Solved

Windows Server 2003-2008 Migration/Upgrade/Fresh Install

Posted on 2009-07-14
8
1,702 Views
Last Modified: 2012-05-07
Here is the basic situation.  I have two domain controllers on our network.  One is a physical machine (Dell Poweredge 1950 - Windows Server 2003 R2 Standard) and one Virtual (running in Parallels Server on an iMac Windows Server 2008 Standard).

I would like to make the 2003 Server a 2008 Server...  I have a few questions...

1. Can I promote the VM to be the Primary DC; take the 2003 DC offline; Do a clean install on the physical machine and then re-promote it to Primary DC (with the same name that it had)?

2. Should I use the 32bit or 64bit version? It is only a DC and a Printer Server/  I have other 32 bit servers on the network... will this make a difference in their performance as well?

3. Aside from temporarily losing print services... What other problems would be causes if I did it during normal business hours?

4. Would I have to rejoin all the computers to the domain after it is completed?  Will I have to re-deploy printers to everyone?  I have one shared directory on the machine... will I have to set it up on the workstations again?

5. Will Windows 2008 as all DCs effect a SQL 2005 instance on a 2003 Server machine???


Okay... that's my start...  I want to avoid doing an inplace upgrade, because I want to put bigger hard drives in the server... Thank you for whatever help you could provide...  
0
Comment
Question by:Maestroscott
  • 2
  • 2
  • 2
  • +2
8 Comments
 
LVL 1

Expert Comment

by:sporgg
ID: 24850470
Hi there

Hope this info helps

1. Active Directory no longer uses the idea of a primary DC. But the first server you setup manages a few extra roles that you will need to make sure are running on the VM machine before you re-install the server. Check this link out to see how to do this.

http://support.microsoft.com/kb/324801

2. There is only a slight performance advantage in using 64bit rather than 32bit. If your hardware can handle the 64bit version go for it. The main advantage of 64bit is its ability to use more than 4GB of Ram.

3. Other services you may need to think about are DNS and DHCP. Cant think of any others at the moment.

4. Once you have re-installed the server you will need to add that server back to the domain as a DC using Dcpromo. You will need to re-install the printers on the server but if the server is the same name as the old one you should get away without having to re-install all the clients printers(Unfortunately I have not tested this so may be wrong). Again you will need to re-setup the share on the new server. If you are using a logon script to map the drive then no changes needed. If you have mapped the drive from each workstation manually you will need to redo this. Can be done quite fast with a batch file that you email to each user. You will not need to rejoin all the computers to the domain as the domain will be kept running by the VM DC.
0
 

Author Comment

by:Maestroscott
ID: 24851511
That just seems so simple...  

DNS is running on the VM but not DHCP...

If I make it the same name... do I have to delete it from AD in order to allow it to join? (I notice I have to do that with workstations) When it is fully up and running again... can I just move those roles back to the physical server and then the VM will go back to it's old ways???  Or should I take a snapshot of the VM and just use the snapshot when I am done???
 
0
 
LVL 58

Accepted Solution

by:
tigermatt earned 500 total points
ID: 24851932

>> Can I promote the VM to be the Primary DC; take the 2003 DC offline; Do a clean install on the physical machine and then re-promote it to Primary DC (with the same name that it had)?

The previous comment pretty much answered this. The idea of 'Primary DC' and 'Secondary/Backup DC' from the NT4 days was removed in Windows 2000 and has not been there in Server 2003 or 2008 either. All DCs are multi-master (meaning they are all essentially the same). The only thing you need to be concerned about are the Global Catalogs (GCs) - all DCs should be GCs too as per best practices - and the 5 FSMO Operations Roles.

When removing a DC, you need to ensure it doesn't hold any of the 5 operations roles, that you have at least 1 other GC, and that there is another DNS server running somewhere - workstations also need updating to point to this DNS server.

To do the action you describe, it's simply a case of doing a server migration - twice. First time, you move the roles etc. to the VM, then you rebuild the old server and then migrate back. I've posted details for this at the end of this post.

>> Should I use the 32bit or 64bit version? It is only a DC and a Printer Server/  I have other 32 bit servers on the network... will this make a difference in their performance as well?

Definitely 64-bit. I should note Server 2008 was the LAST server release which had a 32-bit architecture edition in the release. Server 2008 R2 (due to RTM sometime last this quarter or beginning of the next) and all new server Operating Systems will be 64-bit only. By installing 64-bit now, you can more easily do an in-place upgrade to R2 if necessary.

You may run into problems with a 64-bit print server but 32-bit workstations, but this is quite easily overcome with a few simple precautions.

