Link to home
Start Free TrialLog in
Avatar of ISSit
ISSit

asked on

Changing to a new Domain Controller

I have a few questions I hope someone can answer.  At present I have a domain controller that for some reason will not allow users to access with roaming profiles.  In discussion with a Microsoft technician he advised that it would be best to re-install the OS and build DC from scratch.  He stated that there were so many problems, that this would be the easiest solution.  Rather than completely wipe the DC and build over, I was wondering if I built up another server, ran DCPromo and move the roles from the troubled DC to this new one then demote the troubled server and rebuild at that time.  I would think that this would keep my users accounts available and I am hoping that the roaming profile issue would be fixed as well.  Would like your thoughts on this matter.  Also was wondering if you know if a DC can run from a virtual server environment?  I have a VMware server it would be ideal if I could build this new server from within here then maybe share the roles when I the old server is rebuilt.  I hope this makes sense.
Avatar of tigermatt
tigermatt
Flag of United Kingdom of Great Britain and Northern Ireland image


It depends on what is actually causing the Roaming Profile issue. It is unusual that an installation of a server Operating System could cause Roaming Profiles not to work. I would usually put it down to either a misconfiguration of permissions or roaming profiles themselves, or an issue with the Active Directory Schema. Since you've been in touch with Microsoft anyway, I would guess they have checked through with you your configuration to ensure it is OK, and you have exhausted efforts to try to correct it, which must indicate the issue is somewhere either with the installation of the server, workstation or the domain.

If the domain is indeed the problem, then you will need to build a completely new domain in a new forest and start fresh. This means a total migration off of one Domain Controller and onto another one, something which is on such a scale that I would not recommend you carry this out until you prove it is not a specific DC which is causing it.

You can build a new DC in the existing domain as either a physical or virtual machine. If you wish to virtualise it, any virtualisation product would do - VMWare, Virtual Server 2005, Server 2008's Hyper-V or even Virtual PC 2007 (although VPC would be less reliable for running a server, in my opinion). I've posted below the instructions for installing a new DC and migrating roles for you to follow, and then you can test Roaming Profiles again to prove where the cause of the issue actually is.

---

Install Windows Server 2008 onto the new server which is intended to be promoted as a Domain Controller. Ensure the new server is assigned a routable static IP address on your IP subnet. Ensure the IP address is not included in any of your existing DHCP scopes. The only DNS server entry at this stage should be the IP address of the existing domain controller on your network.

After installation, join the new machine to the existing domain as a member server. This procedure is exactly the same as joining a workstation to the domain.

Promote the new server as a Domain Controller for the domain. Enter dcpromo at a command prompt and follow the wizard. When prompted, select the option for an additional domain controller in an existing domain. After the wizard completes, the new server will be acting as a Domain Controller for your domain. It is necessary at this point to restart the server for these changes to be applied.

In a single-domain Active Directory forest, all servers should also be Global Catalog servers. The Global Catalog is a required component of Active Directory which is used during logins to establish universal group membership for a user account. To promote the new server as a Global Catalog, open Active Directory Sites and Services from the Administrative Tools container within Control Panel or on the Start Menu. Double-click Sites, then Servers, followed by the name of the new server. Next, right-click "NTDS Settings" and select Properties. On the General tab, check the Global Catalog checkbox. Restart the new Domain Controller for changes to take effect.

Since you intend on removing the old Domain Controller from the domain, you need to transfer all the Operations (FSMO) roles to the new Domain Controller.

The current FSMO role configuration for your network can be found by running the command "netdom query fsmo" at a command prompt on a Domain Controller.

To transfer these FSMO roles to the new domain controller, follow the information detailed in the following Microsoft Support article: http://support.microsoft.com/kb/324801. Please ensure any other information you follow is information regarding the TRANSFER of FSMO roles. Seizing FSMO roles is an emergency operation which should not be performed during this procedure.

DNS is a critical component of your Active Directory network. The easiest way to install the DNS role onto the new server is to follow the instructions outlined at http://technet2.microsoft.com/WindowsServer2008/en/library/3cf4d1b1-7a6e-4438-bf4f-22d9468c17321033.mspx You should be already using Active Directory-integrated DNS zones, which is the easiest method of allowing DNS replication to occur - DNS information is stored in Active Directory and replicates with Domain Controller replication traffic. To check if your DNS zones are AD-integrated (and convert them if not), please follow http://support.microsoft.com/kb/227844.

