade will work, install the new server again, this time as BDC. Replicate, upgrade it to PDC (which will automatically downgrade the current PDC to BDC). Take any BDC offline during the upgrade, just in case.
Continue as described above.
And, yes, the W2k3 machine will behave just like an NT4 PDC as far as your NT4 BDCs are concerned.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.