>> Aside from temporarily losing print services... What other problems would be causes if I did it during normal business hours?

Agreed. DNS and DHCP are important. Workstations MUST be updated (through DHCP, or manually if they are statically assigned) to use the VM DC as their preferred DNS server; don't leave the IP of the server you are working on in there while it is offline, as that could cause a potential problem.

>> Would I have to rejoin all the computers to the domain after it is completed?  Will I have to re-deploy printers to everyone?  I have one shared directory on the machine... will I have to set it up on the workstations again?

The VM DC maintains a replica copy of the Active Directory database, so will hold the domain up while the other server is rebuilt. Just bring the new server up, dcpromo to promote it, make it a GC and DNS server, then add it back in as a preferred/alternate DNS server to workstations. No rejoining required.

Shared Directory will be fine - provided it is shared out with the same name. It will just remap.

As for printers, you MAY run into a problem with drivers which I mentioned above. This is just going to be a trial and error step, as depending on various variables will depend on whether it is successful (no printer remapping) or not (remapping required).

>> Will Windows 2008 as all DCs effect a SQL 2005 instance on a 2003 Server machine???

It should not have an effect on an SQL Server 2005 database.

>> If I make it the same name... do I have to delete it from AD in order to allow it to join?

You don't have to (you shouldn't have to with workstations either). However, while the DC is formatting, it might be a good idea to pull out its computer account and remove any traces of the DC from Active Directory Sites & Services (using the VM instance).

>> can I just move those roles back to the physical server and then the VM will go back to it's old ways???  Or should I take a snapshot of the VM and just use the snapshot when I am done

Don't take a snapshot and revert - unneeded complications and recipe for disaster. Just transfer the roles back using the same procedure you used initially (per the below info).

-Matt

--
Steps to install the 2008 DC once the old box is demoted and formatted.
As the first step (to demote), you need to follow the procedure on transferring FSMO roles and then the demotion procedure. Then format, install Server 2008 and follow the entire set of steps from the top down...

Install Windows Server 2008 onto the new server which is intended to be promoted as a Domain Controller. Ensure the new server is assigned a routable static IP address on your IP subnet. Ensure the IP address is not included in any of your existing DHCP scopes. The only DNS server entry at this stage should be the IP address of the existing domain controller on your network.

After installation, join the new machine to the existing domain as a member server. This procedure is exactly the same as joining a workstation to the domain.

Since you are upgrading the Operating System on the new Domain Controller, you will need to add some values to the existing Active Directory schema, in order for the new server to become a Domain Controller. Windows Server 2008 supports more functionality than before, so a schema upgrade for the domain and forest is required to facilitate this and make this new feature set fully functional on the domain. To make the necessary changes, you must be logged on as the built-in Administrator user account, or a user with Domain, Schema and Enterprise Admin privileges.

Insert the Windows Server 2008 media into your current server . Open a command prompt and browse to sources\adprep folder within the Windows Server 2008 DVD media. Execute the command adprep /forestprep.

Next, execute adprep /domainprep . You must be logged on as a Domain Admin user for these steps to work correctly. Once these commands have run your Active Directory schema will have been extended to support Windows Server 2008 as a Domain Controller.

The next step is to promote the new server as a Domain Controller for the domain. Enter dcpromo at a command prompt and follow the wizard. When prompted, select the option for an additional domain controller in an existing domain. After the wizard completes, the new server will be acting as a Domain Controller for your domain. It is necessary at this point to restart the server for these changes to be applied.

In a single-domain Active Directory forest, all servers should also be Global Catalog servers. The Global Catalog is a required component of Active Directory which is used during logins to establish universal group membership for a user account. To promote the new server as a Global Catalog, open Active Directory Sites and Services from the Administrative Tools container within Control Panel or on the Start Menu. Double-click Sites, then Servers, followed by the name of the new server. Next, right-click "NTDS Settings" and select Properties. On the General tab, check the Global Catalog checkbox. Restart the new Domain Controller for changes to take effect.

Since you intend on removing the old Domain Controller from the domain, you need to transfer all the Operations (FSMO) roles to the new Domain Controller.

The current FSMO role configuration for your network can be found by running the command "netdom query fsmo" at a command prompt on a Domain Controller.

To transfer these FSMO roles to the new domain controller, follow the information detailed in the following Microsoft Support article: http://support.microsoft.com/kb/324801. Please ensure any other information you follow is information regarding the TRANSFER of FSMO roles. Seizing FSMO roles is an emergency operation which should not be performed during this procedure.

