Solved

Adding a Server 2008 domain controller to an existing 2003 domain?

Posted on 2008-11-02
13
50,874 Views
Last Modified: 2012-09-11
I am attempting to add a 2008 server to an existing domain which is Server 2003 Standard.

When installing the Active Directory Domain Service Roll, this completes correctly.  You are then advised that the server isn't running as a domain controller and you need to run dcpromo.  When I run this, I select "existing forest" and "add a domain controller to an existing domain."  

I then get a message that says "to install a domain controller into this AD domain, you must first prepare the domain using "adprep /domainprep"

It used to tell me to run "adprep /forestprep" which has been run correctly on the original 2003 DC.

When running "adprep /domainprep" on the 2003 DC, I get the message:
Adprep detected that the domain is not in native mode.  AdPrep has stopped without making changes.  Configure the domain to run in native mode and re-run domainprep.

Is is correct to "configure the domain to run in native mode" and if so...how?

Thanks.
0
Comment
Question by:mikeshaver
  • 5
  • 3
  • 2
  • +3
13 Comments
 
LVL 58

Accepted Solution

by:
tigermatt earned 500 total points
ID: 22862567

Your domain is running at the Windows Server 2000 Mixed Mode Functional Level, which means NT4 DCs are still supported. If you have no pre-Windows 2003 DCs and you don't intend on having any, you can safely promote both the Domain and Forest Functional Levels to Windows Server 2003. The Domain must be at the 2000 Native Mode for a Server 2008 DC to be supported anyway.

To promote the Functional Level, see http://support.microsoft.com/kb/322692.

Don't forget too that after adprep /domainprep, you should also run adprep /domainprep /gpprep.

The full procedure is below; follow it once the Levels are raised.

-Matt

---

Install Windows Server 2008 onto the new server which is intended to be promoted as a Domain Controller. Ensure the new server is assigned a routable static IP address on your IP subnet. Ensure the IP address is not included in any of your existing DHCP scopes. The only DNS server entry at this stage should be the IP address of the existing domain controller on your network.

After installation, join the new machine to the existing domain as a member server. This procedure is exactly the same as joining a workstation to the domain.

Since you are upgrading the Operating System on the new Domain Controller, you will need to add some values to the existing Active Directory schema, in order for the new server to become a Domain Controller. Windows Server 2008 supports more functionality than before, so a schema upgrade for the domain and forest is required to facilitate this and make this new feature set fully functional on the domain. To make the necessary changes, you must be logged on as the built-in Administrator user account, or a user with Domain, Schema and Enterprise Admin privileges.

Insert the Windows Server 2008 media into your current server . Open a command prompt and browse to sources\adprep folder within the Windows Server 2008 DVD media. Execute the command adprep /forestprep.

Next, execute adprep /domainprep . You must be logged on as a Domain Admin user for these steps to work correctly. Once these commands have run your Active Directory schema will have been extended to support Windows Server 2008 as a Domain Controller.

Promote the new server as a Domain Controller for the domain. Enter dcpromo at a command prompt and follow the wizard. When prompted, select the option for an additional domain controller in an existing domain. After the wizard completes, the new server will be acting as a Domain Controller for your domain. It is necessary at this point to restart the server for these changes to be applied.

In a single-domain Active Directory forest, all servers should also be Global Catalog servers. The Global Catalog is a required component of Active Directory which is used during logins to establish universal group membership for a user account. To promote the new server as a Global Catalog, open Active Directory Sites and Services from the Administrative Tools container within Control Panel or on the Start Menu. Double-click Sites, then Servers, followed by the name of the new server. Next, right-click "NTDS Settings" and select Properties. On the General tab, check the Global Catalog checkbox. Restart the new Domain Controller for changes to take effect.

If you wish the new server to become the holder of one or more Operations (FSMO) roles, you will need to transfer these roles to the new server. In a single-domain environment, you gain no benefits from spreading FSMO roles between Domain Controllers

The current FSMO role configuration for your network can be found by running the command "netdom query fsmo" at a command prompt on a Domain Controller.

To transfer one or more of these FSMO roles to the new domain controller, follow the information detailed in the following Microsoft Support article: http://support.microsoft.com/kb/324801. Please ensure any other information you follow is information regarding the TRANSFER of FSMO roles. Seizing FSMO roles is an emergency operation which should not be performed during this procedure.

DNS is a critical component of your Active Directory network. The easiest way to install the DNS role onto the new server is to follow the instructions outlined at http://technet2.microsoft.com/WindowsServer2008/en/library/3cf4d1b1-7a6e-4438-bf4f-22d9468c17321033.mspx You should be already using Active Directory-integrated DNS zones, which is the easiest method of allowing DNS replication to occur - DNS information is stored in Active Directory and replicates with Domain Controller replication traffic. To check if your DNS zones are AD-integrated (and convert them if not), please follow http://support.microsoft.com/kb/227844.

You probably want to enable DNS forwarding in the DNS console on the server, too. This forwards lookups for external domains to a DNS server at your ISP, which allows the server to effectively resolve DNS for external domains. More information on forwarders can be found at http://technet2.microsoft.com/WindowsServer/en/Library/ee992253-235e-4fd4-b4da-7e57e70ad3821033.mspx.

