Solved

New Windows 2008 Domain Controller - Steps

Posted on 2010-09-01
21
486 Views
Last Modified: 2012-08-13
Hi,

I am currently in the process of adding a new Windows 2008 domain controller to our network (to replace our ageing 2003 PDC).

I've made a high level list of processes I have documented in preparation for the build. I've also expanded on this list and documented every individual step that needs doing for the build.

At the moment, I'm at the stage where I am just finalising which steps need to be carried out & which roles I need to migrate.

The next stage is to perform the actual migration. I've been trying to schedule an our of hours time slot but that's been difficult lately.

How much of the following could I do without any disruption to the live system? Initially I was thinking of adding the 2008 box as a domain controller, making it the primary controller (& testing logons, DNS, etc) out of hours then migrating the roles (file, print, fax, vpn, etc) gradually during the working week.

I would like to see how much of the migration I can perform during the working week. If it's not possible, then I will have to just schedule some time out of hours where I can come in and promote the 2008 box to a new primary DC and test the logon, DNS, etc. Once the DC aspect is complete, I can continue to migrate the roles during the working week.

Below is the list of steps I've collated so far:

Phase 1 - Windows 2008 R2 64-Bit Installation                                          
Configure HDD's in RAID-1 array (Mirrored disks)
Install Windows 2008 R2 from installation DVD
Set IP address and join onto domain as normal
Configure DRAC card and test from another PC

Phase 2 – Migrate Domain Controller from 2003 > 2008

Check old server for replication-enabled AD
Check old DC for errors
Upgrade domain/schema on 2003
Run dcpromo to add 2008 to domain as a DC
Install DNS role
Check DNS replication
Transfer Schema Master Role from 2003 to 2008
Transfer Domain Naming Master Role from 2003 to 2008
Transfer Infrastructure Master Role from 2003 to 2008
Transfer Relative ID Master Role from 2003 to 2008
Transfer PDC Emulator Role from 2003 to 2008
Check that 2008 server has AD / DHCP / DNS Roles installed
Configure NIC DNS settings on new DC – Primary-New, Secondary-Old
Re-configure DHCP scope settings to point to new DNS Server (DC)
Move DHCP Database from 2003 > 2008
Authorise DHCP server on new 2008 DC
Re-configure some client PC's to point DNS server on 2008 DCC
Disconnect old DC from LAN & test client logon / Group Policy
If OK, demote old DC (Moves from DC OU to 'Computers' OU as normal server)
Check DNS Management Console
Re-configure remaining PC's to point to DNS server on 2008 DC

Raise Domain Functional Level to 2008 (FINAL STEP!!!)
Raise Forest Functional Level to 2008 (FINAL STEP!!!)

Phase 3 – Migrate Roles from 2003 > 2008

File Server
Print Server
VPN / Remote Access
Fax Server

Phase 4 – Other Actions

User Profiles - migrate user-by-user (only 6 roaming profile users to migrate)
Archive all unused files / documents into 'Old User Documents', etc.
Re-map network drives to new DC

Does this list seem comprehensive enough?

I look forward to receiving your feedback as I'm very keen to get this project finished by the end of next week.

Thanks in advance!
0
Comment
Question by:robsamuel2k8
  • 6
  • 5
  • 5
  • +2
21 Comments
 
LVL 39

Expert Comment

by:Krzysztof Pytko
Comment Utility
You described all you need to do :) Nothing more to say :]
0
 
LVL 24

Accepted Solution

by:
MojoTech earned 125 total points
Comment Utility
You will need to prepare the current 2003 schema and AD for the 2008 Server before you can run DC Promo.

When you run dcpromo on the 2008 box AD and DNS will be installed and configured as part of that process, so you just need to install and configure the DHCP role.

Once configure you just have to move roles as stated.
0
 
LVL 39

Assisted Solution

by:Krzysztof Pytko
Krzysztof Pytko earned 125 total points
Comment Utility
Additionally you can run on 2003 DC before start DCPROMO on 2008, dcdiag to check if there is no error.
0
 
LVL 20

Assisted Solution

by:woolnoir
woolnoir earned 125 total points
Comment Utility
No real comments apart from have some stages at key points for testing, i.e after domain and forest prep, after the 2008 dcpromo and then after the FSMO role migration.

You seem to have everything else covered - certainly nothing more i would add.
0
 
LVL 3

Assisted Solution

by:Willy Van den Houten
Willy Van den Houten earned 125 total points
Comment Utility
Perfect !

The first thing I should check is also for network related problems.

DNS and AD won't work correctly if there was a networkproblem.

But if it's migrating from 2003, it will run fine...
0
 
LVL 20

Expert Comment

by:woolnoir
Comment Utility
Not sure if you use DFS as part of your file server configuration - if so you need to migrate from FRS -> DFSR to gain from the new functionality.

http://www.activedir.org/Articles/tabid/54/articleType/ArticleView/articleId/10/Default.aspx <- gives a good overview.
0
 

Author Comment

by:robsamuel2k8
Comment Utility
Thanks for all of the comments! It seems like the document I have prepared will cover all angles (DCdiag has been added)

With regard to the implementation, do you advise that I run the DC migration out of hours and then proceed with the 'role' migrations during normal working days?

