Solved

Windows 2003 Domain Migration to new Servers

Posted on 2009-05-03
6
780 Views
Last Modified: 2012-06-27
We are  running windows 2003 standard server on a older HPML150 server running as domain controller with 9 PCs local and 2 Pcs via watchguard branch office vpn. Single user setup hosted application on sql2000 SP3.

We have bought two new ML350 G5 servers with Dual Quad processors with 12Gb ram each One is these is to be new domain server and second to act as terminal server. We need to decide on whether to buy  Windows 2008 standard 64bit edition to utilize 12gb Ram otherwise standard 32bit will only see 4GB as we were advised, We also have been given options  to windows 2003 enterprise which supports over 4gb Ram also.

My question to all you experts is what to choose here since we would like to maintain domain name and structure intact and not have to redo all workstations setups  maintaining current profiles and what would be our best choice for operating system and how to handle domain migration or making replica of exisitng and promoting it to be dc. Will step by step directions please we have not done any windows 2008 setup thus the hesitation.
0
Comment
Question by:mohammedsheikh786
  • 3
  • 2
6 Comments
 
LVL 5

Expert Comment

by:Member_2_4708244
ID: 24293139
Why not use SBS Prem 2008? It will require rejoining the PC's to the domain, but there ar eonly 9 of them locally and 2 remote so its not a hard job.

That way you will have Exchange, SQL, and a second server licence. Running SQL and TS on the one server should be fine with that amount of RAM and CPU performance and so few users.
0
 
LVL 58

Expert Comment

by:tigermatt
ID: 24293724

I would concur with the above. SBS 2008 Premium would be a much better investment. It offers better value for money by giving you integrated management tools, an Exchange Server as well as a second Windows Server 2008 Standard license for installing on the second server.

To answer your question more directly: you have no reason to purchase Server 2008 Enterprise Edition. The only time you would really consider that is if you were looking to configure a server cluster. As you will not be doing this, it would be an unnecessary expense.

Windows Server 2008 Standard Edition would suffice; install the 64-bit edition on both servers and you will have all 12GB RAM available.

-Matt
0
 
LVL 5

Expert Comment

by:Member_2_4708244
ID: 24293768
He is talking server 2003 enterprise (for extra ram), however why install an outdated OS? Its also more expensive.
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 58

Expert Comment

by:tigermatt
ID: 24293788

Server 2003 is a rock-solid Operating System. I would prefer to deploy 2008, but would have no issues deploying 2003 at this stage if I had no other option.

Either Server 2003 Enterprise 64-bit and Server 2008 Standard 64-bit would be sufficient for what you require. As I stated previously, Enterprise is overkill for your intended use; you will not be using the clustering capabilities, so there is no point spending at least twice the cost, if not more, on an Enterprise license.

If you were installing a 32-bit OS, you would have to go Enterprise. Server 2003/2008 Standard 32-bit is restricted to 4GB RAM in software. However, a 32-bit OS also hits the 32-bit CPU limitation on 4GB of RAM, meaning you would have to enable PAE to address more than 4GB.

Server 2003/2008 Standard 64-bit would be sufficient for your requirements - and much cheaper.

-Matt
0
 

Author Comment

by:mohammedsheikh786
ID: 24296167
Thanks for clarifiying the Ram issue and operating system now on to my 2nd part of our  question as clarified below please comment.

We would like to maintain current domain name and structure intact and not have to redo all workstations setups  maintaining current profiles  and how to handle domain migration or making replica of exisitng domain and promoting it to be dc. Will step by step directions please we have not done any windows 2008 setup thus the hesitation.

1)Should we join exisitng domain and then promote the new server as DC and retire the old one if so please suggest step by step procedures.

2)Should we install in a fresh new  domain forest and just transfer using Active Directory Migration to transfer all existing account from original domain? and retire the old one if so please suggest step by step procedures.

0
 
LVL 58

Accepted Solution

by:
tigermatt earned 150 total points
ID: 24296217

You do not want to go down the route of creating a new domain and then migrating things with the migration tools. You can simply install the new DCs into the existing domain and replicate everything across.

For migrating Active Directory to Server 2008, the procedure is below.

-Matt

--

Install Windows Server 2008 onto the new server which is intended to be promoted as a Domain Controller. Ensure the new server is assigned a routable static IP address on your IP subnet. Ensure the IP address is not included in any of your existing DHCP scopes. The only DNS server entry at this stage should be the IP address of the existing domain controller on your network.

After installation, join the new machine to the existing domain as a member server. This procedure is exactly the same as joining a workstation to the domain.

Since you are upgrading the Operating System on the new Domain Controller, you will need to add some values to the existing Active Directory schema, in order for the new server to become a Domain Controller. Windows Server 2008 supports more functionality than before, so a schema upgrade for the domain and forest is required to facilitate this and make this new feature set fully functional on the domain. To make the necessary changes, you must be logged on as the built-in Administrator user account, or a user with Domain, Schema and Enterprise Admin privileges.

