active directory domain level raising

active8it used Ask the Experts™
we have citrix xenapp 6.5 and require a CAG to be setup but in order to setup certificate services on the new 2008r2 box i believe i need to raise the  forest/domain which is in 2000 native mode at present. if i change this to 2003 is there any risk or could this cause any issues. all pc etc are xp or vista or 7.
once ive done this do i need to update the forest with adprep to 2008 to support certificate services, again will this cause any issues.

the error i get when trying to add the certificate enrollment webservice in server manager in the current envirnment is "The Certificate Enrollment Web Service or Certificate Enrollment Policy Web Service must be installed on a member server in an Active Directory forest in which the Windows Server 2008 R2 version of ADPrep /forestprep has been successfully run."
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
There should be no issues in raising Domain Level to 2003

"Do not raise the forest functional level if you have, or will have, any domain controllers running Windows NT 4.0 or Windows 2000. As soon as the forest functional level is raised to Windows Server 2003, it cannot be changed back to the Windows 2000 forest functional level"

For running Forest prep you are preparing the domain for introducing windows 2008 DC .. as such which will not have any effect untill you introduce the DC.
Adprep.exe has parameters that perform a variety of operations that help prepare an existing Active Directory environment for a domain controller that runs a later version of Windows Server. Not all versions of Adprep.exe perform the same operations, but generally the different types of operations that Adprep.exe can perform include the following:
Updating the Active Directory schema
Updating security descriptors
Modifying access control lists (ACLs) on Active Directory objects and on files in the SYSVOL shared folder
Creating new objects, as needed
Creating new containers, as needed

see more details in below link


i just checked and the client has a wsus/blackberry server which is 2000 i guess this isnt an issue as its not a DC?
Requirement is to have 2003 DC. you can still have 2000 servers in the network.


thanks for your help

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial