[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 219
  • Last Modified:

Active Directory Migration on windows server 2008

I am having one customer who is using AD server 2003 his setup details are below:


Box 1 kept in bulding1
Box 2 kept in building 2

Box1 having schema master, DNS, DHCP, GC
Box 2 having DNS, DHCP, GC also may be few roles as well.

Dependent application on AD are below:

Cisco NAC (clean access)
CX and Exchange.

we have to migrate his boxes to windows server 2008. please suggest how should i proceed migration for the same.
4 Solutions
AmitIT ArchitectCommented:
Upgrade the schema first, then introduce 2008 as ADC on both sites and let it replicate, move the FSMO roles to 2008 servers at site 1, verify the applications, if they are hardcoded to specific dc, change it. Change the DNS setting at member server also, so they should point to new 2008 DC's for GC, DNS etc.

Important point WINS, WINS plays are major role, don't forget to migrate to new server, if you have separate server for WINS, as lot of application including Exchange depends to WINS. Let me know, if this helps
Krzysztof PytkoActive Directory EngineerCommented:
You don't have to migrate your environment to use 2008 server as DC. You need to extend schema and the you can promote it as DC.

For that, plese check my blog at

after all, you may wish to transfer FSMO roles to the new DC

When you transfer PDC Emulator role, then you have to advertise new time server in your forest

[...]- after transfer of the PDCEmulator role, configure the NEW PDCEmulator to an external timesource and reconfigure the old PDCEmulator to use the domainhierarchie now. Therefore run on the NEW "w32tm /config /manualpeerlist:PEERS /syncfromflags:manual /reliable:yes /update" where PEERS will be filled with the ip address or server(time.windows.com) and on the OLD one run "w32tm /config /syncfromflags:domhier /reliable:no /update" and stop/start the time service on the old one. All commands run in an elevated command prompt without the quotes. [...]

an extract from MVP blog at

and as the last step, you can decommission the old DC

There are a couple of very important considerations, that you should have in mind, before you proceed with your migration scenario.
--Check, and raise, if necessary, the Domain and Forest functional levels. You cannot upgrade directly from Windows 2000 mixed, or Windows Server 2003 interim domain functional levels.

--The first Windows Server 2008 Domain Controller in the forest must be a Global Catalog Server, and it cannot be a Read Only Domain Controller, RODC.

--Check the FSMO roles assignments. When you prepare the existing AD, you should run adprep /forestprep on the Schema operations master, and adprep /domainprep /gpprep on the infrastructure master.In your case as there is a single Dc you need to run on the same server.

Steps to Install Windows 2008 R2 DC

1.First prepare the domain.
Insert Win 2008 R2 DVD on windows 2003 DC and execute adprep as below
Ran D:\2008DVD\Support\Adprep\adprep32.exe /forestprep on the server holding the Schema Master role.
Ran D:\2008DVD\Support\Adprep\adprep32.exe /domainprep /gpprep on the server holding the domain master role.
Reference article:http://www.petri.co.il/prepare-for-server-2008-r2-domain-controller.htm

2.Install 2008 server on the new machine. You need to assign the 2008 new computer an IP address and subnet mask on the existing network. Make sure that the preferred DNS server on new machine points to the existing DNS Server on the Domain (normally the existing domain controller)

Join the new 2008 machine to the existing domain as a member server

3.Install DNS role in win2k8
Reference KB article:http://technet.microsoft.com/en-us/library/cc725925.aspx

4.Once DNS role is installed.Ran dcpromo on win2k8 R2.
Reference KB article:http://technet.microsoft.com/en-us/library/cc753720(WS.10).aspx

5.After the Win2k8 Dc promotion is completed restart the win2k8 DC.

6.Once Active Directory is installed then to make the new machine a global catalog server, go to Administrative Tools, Active Directory Sites and Services, Expand, Sites, Default first site and Servers. Right click on the new server and select properties and tick the"Global Catalog" checkbox. (Global catalog is essential for logon as it needs to be queried to establish Universal Group Membership)

7.You must transfer the FSMO roles to the 2008 machine then the process is as outlined at http://www.petri.co.il/transferring_fsmo_roles.htm

8.Ran dcdiag /q and repadmin /replsum on DC to check for any errors.

9.Change all of the clients (and the new 2008 DC itself), to point to the 2008 DC for their preferred DNS server this may be in DHCP options or the TCP/IP settings.


Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now