Solved

adding a 2k12 dc to sbs 2k3

Posted on 2013-06-18
7
624 Views
Last Modified: 2013-07-01
Hello,

I'm trying to put a 2k12 std server into an sbs 2k3 domain. the forest lvl is set to 2k3. when I run adprep32.exe on the sbs server just to make sure im not missing something (since the gui can be wrong) it fails. attached is the log for the adprep32 run I did. I will also outline step-by-step what ive done when adding the new server to the sbs domain:

1. sbs domain is live and running for millennia as 2k3 forest lvl (I checked b4 the next steps)
2. connected 2k12 srv to domain X
3. "welcome to domain x"
4. rebooted 2k12
5. went to 2k12 dcpromo wizard
6. tried contacting a dc on domain x (the only one is the sbs server)
7. 2k12 returns "verification of replica failed. the forest level is windows 2000. to install a windows 2012 dc...."

any help is appreciated!
ADPrep.log
0
Comment
Question by:CMx-Eng
7 Comments
 
LVL 25

Expert Comment

by:Tony1044
ID: 39258923
Ok first off I am unsure whether this would or wouldn't be supported but assuming you have taken care to appreciate a couple of things:

SBS can have additional domain controllers but these additional DC's must not host any FSMO roles. If you do this, it'll cause SBS to shut down.

Next, from http://technet.microsoft.com/en-us/library/hh994618.aspx#BKMK_UpgradePaths :

Functional level features and requirements

--------------------------------------------------------------------------------

Windows Server 2012 requires a Windows Server 2003 forest functional level. That is, before you can add a domain controller that runs Windows Server 2012 to an existing Active Directory forest, the forest functional level must be Windows Server 2003 or higher. This means that domain controllers that run Windows Server 2008 R2, Windows Server 2008, or Windows Server 2003 can operate in the same forest, but domain controllers that run Windows 2000 Server are not supported and will block installation of a domain controller that runs Windows Server 2012. If the forest contains domain controllers running Windows Server 2003 or later but the forest functional level is still Windows 2000, the installation is also blocked.

Windows 2000 domain controllers must be removed prior to adding Windows Server 2012 domain controllers to your forest. In this case, consider the following workflow:

1.Install domain controllers that run Windows Server 2003 or later. These domain controllers can be deployed on an evaluation version of Windows Server. This step also requires running adprep.exe for that operating system release as a prerequisite.


2.Remove the Windows 2000 domain controllers. Specifically, gracefully demote or forcibly remove Windows Server 2000 domain controllers from the domain and used Active Directory Users and Computers to remove the domain controller accounts for all removed domain controllers.


3.Raise the forest functional level to Windows Server 2003 or higher.


4.Install domain controllers that run Windows Serer 2012.


5.Remove domain controllers that run earlier versions of Windows Server.

Now this is where I am uncertain - see in step 1 where it says run ADPREP.EXE ? ( http://technet.microsoft.com/en-us/library/dd464018(WS.10).aspx ) this writes changes to the AD schema to, among other things, add support for newer versions.

So the step would be something along the lines of, elevate the domain to 2003 functional level (after taking note of how this may impact your current systems), and then run ADPrep from the 2012 media on the SBS DC.

Personally I wouldn't want to do this on a live system.
0
 
LVL 36

Expert Comment

by:Jian An Lim
ID: 39259009
do you have schema admin and domain admin?

also verify this folder security access to confirm why you don't have access to update this folder (use ADSIedit.msc)


[Status/Consequence]

The operation has not run or is not currently running. It will be run next.
[2013/06/18:17:04:55.984]
ADPREP was unable to modify the default security descriptor on object CN=ms-DS-Managed-Service-Account,CN=Schema,CN=Configuration,DC=CENTER,DC=local.

[Status/Consequence]

Adprep attempts to merge the existing default security descriptors with the new access control entry (ACE).
0
 
LVL 35

Expert Comment

by:Cris Hanna
ID: 39259549
The real question that needs answering is why?  What is your goal by adding Win2K12 server as a DC?

As already pointed out the Forest and Domain Levels of the SBS server to Server 2003
You can find the instructions to perform those tasks here
http://technet.microsoft.com/en-us/library/cc780862(v=ws.10).aspx
http://technet.microsoft.com/en-us/library/cc776703(v=ws.10).aspx

With Server 2012, you no longer have to run ADPREP on the SBS 2003 server..the "wizard" in Server 2012 will do it for you
CAUTION HERE:   BE SURE YOU HAVE A GOOD, VERIFIABLE BACKUP
The follow the instructions in this great article by one of Microsoft's Premier Field Engineers
http://blogs.technet.com/b/askpfeplat/archive/2012/09/03/introducing-the-first-windows-server-2012-domain-controller.aspx
0
What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

 

Author Comment

by:CMx-Eng
ID: 39262453
@cris we have clients in distant locations on the current domain. adding the new server as a dc and moving everything "in house" is easier from an administrative pov than creating a new domain that would require travel or coordination between points to configure the distant client workstations....

@limjianan the account im using has schema and enterprise rights, yes. I also verified security control for the groups in the adsiedit properties of CN=Schema,CN=Configuration,DC=CENTER,DC=local
0
 
LVL 35

Expert Comment

by:Cris Hanna
ID: 39263945
just be aware that your SBS 2003 CALs do not cover access to a Server 2012 servers, so you'll need to 2012 CALs as well
0
 

Accepted Solution

by:
CMx-Eng earned 0 total points
ID: 39279798
I had to change a value in CN=Schema,CN=Configuration,DC=CENTER,DC=local to reflect the win 2003 forest lvl and the 2012 DC took. All setup and on the domain now.
0
 

Author Closing Comment

by:CMx-Eng
ID: 39289444
overlooked a value in the config, should have seen it earlier. good thing I double checked...
0

Featured Post

What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

This is a little timesaver I have been using for setting up Microsoft Small Business Server (SBS) in the simplest possible way. It may not be appropriate for every customer. However, when you get a situation where the person who owns the server is i…
This article offers some helpful and general tips for safe browsing and online shopping. It offers simple and manageable procedures that help to ensure the safety of one's personal information and the security of any devices.
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now