You probably want to enable DNS forwarding in the DNS console on the server, too. This forwards lookups for external domains to a DNS server at your ISP, which allows the server to effectively resolve DNS for external domains. More information on forwarders can be found at http://technet2.microsoft.com/WindowsServer/en/Library/ee992253-235e-4fd4-b4da-7e57e70ad3821033.mspx.

To move DHCP to the new server, you will need to first install the role. To install the role in Windows Server 2008, check the DHCP Server role option within the Add Roles wizard in the Server Manager. To correctly configure DHCP after the role is installed on your new server, you will need to ensure you configure it to distribute IP addresses which are in a different range to the IP scope defined on the other DHCP server. You should also ensure the correct DNS and WINS servers are entered into the scope options. Remember that the only DNS servers which should be configured on workstations are the Domain Controllers which are also acting as DNS servers - no ISP DNS server should ever be set through DHCP.

Once all of these steps have been completed, you should have successfully transferred all of the Active Directory roles to the new domain controller. At this stage, I would suggest you shut down the old domain controller and check to ensure all services on workstations and servers are working correctly - including logins. If they are, you should be safe to switch the old DC back on, run dcpromo and demote it from its Domain Controller role. This will remove the DC as a Domain Controller, leaving it as a member server on the network.

To completely remove the DC from the network, you will need to remember that any other data - including folder redirection folders and user profiles - should be replicated or otherwise transferred to either the new server or another location on the network.

-tigermatt
Avatar of ISSit
ISSit

ASKER

tigermatt, thank you for taking the time.
I hope to start this process later this week, had a question as I read through you response.  The link for transferring roles was for Windows 1003 server, I assume that it is applicable to 2008, correct?
I am not sure what to do about the DHCP server, you stated that it needed to be configured to distribute IP addresses which are in a different range to the IP scope...  Does that mean that where my current range is 192.168.0.??? for example the new scope should be 192.168.5.???  Sorry if this is an inane question, but need this to go smoothly so I want to be clear.  
With respect to Microsoft, there were diags run, but I feel that if the system was as bad off as the technician made it sound, I would think that it would not function at all.  One thing he pointed out was the fact that we ran out of disk space on the C: drive, this may of caused corruption.  Over all I just felt that the response was more out of a desire to pawn it off (not wanting to deal with it (I use to work support for Gateway some years ago and the reformat and reinstall was a means of getting the caller off the line.  
> The link for transferring roles was for Windows 1003 server, I assume that it is applicable to 2008, correct?

Yes, the link should apply to 2008 too, sorry I should have made that more clear :)

> I am not sure what to do about the DHCP server, you stated that it needed to be configured to distribute IP addresses which are in a different range to the IP scope...  Does that mean that where my current range is 192.168.0.??? for example the new scope should be 192.168.5.???

This all depends on a) your current configuration, and b) what you intend on doing with the old server. If you are going to completely remove the DHCP Server on the old server, then you can just copy the configuration from the old server's DHCP to the new server's. Once you have copied it across, you simply need to uninstall DHCP from the old server, and the new server will take over.

My instructions are really geared to if you wanted to stay with the same Domain Controller and merely add a new one; in this case, to prevent any IP clashes you would have to ensure the IP addresses the two DHCP servers are handing out, but it is more than likely these must still begin with 192.168.0.xxx, but not overlap with the other IPs. Sorry, probably didn't explain this too well, but since you want to remove the old DC, you just need to transfer the configuration, then uninstall DHCP from the old server.

-tigermatt
Avatar of ISSit

ASKER

My plans are to change the server over.  If Microsoft is correct and my current DC has issues I want change it out.  The thought is to put the new server on-line, demote the current, reformat and reinstall, place it back on-line as a secondary DC.  So do I have this straight, if I want to keep the same range, I can set up DHCP with the same range, when ready (after all roles are moved) turn off DHCP on the old server and start it on the new?
ASKER CERTIFIED SOLUTION
Avatar of tigermatt
tigermatt
Flag of United Kingdom of Great Britain and Northern Ireland image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of ISSit

ASKER

I am a bit slow, but tigermatt was patient with his responses.
thank you

ISSit,

Don't worry about it :)
Thanks!

-Matt