To move DHCP to the new server, you will need to first install the role. To install the role in Windows Server 2008, check the DHCP Server role option within the Add Roles wizard in the Server Manager. To correctly configure DHCP after the role is installed on your new server, you will need to ensure you configure it to distribute IP addresses which are in a different range to the IP scope defined on the other DHCP server. You should also ensure the correct DNS and WINS servers are entered into the scope options. Remember that the only DNS servers which should be configured on workstations are the Domain Controllers which are also acting as DNS servers - no ISP DNS server should ever be set through DHCP.

-tigermatt
0
 
LVL 1

Author Comment

by:mikeshaver
ID: 22862572
I went on my 2003 Exchange Server (different box from the one I ran the other adprep commands on).  
On here I changed the mode of Exchange (ESM, right click organization, properties, change mode) to Native.  It was mixed.  Change appears to be successful (no messages, but when going back in ESM is shows the mode as Native now).

However...I am still getting the "configure the domain to run in native mode and re-run domain prep" on the 2008 Server.
 
 
0
 
LVL 58

Expert Comment

by:tigermatt
ID: 22862581

It's not the Exchange Organization Mode (although that would be good to be at Native anyway), it's the Domain Functional Level you're worried about. Depending on where this level is set depends on what features are / aren't supported on the network.

For example, Server 2008 needs at least Windows 2000 Native, because that level doesn't support any NT4 DCs. Since Server 2008 also has no support for NT4, promoting the level to Native can assure the server that no NT4 DCs are left on the network.

Hopefully now you've seen my above post and it all makes sense now :)

-Matt
0
 
LVL 1

Author Comment

by:mikeshaver
ID: 22862671
haha, yes - I saw your post aftrer I added to my description.  Thanks for the help!
0
 
LVL 58

Expert Comment

by:tigermatt
ID: 22862686

You're most welcome, there's often timing issues like that here on EE! :)

Thanks,
-Matt
0
 

Expert Comment

by:Stephen-TheMIM
ID: 23235506
the question i have is what can break if anything when elevating the level, or is it JUST the NT4 domain compatibility.
0
Are your corporate email signatures appalling?

Is it scary how unprofessional your email signatures look? Do users create their own terrible designs and give themselves stupid job titles? You can make this a lot easier for yourself by choosing an email signature management solution from Exclaimer today.

 
LVL 58

Expert Comment

by:tigermatt
ID: 23235732
Stephen-TheMIM

Please post a new question of your own. This is an old question, and as such, asking further questions about this solution will not attract much expert activity.

You will notice a 'Ask a Related Question' link/button in the question, above the comment box. Please click that, which will link your new question to this solution and enable the Experts answering it to see what you are talking about.

-tigermatt
0
 

Expert Comment

by:Stephen-TheMIM
ID: 23237094
I actually bit the bullet and it works exactly like that.
0
 
LVL 58

Expert Comment

by:tigermatt
ID: 23239261

Yes - I can tell you that it does work exactly like that (Native = No NT4 capability), but in future, it's best to post a related question if you have an issue with a solution.
0
 

Expert Comment

by:SecondCity
ID: 34056018
Just to add on to this: if you're trying to run adprep on a 32-bit 2k3 server with a 2k8 R2 disc, the "adprep" command doesn't work.  Simply enough, it's because it's a 64-bit program.  Instead run "adprep32" that's located inside the folder, and you're set.  Plus, these can be found in the "support\adprep" folder, not the "sources\adprep" folder on R2 media.

A bit of hair rending and googling gave me that little nugget.

Regardless, thanks very much for the roadmap!!
0
 

Expert Comment

by:JustinBMak
ID: 34772713

Everyone:


     So I have read all of this and think it's awesome that everyone is out to help everyone! I have done the adprep /forestprep and as well just about every other adprep /______ in the utility. I have NETDIAG & DCDIAG on my main DC (only have one - no replication, no other sites, nothing!) and everything passed and I mean EVERYTHING.

     But still I am unable to attach my brand spank'en new MS Windows 2008 R2 (x64) Server to my existing domain and continue to receive the following error message :

   
                   "To install a domain controller into this Active Directory forest, you must first prepare the forest use "adprep /forestprep". The Adprep utility is available on the Windows Server 2008 R2 installation media in the \support\adprep folder"

                                                                        Then I press OK

When I look at the 'Domain Level' in Active Directory Users & Computers by right clicking on my domain name 'm**it.dal.local' it shows 'Windows Server 2003'. When I check it under 'AD Sites & Services' it shows the same exact thing!! Let me point out for just a second that EVERYONE within the organization is working just fine for login, password resets, VPN, everything! However when I go to any work station, open up a Command Prompt and type in 'gpresult' (in Windows XP) or 'gpresult /r' (in Windows 7 or Server 2008) it is showing ' Domain Type : Windows 2000'


         A.) I'm assuming why I'm having such difficulties and B.) Why I am unable to add this 2008 box to my current environment.


Could any one out there PLEASE help me!! ??



0
 
LVL 1

Author Comment

by:mikeshaver
ID: 34773213
As the others said...you're going to get a lot more replies with a new question.
0
 
LVL 1

Expert Comment

by:mxrider_420
ID: 34986080
haha im SO glad he posted about the 32bit version! i was scratching my head for a while there. i know i know.. i should have known better :( lol
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I was asked if I could set up a fax machine so that incoming faxes were delivered to people's Exchange inboxes and so that they could send faxes from their desktops without needing to print the document first.  I knew it was possible but I had no id…
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This tutorial will walk an individual through locating and launching the BEUtility application and how to execute it on the appropriate database. Log onto the server running the Backup Exec database. In a larger environment, this would generally be …
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…

914 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now