Link to home
Start Free TrialLog in
Avatar of PaperTiger
PaperTigerFlag for United States of America

asked on

Moving DC (GC) to new hardware

I am planning to move one of my DC to a new computer. The particular DC is also my GC.

I use Acronis Universal Restore to restore from an Acronis image.

Is that all i need to do?

The problem is when I did this with a member server, after booting up the member server, it says:

"The system cannot log you on to this domain because the system's computer account in its primary domain is missing or the password on that account is incorrect"

Remember I only recovered from an image, no SID has been changed.
Avatar of Rajith Enchiparambil
Rajith Enchiparambil
Flag of United Kingdom of Great Britain and Northern Ireland image

That won't be the best way.

Install AD on the new computer while the present one is online. Make it as a GC, DNS and DHCP as well. And change all the FSMO roles. And then demote the present DC and shut it down.
Avatar of tigermatt
I would not recommend you transfer over an image of the system. You will got driver incompatibilites as well as a whole host of other issues. The best way to achieve this - while it will take slightly longer - is as I have detailed below for you.

--

Install Windows Server 2003 onto the new server which is intended to be promoted as a Domain Controller. Ensure the new server is assigned a routable static IP address on your IP subnet. Ensure the IP address is not included in any of your existing DHCP scopes. The only DNS server entry at this stage should be the IP address of the existing domain controller on your network.

After installation, join the new machine to the existing domain as a member server. This procedure is exactly the same as joining a workstation to the domain.

Promote the new server as a Domain Controller for the domain. Enter dcpromo at a command prompt and follow the wizard. When prompted, select the option for an additional domain controller in an existing domain. After the wizard completes, the new server will be acting as a Domain Controller for your domain. It is necessary at this point to restart the server for these changes to be applied.

In a single-domain Active Directory forest, all servers should also be Global Catalog servers. The Global Catalog is a required component of Active Directory which is used during logins to establish universal group membership for a user account. To promote the new server as a Global Catalog, open Active Directory Sites and Services from the Administrative Tools container within Control Panel or on the Start Menu. Double-click Sites, then Servers, followed by the name of the new server. Next, right-click "NTDS Settings" and select Properties. On the General tab, check the Global Catalog checkbox. Restart the new Domain Controller for changes to take effect.

Since you intend on removing the old Domain Controller from the domain, you need to transfer all the Operations (FSMO) roles to the new Domain Controller.

The current FSMO role configuration for your network can be found by running the command "netdom query fsmo" at a command prompt on a Domain Controller.

To transfer these FSMO roles to the new domain controller, follow the information detailed in the following Microsoft Support article: http://support.microsoft.com/kb/324801. Please ensure any other information you follow is information regarding the TRANSFER of FSMO roles. Seizing FSMO roles is an emergency operation which should not be performed during this procedure.

DNS is a critical component of your Active Directory network. The easiest way to install the DNS role onto the new server is to follow the instructions outlined at http://support.microsoft.com/kb/814591 You should be already using Active Directory-integrated DNS zones, which is the easiest method of allowing DNS replication to occur - DNS information is stored in Active Directory and replicates with Domain Controller replication traffic. To check if your DNS zones are AD-integrated (and convert them if not), please follow http://support.microsoft.com/kb/227844.

You probably want to enable DNS forwarding in the DNS console on the server, too. This forwards lookups for external domains to a DNS server at your ISP, which allows the server to effectively resolve DNS for external domains. More information on forwarders can be found at http://technet2.microsoft.com/WindowsServer/en/Library/ee992253-235e-4fd4-b4da-7e57e70ad3821033.mspx.

To move DHCP to the new server, you will need to first install the role. Please see http://support.microsoft.com/kb/300429 for information on how to do this. To correctly configure DHCP after the role is installed on your new server, you will need to ensure you configure it to distribute IP addresses which are in a different range to the IP scope defined on the other DHCP server. You should also ensure the correct DNS and WINS servers are entered into the scope options. Remember that the only DNS servers which should be configured on workstations are the Domain Controllers which are also acting as DNS servers - no ISP DNS server should ever be set through DHCP.

Once all of these steps have been completed, you should have successfully transferred all of the Active Directory roles to the new domain controller. At this stage, I would suggest you shut down the old domain controller and check to ensure all services on workstations and servers are working correctly - including logins. If they are, you should be safe to switch the old DC back on, run dcpromo and demote it from its Domain Controller role. This will remove the DC as a Domain Controller, leaving it as a member server on the network.

To completely remove the DC from the network, you will need to remember that any other data - including folder redirection folders and user profiles - should be replicated or otherwise transferred to either the new server or another location on the network.

-tigermatt
That also applies to Windows 2000, by the way :-)
Avatar of PaperTiger

ASKER

why would this not be a best way?

1. I still have my old machine available. i can turn it back on if needed.
2. the new computer will carry the same SID etc. from the old computer, which is kept down, of course.

It is not the best way to transfer Active Directory across. By building the new DC from scratch, you ensure you don't get any issues coming across from the old server - you build a completely new Active Directory partition and simply replicate with the other servers. You are also ensuring that the registry is clean and fresh, as well as a lot of other things.

The known, tried, tested and recommended way to do this is in my above post.

-tigermatt
well, what if my DC suddenly died/were toasted/flooded? I would have no choice but to recover from my image to a new hardware, right? this is the same scenario except i have a fallback.

all the driver issues have already been taken care of, very painlessly, actually.

i am worried about the restored server's FSMO roles and my Exchange.
the primary reason that i don't want to build another DC is this current DC has a lot of applications/services installed. I do have another DC available in the domain.
Restoring backups in the case of a hardware failure is the main time when you have to restore them. I can appreciate that you want to retain all your services and applications, in which case transferring the backup to new hardware may be a good idea.

If I had to transfer it using a restored backup, I would definitely be doing it to a freshly built server and transferring everything, not just System State.

-tigermatt
tigermatt, you do realize that i will be doing an image restore, which is to virtually clone my old DC using new hardware.

it's not system state restore or anything like that.
Well, personally I would still be going for building up the new server and then transferring roles etc. across manually. However, doing an image restore to new hardware with Acronis is definitely a viable approach - just not a recommended one. The fact you are doing it through Acronis is good, because it can deal with the hardware changes much better than other software.

You will need to remember that if you have Windows Server on the server licensed through an OEM license, you cannot legally transfer that license to new hardware.

-tigermatt
i am aware of the license issue. not planning to do anything illegal.
ASKER CERTIFIED SOLUTION
Avatar of tigermatt
tigermatt
Flag of United Kingdom of Great Britain and Northern Ireland image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
"it does have a good track record of being able to restore well to different server hardware." Where "it" is Acronis!
I ghosted it over using Acronis. seems to be good so far. no issue, knock on wood.