Have an NT4 domain still and need to move to AD asap

Posted on 2006-06-22
Medium Priority
Last Modified: 2010-04-13
I understand that this is not a light issue and we cannot migrate our entire network overnight.
First, the reason I am asking is that we are implementing an application that offers SSO and can integrate with Active Directory.
What I am hoping is this, can I setup a Windows 2003 server and run in mixed mode to allow me time to plan the eventual network migration to Active Directory, but at the same time allow our SSO product to access the W2003 server for Active Directory authentication?
Question by:harlemit
  • 4
  • 3
LVL 85

Accepted Solution

oBdA earned 1000 total points
ID: 16963257
You can NOT use a W2k3 machine as DC in an NT4 domain. The only way to do that would be a separate AD domain, then create a trust to your NT4 domain.
You could then use the ADMT to move your users over to the new domain.
Active Directory Migration Tool v3.0

But the easiest way is usually to just upgrade your NT4 domain. You can keep your NT4 BDCs, you can keep your NT4 domain members, basically nobody will notice what happened.
Install DNS on the new W2k3 machine, create a zone with the future DNS domain name you're using; enable dynamic updates on the zone, and let the machine point *only* to itself for DNS resolution.
Install NT4 as BDC in your current domain on an NT4 compatible machine (can be a virtual machine!), let the machine point to the W2k3 machine for DNS.
Do a full replication of your DCs.
Promote your new BDC to PDC, then shutdown your old PDC (now BDC) as a backup. If you have domain members running W2k or later, you might want to set the "NT4Emulator" registry entry (as described below) *before* you run the upgrade; not (only) to prevent the overloading, but also to prevent your W2k/XP machines to recognize the domain as AD domain and change their logon behaviour (just in case you want to go back to NT4). If you do so, set the value on the W2k3 machine as well, and set the "NeutralizeNT4Emulator" on both machines, too (they have to recognize each other as DCs).
Upgrade the NT4 PDC to Server 2003.
Promote the W2k3 machine to DC, make it a global catalog.
Transfer the FSMO roles to the W2k3 machine, then depromote the ugraded server (never, ever, simply remove a DC in an AD domain!).
As usual: Make sure you have working backups, and try the method that's best for you in a lab environment before starting in your production domain.

If you already have W2k/XP clients, you might have a look at this article before starting the upgrade:
How to prevent overloading on the first domain controller during domain upgrade

How To View and Transfer FSMO Roles in Windows Server 2003

How to promote a domain controller to a global catalog server

And you want to make sure your DNS settings are correct:
Frequently Asked Questions About Windows 2000 DNS and Windows Server 2003 DNS

Best practices for DNS client settings in Windows 2000 Server and in Windows Server 2003

And some other links that might be useful:
Tools and Documentation for Upgrading to Windows Server 2003

Background Information for Upgrading to Windows Server 2003 Active Directory

Migrating Windows NT Server 4.0 Domains to Windows Server 2003 Active Directory

Microsoft Virtual Server 2005

Author Comment

ID: 16964172
Wow, that was quick and complete.
Thank you.
I do have one additional question.
Our current NT4 PDC is also our file and print server, can I demote it to a BDC and leave it online rather than shutting it down and take another BDC and shut it down for DR sake?
LVL 85

Expert Comment

ID: 16964226
Sure; any BDC will do. This one is just in case something goes really bad, but that shouldn't happen; the upgrade from NT4 to 2003 is not the mess it was with Win9x. If you're using hardware (instead of a virtual machine) to do the upgrade, install it as a member server first and do a regular upgrade to 2003, just to make sure the OS upgrade will work properly. Then reinstall as BDC and continue as described.
You can use Virtual Server as well to test the upgrade to AD and the FSMO move in general, without endangering your production environment; some desktop hardware with 2GB RAM and plenty of HD space will do.
Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.


Author Comment

ID: 17195626
We do have a handful of w95 machines out there still for assorted reasons which I know will make this more difficult.
Is there any benefit to moving to W2000 server first and once on AD then upgrade to 2003?
LVL 85

Expert Comment

ID: 17195720
Nope. Not to mention that the upgrade from NT4 to W2k3 has been improved as compared to the upgrade from NT4 to W2k.
If you still hav Win9x clients, don't forget that you'll still need a WINS server.

Author Comment

ID: 17196038
One last question and the points are awarded.
Just to clarify:
I am building a new server as an NT BDC and taking it offline.
I will then upgrade the NT4 PDC to W2003.
Make it a global catalog server.
At this point my old NT4 domain is still in tact acting as it was and I will have LDAP connectivity to the W2003 server to access the user NT4 domain user accounts.

The last line is what I am not sure of.
Will the W2003 machine keep in sync with the NT4 domain?
LVL 85

Expert Comment

ID: 17196129
Hm? Earlier, you said that you wanted to keep your current PDC online.
Again: If you're using hardware (the upgrade works fine on a virtual machine) as the "Upgrade DC", start with building a new server as NT4 stand-alone, upgrade it to W2k3 to make sure the upgrade from NT4 works okay. You don't want to find out during the "real" upgrade that the hardware is giving you trouble.
Once you're sure the upgrade will work, install the new server again, this time as BDC. Replicate, upgrade it to PDC (which will automatically downgrade the current PDC to BDC). Take any BDC offline during the upgrade, just in case.
Continue as described above.
And, yes, the W2k3 machine will behave just like an NT4 PDC as far as your NT4 BDCs are concerned.

Featured Post

Important Lessons on Recovering from Petya

In their most recent webinar, Skyport Systems explores ways to isolate and protect critical databases to keep the core of your company safe from harm.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
If anyone asked you to network diagram of the internet, it was drawn in the form of a fluffy cloud which further became known as cloud computing. Popularly cloud computing is defined as workloads that run over the internet in a commercial provider’s…
this video summaries big data hadoop online training demo (http://onlineitguru.com/big-data-hadoop-online-training-placement.html) , and covers basics in big data hadoop .
In a question here at Experts Exchange (https://www.experts-exchange.com/questions/29062564/Adobe-acrobat-reader-DC.html), a member asked how to create a signature in Adobe Acrobat Reader DC (the free Reader product, not the paid, full Acrobat produ…
Suggested Courses

829 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question