Solved

Adding a Server 2008 domain controller to an existing 2003 domain?

Posted on 2008-11-02
13
50,840 Views
Last Modified: 2012-09-11
I am attempting to add a 2008 server to an existing domain which is Server 2003 Standard.

When installing the Active Directory Domain Service Roll, this completes correctly.  You are then advised that the server isn't running as a domain controller and you need to run dcpromo.  When I run this, I select "existing forest" and "add a domain controller to an existing domain."  

I then get a message that says "to install a domain controller into this AD domain, you must first prepare the domain using "adprep /domainprep"

It used to tell me to run "adprep /forestprep" which has been run correctly on the original 2003 DC.

When running "adprep /domainprep" on the 2003 DC, I get the message:
Adprep detected that the domain is not in native mode.  AdPrep has stopped without making changes.  Configure the domain to run in native mode and re-run domainprep.

Is is correct to "configure the domain to run in native mode" and if so...how?

Thanks.
0
Comment
Question by:mikeshaver
  • 5
  • 3
  • 2
  • +3
13 Comments
 
LVL 58

Accepted Solution

by:
tigermatt earned 500 total points
Comment Utility

Your domain is running at the Windows Server 2000 Mixed Mode Functional Level, which means NT4 DCs are still supported. If you have no pre-Windows 2003 DCs and you don't intend on having any, you can safely promote both the Domain and Forest Functional Levels to Windows Server 2003. The Domain must be at the 2000 Native Mode for a Server 2008 DC to be supported anyway.

To promote the Functional Level, see http://support.microsoft.com/kb/322692.

Don't forget too that after adprep /domainprep, you should also run adprep /domainprep /gpprep.

The full procedure is below; follow it once the Levels are raised.

-Matt

---

Install Windows Server 2008 onto the new server which is intended to be promoted as a Domain Controller. Ensure the new server is assigned a routable static IP address on your IP subnet. Ensure the IP address is not included in any of your existing DHCP scopes. The only DNS server entry at this stage should be the IP address of the existing domain controller on your network.

After installation, join the new machine to the existing domain as a member server. This procedure is exactly the same as joining a workstation to the domain.

Since you are upgrading the Operating System on the new Domain Controller, you will need to add some values to the existing Active Directory schema, in order for the new server to become a Domain Controller. Windows Server 2008 supports more functionality than before, so a schema upgrade for the domain and forest is required to facilitate this and make this new feature set fully functional on the domain. To make the necessary changes, you must be logged on as the built-in Administrator user account, or a user with Domain, Schema and Enterprise Admin privileges.

Insert the Windows Server 2008 media into your current server . Open a command prompt and browse to sources\adprep folder within the Windows Server 2008 DVD media. Execute the command adprep /forestprep.

Next, execute adprep /domainprep . You must be logged on as a Domain Admin user for these steps to work correctly. Once these commands have run your Active Directory schema will have been extended to support Windows Server 2008 as a Domain Controller.

Promote the new server as a Domain Controller for the domain. Enter dcpromo at a command prompt and follow the wizard. When prompted, select the option for an additional domain controller in an existing domain. After the wizard completes, the new server will be acting as a Domain Controller for your domain. It is necessary at this point to restart the server for these changes to be applied.

In a single-domain Active Directory forest, all servers should also be Global Catalog servers. The Global Catalog is a required component of Active Directory which is used during logins to establish universal group membership for a user account. To promote the new server as a Global Catalog, open Active Directory Sites and Services from the Administrative Tools container within Control Panel or on the Start Menu. Double-click Sites, then Servers, followed by the name of the new server. Next, right-click "NTDS Settings" and select Properties. On the General tab, check the Global Catalog checkbox. Restart the new Domain Controller for changes to take effect.

If you wish the new server to become the holder of one or more Operations (FSMO) roles, you will need to transfer these roles to the new server. In a single-domain environment, you gain no benefits from spreading FSMO roles between Domain Controllers

The current FSMO role configuration for your network can be found by running the command "netdom query fsmo" at a command prompt on a Domain Controller.

To transfer one or more of these FSMO roles to the new domain controller, follow the information detailed in the following Microsoft Support article: http://support.microsoft.com/kb/324801. Please ensure any other information you follow is information regarding the TRANSFER of FSMO roles. Seizing FSMO roles is an emergency operation which should not be performed during this procedure.

DNS is a critical component of your Active Directory network. The easiest way to install the DNS role onto the new server is to follow the instructions outlined at http://technet2.microsoft.com/WindowsServer2008/en/library/3cf4d1b1-7a6e-4438-bf4f-22d9468c17321033.mspx You should be already using Active Directory-integrated DNS zones, which is the easiest method of allowing DNS replication to occur - DNS information is stored in Active Directory and replicates with Domain Controller replication traffic. To check if your DNS zones are AD-integrated (and convert them if not), please follow http://support.microsoft.com/kb/227844.

You probably want to enable DNS forwarding in the DNS console on the server, too. This forwards lookups for external domains to a DNS server at your ISP, which allows the server to effectively resolve DNS for external domains. More information on forwarders can be found at http://technet2.microsoft.com/WindowsServer/en/Library/ee992253-235e-4fd4-b4da-7e57e70ad3821033.mspx.