I know out of hours would be the best option to make the 2008 box the new PDC, but I would just like to know how much I can carry out during office hours.

My assumption is that I can run all of the steps up until DCPROMO (i.e. all the diagnostic checks), then ideally run DCPROMO out of hours will all network PC's switched off?
0
 
LVL 24

Expert Comment

by:MojoTech
Comment Utility
This work can be done during office hours but if something goes wrong you may encounter difficulties, if it was me I would do it during office hours because I am brave like that. ;)
0
 
LVL 39

Expert Comment

by:Krzysztof Pytko
Comment Utility
You don't have to do it after hours. Even FSMO transfer you can do during working hours. It shouldn't affect network at all.
0
 
LVL 24

Expert Comment

by:MojoTech
Comment Utility
Oh and there is no need to turn off client PC's when transfering roles or promoting a domain controller.
0
Don't lose your head updating email signatures!

Do your end users still have the wrong email signature? Do email signature updates bore you or fill you with a sense of dread? You can make this a whole lot easier on yourself by trusting an Exclaimer email signature management solution. Over 50 million users do...so should you!

 
LVL 20

Expert Comment

by:woolnoir
Comment Utility
I agree with @iSiek and @mojotech about the FSMO rules and promotion, but i guess ive always been a little protective. I tend to do any procedures out of hours so if restores are required it can be done without user impact. Theres very little inconvenience from your side doing it out of hours - if it goes perfect the result is the same - if anything goes wrong you have more time to rectify.
0
 

Author Comment

by:robsamuel2k8
Comment Utility
I assume group policy will be migrated over as part of DCPROMO as well?

I totall agree with woolnoir, it seems like it's safe enough to run during office hours but if anything did go wrong I'd be able to restore within a couple of hours as opposed to disrupting the whole office.

The reason why we're upgrading our PDC is that during a routine office power-down (re-fitting the floor below us), the PDC did not power back on due to a failed power supply.

I was able to restore the PDC (using Acronis True Image) to a powerful PC within 3 hours and got things back up & running.

I think I'll pencil in a day one weekend to run the migration just in case any issues do crop up. 20 angry sales staff are not what you want, believe me! :p
0
 
LVL 20

Expert Comment

by:woolnoir
Comment Utility
@robsamuel2k8 - believe me, my caution is created out of being in the situation with annoyed users back in the distant past... never again :)
0
 
LVL 24

Expert Comment

by:MojoTech
Comment Utility
Yes when you have your new DC it will be replicated as it would with a new 2003 DC, and there is really no such thing as a PDC since Server 2000 all DC'S although they may hold the different roles are actually all replicas of each other so any DC has all the info of the other DC's
0
 
LVL 39

Expert Comment

by:Krzysztof Pytko
Comment Utility
@woolnoir @robsamuel2k8 everything depend on your character ;) I like adrenalin :P and each FSMO transfers I did on live environment :) In my case wasn't any failures :)
0
 

Author Comment

by:robsamuel2k8
Comment Utility
iSiek, i agree it all depends on your character and past experiences. In our sales environment, even if there's a minor issue it causes huge disruption :(

Theoretically, I could run the migration today but can't really afford for any issues to crop up. I think I'll run all the diagnostics today then look at the migration this weekend :)

0
 
LVL 24

Expert Comment

by:MojoTech
Comment Utility
You need to do what you are comfortable with Rob as its your gig at the end of the day....



...and your neck ;)
0
 

Author Comment

by:robsamuel2k8
Comment Utility
Exactly! I can run all the diagnostics this week and check for errors then migrate out of hours - probably the safest option.

Thanks for all your comments, as usual EE is worth it's weight in gold!
0
 
LVL 39

Expert Comment

by:Krzysztof Pytko
Comment Utility
yup, so, wish you luck :] and no failures :)
0
 

Author Closing Comment

by:robsamuel2k8
Comment Utility
Thanks for the comments, I just wanted to clarify a few things before moving forward :)
0
 

Author Comment

by:robsamuel2k8
Comment Utility
Hi, I just wanted to clarify something before I carry out the upgrade/DCpromo on the weekend....

At the moment, we have a Windows / Exchange 2000 server on the network and I just wanted to make sure that when I promote the new 2008 server to be our primary DC that it won't have any knock-on effect on the exchange server.

Once the DC project is complete, my next project is the e-mail server. I've researched Exchange 2007 / 2010 and I'm also looking to BPOS (Exchange Online).

Please can you let me know your thoughts on the Win 2000 server as I do not want to complete the migration and find there are issues or try and revert back to the old DC.

Thanks in advance!!!
0

Featured Post

Promote certifications in your email signature

Has your company recently won an award or achieved a certification? They'll no doubt want to show it off. Email signature images used to promote certifications & awards can instantly establish credibility with a recipient and provide you with numerous benefits.

Join & Write a Comment

Find out how to use Active Directory data for email signature management in Microsoft Exchange and Office 365.
A procedure for exporting installed hotfix details of remote computers using powershell
This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now