Adding a Server 2008 domain controller to an existing 2003 domain?

I am attempting to add a 2008 server to an existing domain which is Server 2003 Standard.

When installing the Active Directory Domain Service Roll, this completes correctly.  You are then advised that the server isn't running as a domain controller and you need to run dcpromo.  When I run this, I select "existing forest" and "add a domain controller to an existing domain."  

I then get a message that says "to install a domain controller into this AD domain, you must first prepare the domain using "adprep /domainprep"

It used to tell me to run "adprep /forestprep" which has been run correctly on the original 2003 DC.

When running "adprep /domainprep" on the 2003 DC, I get the message:
Adprep detected that the domain is not in native mode.  AdPrep has stopped without making changes.  Configure the domain to run in native mode and re-run domainprep.

Is is correct to "configure the domain to run in native mode" and if

Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.


Your domain is running at the Windows Server 2000 Mixed Mode Functional Level, which means NT4 DCs are still supported. If you have no pre-Windows 2003 DCs and you don't intend on having any, you can safely promote both the Domain and Forest Functional Levels to Windows Server 2003. The Domain must be at the 2000 Native Mode for a Server 2008 DC to be supported anyway.

To promote the Functional Level, see

Don't forget too that after adprep /domainprep, you should also run adprep /domainprep /gpprep.

The full procedure is below; follow it once the Levels are raised.



Install Windows Server 2008 onto the new server which is intended to be promoted as a Domain Controller. Ensure the new server is assigned a routable static IP address on your IP subnet. Ensure the IP address is not included in any of your existing DHCP scopes. The only DNS server entry at this stage should be the IP address of the existing domain controller on your network.

After installation, join the new machine to the existing domain as a member server. This procedure is exactly the same as joining a workstation to the domain.

Since you are upgrading the Operating System on the new Domain Controller, you will need to add some values to the existing Active Directory schema, in order for the new server to become a Domain Controller. Windows Server 2008 supports more functionality than before, so a schema upgrade for the domain and forest is required to facilitate this and make this new feature set fully functional on the domain. To make the necessary changes, you must be logged on as the built-in Administrator user account, or a user with Domain, Schema and Enterprise Admin privileges.

Insert the Windows Server 2008 media into your current server . Open a command prompt and browse to sources\adprep folder within the Windows Server 2008 DVD media. Execute the command adprep /forestprep.

Next, execute adprep /domainprep . You must be logged on as a Domain Admin user for these steps to work correctly. Once these commands have run your Active Directory schema will have been extended to support Windows Server 2008 as a Domain Controller.

Promote the new server as a Domain Controller for the domain. Enter dcpromo at a command prompt and follow the wizard. When prompted, select the option for an additional domain controller in an existing domain. After the wizard completes, the new server will be acting as a Domain Controller for your domain. It is necessary at this point to restart the server for these changes to be applied.

In a single-domain Active Directory forest, all servers should also be Global Catalog servers. The Global Catalog is a required component of Active Directory which is used during logins to establish universal group membership for a user account. To promote the new server as a Global Catalog, open Active Directory Sites and Services from the Administrative Tools container within Control Panel or on the Start Menu. Double-click Sites, then Servers, followed by the name of the new server. Next, right-click "NTDS Settings" and select Properties. On the General tab, check the Global Catalog checkbox. Restart the new Domain Controller for changes to take effect.

If you wish the new server to become the holder of one or more Operations (FSMO) roles, you will need to transfer these roles to the new server. In a single-domain environment, you gain no benefits from spreading FSMO roles between Domain Controllers

The current FSMO role configuration for your network can be found by running the command "netdom query fsmo" at a command prompt on a Domain Controller.

To transfer one or more of these FSMO roles to the new domain controller, follow the information detailed in the following Microsoft Support article: Please ensure any other information you follow is information regarding the TRANSFER of FSMO roles. Seizing FSMO roles is an emergency operation which should not be performed during this procedure.