To move DHCP to the new server, you will need to first install the role. To install the role in Windows Server 2008, check the DHCP Server role option within the Add Roles wizard in the Server Manager. To correctly configure DHCP after the role is installed on your new server, you will need to ensure you configure it to distribute IP addresses which are in a different range to the IP scope defined on the other DHCP server. You should also ensure the correct DNS and WINS servers are entered into the scope options. Remember that the only DNS servers which should be configured on workstations are the Domain Controllers which are also acting as DNS servers - no ISP DNS server should ever be set through DHCP.

-tigermatt
0
 
LVL 1

Author Comment

by:mikeshaver
Comment Utility
I went on my 2003 Exchange Server (different box from the one I ran the other adprep commands on).  
On here I changed the mode of Exchange (ESM, right click organization, properties, change mode) to Native.  It was mixed.  Change appears to be successful (no messages, but when going back in ESM is shows the mode as Native now).

However...I am still getting the "configure the domain to run in native mode and re-run domain prep" on the 2008 Server.
 
 
0
 
LVL 58

Expert Comment

by:tigermatt
Comment Utility

It's not the Exchange Organization Mode (although that would be good to be at Native anyway), it's the Domain Functional Level you're worried about. Depending on where this level is set depends on what features are / aren't supported on the network.

For example, Server 2008 needs at least Windows 2000 Native, because that level doesn't support any NT4 DCs. Since Server 2008 also has no support for NT4, promoting the level to Native can assure the server that no NT4 DCs are left on the network.

Hopefully now you've seen my above post and it all makes sense now :)

-Matt
0
 
LVL 1

Author Comment

by:mikeshaver
Comment Utility
haha, yes - I saw your post aftrer I added to my description.  Thanks for the help!
0
 
LVL 58

Expert Comment

by:tigermatt
Comment Utility

You're most welcome, there's often timing issues like that here on EE! :)

Thanks,
-Matt
0
 

Expert Comment

by:Stephen-TheMIM
Comment Utility
the question i have is what can break if anything when elevating the level, or is it JUST the NT4 domain compatibility.
0
Integrate social media with email signatures

Is your company active on social media? Do you also use email signatures? Including social media icons in your email signature is a great way to get fans for free. Let all your email users know you’re on social media quickly and easily, in a single click.

 
LVL 58

Expert Comment

by:tigermatt
Comment Utility
Stephen-TheMIM

Please post a new question of your own. This is an old question, and as such, asking further questions about this solution will not attract much expert activity.

You will notice a 'Ask a Related Question' link/button in the question, above the comment box. Please click that, which will link your new question to this solution and enable the Experts answering it to see what you are talking about.

-tigermatt
0
 

Expert Comment

by:Stephen-TheMIM
Comment Utility
I actually bit the bullet and it works exactly like that.
0
 
LVL 58

Expert Comment

by:tigermatt
Comment Utility

Yes - I can tell you that it does work exactly like that (Native = No NT4 capability), but in future, it's best to post a related question if you have an issue with a solution.
0
 

Expert Comment

by:SecondCity
Comment Utility
Just to add on to this: if you're trying to run adprep on a 32-bit 2k3 server with a 2k8 R2 disc, the "adprep" command doesn't work.  Simply enough, it's because it's a 64-bit program.  Instead run "adprep32" that's located inside the folder, and you're set.  Plus, these can be found in the "support\adprep" folder, not the "sources\adprep" folder on R2 media.

A bit of hair rending and googling gave me that little nugget.

Regardless, thanks very much for the roadmap!!
0
 

Expert Comment

by:JustinBMak
Comment Utility

Everyone:


     So I have read all of this and think it's awesome that everyone is out to help everyone! I have done the adprep /forestprep and as well just about every other adprep /______ in the utility. I have NETDIAG & DCDIAG on my main DC (only have one - no replication, no other sites, nothing!) and everything passed and I mean EVERYTHING.

     But still I am unable to attach my brand spank'en new MS Windows 2008 R2 (x64) Server to my existing domain and continue to receive the following error message :

   
                   "To install a domain controller into this Active Directory forest, you must first prepare the forest use "adprep /forestprep". The Adprep utility is available on the Windows Server 2008 R2 installation media in the \support\adprep folder"

                                                                        Then I press OK

When I look at the 'Domain Level' in Active Directory Users & Computers by right clicking on my domain name 'm**it.dal.local' it shows 'Windows Server 2003'. When I check it under 'AD Sites & Services' it shows the same exact thing!! Let me point out for just a second that EVERYONE within the organization is working just fine for login, password resets, VPN, everything! However when I go to any work station, open up a Command Prompt and type in 'gpresult' (in Windows XP) or 'gpresult /r' (in Windows 7 or Server 2008) it is showing ' Domain Type : Windows 2000'


         A.) I'm assuming why I'm having such difficulties and B.) Why I am unable to add this 2008 box to my current environment.


Could any one out there PLEASE help me!! ??



0
 
LVL 1

Author Comment

by:mikeshaver
Comment Utility
As the others said...you're going to get a lot more replies with a new question.
0
 
LVL 1

Expert Comment

by:mxrider_420
Comment Utility
haha im SO glad he posted about the 32bit version! i was scratching my head for a while there. i know i know.. i should have known better :( lol
0

Featured Post

Want to promote your upcoming event?

Are you going to an event? Are you going to be exhibiting at a tradeshow? Talking at a conference? Using a promotional banner in your email signature ensures that your organization’s most important contacts stay in the know and can potentially spread the word about the event.

Join & Write a Comment

I have been working as System Administrators since 2003. I recently started working as a FreeLancer and was amazed to find out that very few people are taking full advantage of their Windows Server Machines. Microsoft Windows Server comes with so…
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now