Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win


Adding Server 2008 as a domain controller on a Windows 2000 Server domain

Posted on 2008-06-18
Medium Priority
Last Modified: 2009-12-14
I'm getting ready to add a Windows 2008 (or 2003, depending on the answer) server to an existing Windows 2000 domain.  The current domain is comprised of a single DC, with Exchange 2000 on it (not an SBS).   The DC must be replaced.  Installing the next version of Exchange will not be in the upgrade plan.  My questions are:
- I was planning on removing Exchange from the current DC, then run through the steps here:
My main concern is Exchange - do I need to make any adjustments or do anything else to get Exchange out of the AD?
-  Are there any issues that would make upgrading to a 2003 server a better bet?  Going to 2008 isn't an absolute requirement.
Question by:mike1025
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4
LVL 58

Expert Comment

ID: 21815167
The procedure for upgrading to Windows Server 2008 and migrating all the Active Directory roles is described at the end of this message. It effectively involves moving all the roles across to the new server, and then running dcpromo on the old server to remove it as a Domain Controller from the domain.

You must remember that a server running Exchange CANNOT have its domain controller status changed whilst Exchange is installed. Running dcpromo on any Exchange Server will break Exchange.

If you want the new Domain Controller to be the Exchange Server too, you cannot run any version of Exchange prior to Exchange 2007 SP1. If you want to add Exchange to this server, you must complete the Active Directory migration procedure and then install Exchange. Then following this several part series to transition to the Exchange 2007 server, and remove Exchange from the 2000 server before dcpromo'ing it.

I hope that makes sense! The standard procedure for the Active Directory migration is below.

Any questions, post back.

Install Windows Server 2008 onto the new server which is intended to be promoted as a Domain Controller. Ensure the new server is assigned a routable static IP address on your IP subnet. Ensure the IP address is not included in any of your existing DHCP scopes. The only DNS server entry at this stage should be the IP address of the existing domain controller on your network.

After installation, join the new machine to the existing domain as a member server. This procedure is exactly the same as joining a workstation to the domain.

Since you are upgrading the Operating System on the new Domain Controller, you will need to add some values to the existing Active Directory schema, in order for the new server to become a Domain Controller. Windows Server 2008 supports more functionality than before, so a schema upgrade for the domain and forest is required to facilitate this and make this new feature set fully functional on the domain. To make the necessary changes, you must be logged on as the built-in Administrator user account, or a user with Domain, Schema and Enterprise Admin privileges.

Insert the Windows Server 2008 media into your current server . Open a command prompt and browse to sources\adprep folder within the Windows Server 2008 DVD media. Execute the command adprep /forestprep.

Next, execute adprep /domainprep . You must be logged on as a Domain Admin user for these steps to work correctly. Once these commands have run your Active Directory schema will have been extended to support Windows Server 2008 as a Domain Controller.

The next step is to promote the new server as a Domain Controller for the domain. Enter dcpromo at a command prompt and follow the wizard. When prompted, select the option for an additional domain controller in an existing domain. After the wizard completes, the new server will be acting as a Domain Controller for your domain. It is necessary at this point to restart the server for these changes to be applied.

In a single-domain Active Directory forest, all servers should also be Global Catalog servers. The Global Catalog is a required component of Active Directory which is used during logins to establish universal group membership for a user account. To promote the new server as a Global Catalog, open Active Directory Sites and Services from the Administrative Tools container within Control Panel or on the Start Menu. Double-click Sites, then Servers, followed by the name of the new server. Next, right-click "NTDS Settings" and select Properties. On the General tab, check the Global Catalog checkbox. Restart the new Domain Controller for changes to take effect.

Since you intend on removing the old Domain Controller from the domain, you need to transfer all the Operations (FSMO) roles to the new Domain Controller.

The current FSMO role configuration for your network can be found by running the command "netdom query fsmo" at a command prompt on a Domain Controller.

To transfer these FSMO roles to the new domain controller, follow the information detailed in the following Microsoft Support article: http://support.microsoft.com/kb/324801. Please ensure any other information you follow is information regarding the TRANSFER of FSMO roles. Seizing FSMO roles is an emergency operation which should not be performed during this procedure.

DNS is a critical component of your Active Directory network. The easiest way to install the DNS role onto the new server is to follow the instructions outlined at http://technet2.microsoft.com/WindowsServer2008/en/library/3cf4d1b1-7a6e-4438-bf4f-22d9468c17321033.mspx You should be already using Active Directory-integrated DNS zones, which is the easiest method of allowing DNS replication to occur - DNS information is stored in Active Directory and replicates with Domain Controller replication traffic. To check if your DNS zones are AD-integrated (and convert them if not), please follow http://support.microsoft.com/kb/227844.