DNS is a critical component of your Active Directory network. The easiest way to install the DNS role onto the new server is to follow the instructions outlined at You should be already using Active Directory-integrated DNS zones, which is the easiest method of allowing DNS replication to occur - DNS information is stored in Active Directory and replicates with Domain Controller replication traffic. To check if your DNS zones are AD-integrated (and convert them if not), please follow

You probably want to enable DNS forwarding in the DNS console on the server, too. This forwards lookups for external domains to a DNS server at your ISP, which allows the server to effectively resolve DNS for external domains. More information on forwarders can be found at

To move DHCP to the new server, you will need to first install the role. To install the role in Windows Server 2008, check the DHCP Server role option within the Add Roles wizard in the Server Manager. To correctly configure DHCP after the role is installed on your new server, you will need to ensure you configure it to distribute IP addresses which are in a different range to the IP scope defined on the other DHCP server. You should also ensure the correct DNS and WINS servers are entered into the scope options. Remember that the only DNS servers which should be configured on workstations are the Domain Controllers which are also acting as DNS servers - no ISP DNS server should ever be set through DHCP.


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
mikeshaverAuthor Commented:
I went on my 2003 Exchange Server (different box from the one I ran the other adprep commands on).  
On here I changed the mode of Exchange (ESM, right click organization, properties, change mode) to Native.  It was mixed.  Change appears to be successful (no messages, but when going back in ESM is shows the mode as Native now).

However...I am still getting the "configure the domain to run in native mode and re-run domain prep" on the 2008 Server.

It's not the Exchange Organization Mode (although that would be good to be at Native anyway), it's the Domain Functional Level you're worried about. Depending on where this level is set depends on what features are / aren't supported on the network.

For example, Server 2008 needs at least Windows 2000 Native, because that level doesn't support any NT4 DCs. Since Server 2008 also has no support for NT4, promoting the level to Native can assure the server that no NT4 DCs are left on the network.

Hopefully now you've seen my above post and it all makes sense now :)

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

mikeshaverAuthor Commented:
haha, yes - I saw your post aftrer I added to my description.  Thanks for the help!

You're most welcome, there's often timing issues like that here on EE! :)

the question i have is what can break if anything when elevating the level, or is it JUST the NT4 domain compatibility.

Please post a new question of your own. This is an old question, and as such, asking further questions about this solution will not attract much expert activity.

You will notice a 'Ask a Related Question' link/button in the question, above the comment box. Please click that, which will link your new question to this solution and enable the Experts answering it to see what you are talking about.

I actually bit the bullet and it works exactly like that.

Yes - I can tell you that it does work exactly like that (Native = No NT4 capability), but in future, it's best to post a related question if you have an issue with a solution.
Just to add on to this: if you're trying to run adprep on a 32-bit 2k3 server with a 2k8 R2 disc, the "adprep" command doesn't work.  Simply enough, it's because it's a 64-bit program.  Instead run "adprep32" that's located inside the folder, and you're set.  Plus, these can be found in the "support\adprep" folder, not the "sources\adprep" folder on R2 media.

A bit of hair rending and googling gave me that little nugget.

Regardless, thanks very much for the roadmap!!


     So I have read all of this and think it's awesome that everyone is out to help everyone! I have done the adprep /forestprep and as well just about every other adprep /______ in the utility. I have NETDIAG & DCDIAG on my main DC (only have one - no replication, no other sites, nothing!) and everything passed and I mean EVERYTHING.

     But still I am unable to attach my brand spank'en new MS Windows 2008 R2 (x64) Server to my existing domain and continue to receive the following error message :

                   "To install a domain controller into this Active Directory forest, you must first prepare the forest use "adprep /forestprep". The Adprep utility is available on the Windows Server 2008 R2 installation media in the \support\adprep folder"

                                                                        Then I press OK

When I look at the 'Domain Level' in Active Directory Users & Computers by right clicking on my domain name 'm**it.dal.local' it shows 'Windows Server 2003'. When I check it under 'AD Sites & Services' it shows the same exact thing!! Let me point out for just a second that EVERYONE within the organization is working just fine for login, password resets, VPN, everything! However when I go to any work station, open up a Command Prompt and type in 'gpresult' (in Windows XP) or 'gpresult /r' (in Windows 7 or Server 2008) it is showing ' Domain Type : Windows 2000'

         A.) I'm assuming why I'm having such difficulties and B.) Why I am unable to add this 2008 box to my current environment.

Could any one out there PLEASE help me!! ??

mikeshaverAuthor Commented:
As the others're going to get a lot more replies with a new question.
haha im SO glad he posted about the 32bit version! i was scratching my head for a while there. i know i know.. i should have known better :( lol
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2008

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.