DNS is a critical component of your Active Directory network. The easiest way to install the DNS role onto the new server is to follow the instructions outlined at http://technet2.microsoft.com/WindowsServer2008/en/library/3cf4d1b1-7a6e-4438-bf4f-22d9468c17321033.mspx You should be already using Active Directory-integrated DNS zones, which is the easiest method of allowing DNS replication to occur - DNS information is stored in Active Directory and replicates with Domain Controller replication traffic. To check if your DNS zones are AD-integrated (and convert them if not), please follow http://support.microsoft.com/kb/227844.

You probably want to enable DNS forwarding in the DNS console on the server, too. This forwards lookups for external domains to a DNS server at your ISP, which allows the server to effectively resolve DNS for external domains. More information on forwarders can be found at http://technet2.microsoft.com/WindowsServer/en/Library/ee992253-235e-4fd4-b4da-7e57e70ad3821033.mspx.

To move DHCP to the new server, you will need to first install the role. To install the role in Windows Server 2008, check the DHCP Server role option within the Add Roles wizard in the Server Manager. To correctly configure DHCP after the role is installed on your new server, you will need to ensure you configure it to distribute IP addresses which are in a different range to the IP scope defined on the other DHCP server. You should also ensure the correct DNS and WINS servers are entered into the scope options. Remember that the only DNS servers which should be configured on workstations are the Domain Controllers which are also acting as DNS servers - no ISP DNS server should ever be set through DHCP.

Once all of these steps have been completed, you should have successfully transferred all of the Active Directory roles to the new domain controller. At this stage, I would suggest you shut down the old domain controller and check to ensure all services on workstations and servers are working correctly - including logins. If they are, you should be safe to switch the old DC back on, run dcpromo (after migrating and uninstalling Exchange) and demote it from its Domain Controller role. This will remove the DC as a Domain Controller, leaving it as a member server on the network.

To completely remove the DC from the network, you will need to remember that any other data - including folder redirection folders and user profiles - should be replicated or otherwise transferred to either the new server or another location on the network.
0
 
LVL 4

Expert Comment

by:GMorineau
ID: 24852490
Personnaly and don't see any advantage to have a DC with 2008.

A lot more GPOs, it's true, some few security features for Active Directory also. But nothing to justify the work and trouble from a migration. And I have some "stress" between my 2003 and 2008 DCs.

personnaly I only recommend 2008 for new networks (new forests) or migration from 2000. So think a lot about the benefices of having (or not) a Windows 2008 before doing it! If you chose to migrate you DCs, use 64 bits.
0
Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 
LVL 48

Expert Comment

by:Jay_Jay70
ID: 24855643
""Personnaly and don't see any advantage to have a DC with 2008.""

Interesting Take on it :) I am a huge fan of 2008, and integration with 2003 has been flawless so far and i run maybe ~30 2008 Servers in the mix.....I love it, AD works better, the fact that its raised above the OS into its own "module" is massively beneficial....there are many many advantages with AD but not unless you run a complete 2008 AD, its just most people (inc myself) dont use them, getting indepth with 2008 AD is VERY interesting with some of that changes...however, at a base level, to the eye, its the same.....
GMorineau - what sort of stress do you have with them - email me if you have things that are persistent and annoying - might be able to help
0
 
LVL 4

Expert Comment

by:GMorineau
ID: 24855764
Jay,

I like Windows 2008 as Windows Vista, and not, I´m not trying to be sarcastic! kkk... I realy like both. And with SP2, the product it just great. BUT if I compare W2k3 and W2k8 I´m not able to seen huge diferences and benefics to justify the volume of work to make a full migration.

Ok, AD is better but you must have a third part software for granular backups. I´m not only looking for tecnical benefits but also for managements and cost/benefits.

The stress is with folders redirections and some incompatibility with GPOs appliances and replications. Nothing very serious but a bit strange.
0
 
LVL 48

Expert Comment

by:Jay_Jay70
ID: 24856583
hmm well if you want a second set of eyes....drop me a line :)
0
 
LVL 58

Expert Comment

by:tigermatt
ID: 24873889

I would second Jay_Jay's opinion on Server 2008 Active Directory environments being very stable. It is easy to mix 2003 and 2008 DCs while you upgrade, or even as a permanent deployment topology.

-Matt
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

New Windows 7 Installations take days for Windows-Updates to show up and install. This can easily be fixed. I have finally decided to write an article because this seems to get asked several times a day lately. This Article and the Links apply to…
OfficeMate Freezes on login or does not load after login credentials are input.
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

26 Experts available now in Live!

Get 1:1 Help Now