You probably want to enable DNS forwarding in the DNS console on the server, too. This forwards lookups for external domains to a DNS server at your ISP, which allows the server to effectively resolve DNS for external domains. More information on forwarders can be found at http://technet2.microsoft.com/WindowsServer/en/Library/ee992253-235e-4fd4-b4da-7e57e70ad3821033.mspx.

To move DHCP to the new server, you will need to first install the role. To install the role in Windows Server 2008, check the DHCP Server role option within the Add Roles wizard in the Server Manager. To correctly configure DHCP after the role is installed on your new server, you will need to ensure you configure it to distribute IP addresses which are in a different range to the IP scope defined on the other DHCP server. You should also ensure the correct DNS and WINS servers are entered into the scope options. Remember that the only DNS servers which should be configured on workstations are the Domain Controllers which are also acting as DNS servers - no ISP DNS server should ever be set through DHCP.

Once all of these steps have been completed, you should have successfully transferred all of the Active Directory roles to the new domain controller. At this stage, I would suggest you shut down the old domain controller and check to ensure all services on workstations and servers are working correctly - including logins. If they are, you should be safe to switch the old DC back on, run dcpromo (after migrating and uninstalling Exchange) and demote it from its Domain Controller role. This will remove the DC as a Domain Controller, leaving it as a member server on the network.

To completely remove the DC from the network, you will need to remember that any other data - including folder redirection folders and user profiles - should be replicated or otherwise transferred to either the new server or another location on the network.


Only install Exchange 2007 to the new server after it is promoted as domain controller.


Author Comment

ID: 21827744
I'm sorry, the question wasn't quite clear on this part: I want to remove Exchange from the domain before upgrading.  Nobody on the network currently uses Exchange, and I can't see why it should be installed on a new server.
As far as I understand, removing Exchange involves removing all user mailboxes, and then running the Exchange setup program and choosing to 'Remove' individual components.  My main worry is that just going through these steps might cause me some trouble once I try to add the new server to the mix.  
LVL 58

Accepted Solution

tigermatt earned 1000 total points
ID: 21828822
In that case, it's just a case of doing exactly as you describe. Here's a slightly more detailed guide, to give you the exact process: http://www.msexchange.org/tutorials/Remove-Exchange-server-entire-Exchange-organization.html.

I would say you want to remove Exchange before you even introduce the new server to the domain.

Veeam Disaster Recovery in Microsoft Azure

Veeam PN for Microsoft Azure is a FREE solution designed to simplify and automate the setup of a DR site in Microsoft Azure using lightweight software-defined networking. It reduces the complexity of VPN deployments and is designed for businesses of ALL sizes.


Author Comment

ID: 21840448
One followup to this question:
At the bottom of the linked article, the author cut and paste the MS knowledgebase article for completely removing Exchange from an organization.  That article references the following steps that don't make much sense in a one server environment:
    * Shut down the member server or domain controller where Exchange 2003 was installed.
    * Restart the domain controller that you were using to remove the Exchange organization.
    * Allow sufficient time for replication to occur between the domain controllers.
    * Save the setup logs.
    * Rerun setup /forestprep.
    * Rerun setup /domainprep. If this is the same server that was used previously, move the old setup logs out.
    * Verify permissions in the Exchange 5.5 organization. The user who is logged on must be in the group that was designated during forestprep and must have permissions on the Exchange 5.5 Organization, Site, and Configuration containers.
    * Make sure that you can connect to all the Exchange 5.5 computers by using the Administrator program from the intended Exchange 2003 installation server, and then view the properties of the Exchange 5.5 servers.
    * Remove the Administrator program from this server.
    * Install Exchange 2003.

Do these items need to be done in a one server environment?  What about the forestprep and domainprep options?

Author Comment

ID: 21840455
Beg pardon, the above was listed for completely removing Exchange from the AD.
LVL 58

Expert Comment

ID: 21840572

Author Comment

ID: 21841171
Tigermatt, does that mean you're unsure of the question, or that I need to ask another question and add more points?
LVL 58

Expert Comment

ID: 21841303
Sorry I interpreted your second comment as though you had sorted it out and didn't need my help any more! If I understand you correctly, the best way to migrate Exchange to your new server is as follows:

1. If the new server will be a DC, install it and promote it to DC first.
2. Install Exchange to the new server and migrate Exchange over to it as per http://www.amset.info/exchange/migration.asp.
3. Once Exchange is up and running on the new server and all roles are transferred as per the article, you must then uninstall Exchange from the original server and reboot several times to clear Exchange out fully.
4. Then you can demote the original DC as you wish.

Don't forget that if you want to go to Server 2008 and install Exchange to it, you MUST use no version of Exchange earlier than Exchange 2007 SP1.

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP,  Windows Server…
This process allows computer passwords to be managed and secured without using LAPS. This is an improvement on an existing process, enhanced to store password encrypted, instead of clear-text files within SQL
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
Suggested Courses

618 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question