Insert the Windows Server 2008 media into your current server . Open a command prompt and browse to sources\adprep folder within the Windows Server 2008 DVD media. Execute the command adprep /forestprep.

Next, execute adprep /domainprep . You must be logged on as a Domain Admin user for these steps to work correctly. Once these commands have run your Active Directory schema will have been extended to support Windows Server 2008 as a Domain Controller.

Promote the new server as a Domain Controller for the domain. Enter dcpromo at a command prompt and follow the wizard. When prompted, select the option for an additional domain controller in an existing domain. After the wizard completes, the new server will be acting as a Domain Controller for your domain. It is necessary at this point to restart the server for these changes to be applied.

In a single-domain Active Directory forest, all servers should also be Global Catalog servers. The Global Catalog is a required component of Active Directory which is used during logins to establish universal group membership for a user account. To promote the new server as a Global Catalog, open Active Directory Sites and Services from the Administrative Tools container within Control Panel or on the Start Menu. Double-click Sites, then Servers, followed by the name of the new server. Next, right-click "NTDS Settings" and select Properties. On the General tab, check the Global Catalog checkbox. Restart the new Domain Controller for changes to take effect.

Since you intend on removing the old Domain Controller from the domain, you need to transfer all the Operations (FSMO) roles to the new Domain Controller.

The current FSMO role configuration for your network can be found by running the command "netdom query fsmo" at a command prompt on a Domain Controller.

To transfer these FSMO roles to the new domain controller, follow the information detailed in the following Microsoft Support article: http://support.microsoft.com/kb/324801. Please ensure any other information you follow is information regarding the TRANSFER of FSMO roles. Seizing FSMO roles is an emergency operation which should not be performed during this procedure.

DNS is a critical component of your Active Directory network. The easiest way to install the DNS role onto the new server is to follow the instructions outlined at http://technet2.microsoft.com/WindowsServer2008/en/library/3cf4d1b1-7a6e-4438-bf4f-22d9468c17321033.mspx You should be already using Active Directory-integrated DNS zones, which is the easiest method of allowing DNS replication to occur - DNS information is stored in Active Directory and replicates with Domain Controller replication traffic. To check if your DNS zones are AD-integrated (and convert them if not), please follow http://support.microsoft.com/kb/227844.

You probably want to enable DNS forwarding in the DNS console on the server, too. This forwards lookups for external domains to a DNS server at your ISP, which allows the server to effectively resolve DNS for external domains. More information on forwarders can be found at http://technet2.microsoft.com/WindowsServer/en/Library/ee992253-235e-4fd4-b4da-7e57e70ad3821033.mspx.

To move DHCP to the new server, you will need to first install the role. To install the role in Windows Server 2008, check the DHCP Server role option within the Add Roles wizard in the Server Manager. To correctly configure DHCP after the role is installed on your new server, you will need to ensure you configure it to distribute IP addresses which are in a different range to the IP scope defined on the other DHCP server. You should also ensure the correct DNS and WINS servers are entered into the scope options. Remember that the only DNS servers which should be configured on workstations are the Domain Controllers which are also acting as DNS servers - no ISP DNS server should ever be set through DHCP.

Once all of these steps have been completed, you should have successfully transferred all of the Active Directory roles to the new domain controller. At this stage, I would suggest you shut down the old domain controller and check to ensure all services on workstations and servers are working correctly - including logins. If they are, you should be safe to switch the old DC back on, run dcpromo and demote it from its Domain Controller role. This will remove the DC as a Domain Controller, leaving it as a member server on the network.

To completely remove the DC from the network, you will need to remember that any other data - including folder redirection folders and user profiles - should be replicated or otherwise transferred to either the new server or another location on the network. ROBOCOPY can be used to do this, and it can copy the NTFS ACLs with the files which is a bonus as much as a requirement in most cases.

Once the old DC is fully removed through dcpromo and then disconnected, the new DC can have its name and/or IP address changed to that of the old one.
0

Featured Post

What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

Join & Write a Comment

If you migrate a Terminal Server licenses server inside the 2008 server family, you can takte advantage of the build-in migration tool. If you like to migrate an older 2003 Server (and the installed client CALs) to a 2008 R2 server for example, you …
The password reset disk is often mentioned as the best solution to deal with the lost Windows password problem. In Windows 2008, 7, Vista and XP, a password reset disk can be easily created. But besides Windows 7/Vista/XP, Windows Server 2008 and ot…
This tutorial will walk an individual through locating and launching the BEUtility application and how to execute it on the appropriate database. Log onto the server running the Backup Exec database. In a larger environment, this would generally be …
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now