Solved

Upgrading Domain Controller

Posted on 2014-10-13
7
152 Views
Last Modified: 2014-10-22
Hi Guys,

We recently upgraded our Windows primary domain controller to Windows Server 2012 R2 standard.
The roles were transferred, RID, PDC and Infrastructure.
All points to the new server.

All our domain controllers are GC servers.

The domain function level still shows as Windows Server 2003 (old DC), as does the forest function level.

The problem is that the old domain controller still overwrites domain functions.
For example:  It replicates it's time for the domain and overwrites security policies set on the new domain controller.  

Users authenticate to the new domain controller whilst the old PDC is switched off, although, when the old PDF is on, users still authenticate against the old PDC.

We would like to keep the old domain controller as backup, but the new domain controller should be authoritative.
0
Comment
Question by:Rupert Eghardt
  • 3
  • 3
7 Comments
 
LVL 34

Expert Comment

by:Seth Simmons
ID: 40377039
Users will authenticate with the first domain controller available in the AD site.  Just because the old server responds first doesn't necessarily indicate an issue.  With that box off, users are authenticating against a different domain controller without issue is perfectly acceptable.

As a sanity check, you could do netdiag on those boxes to check for any failures though what you are describing doesn't indicate a problem.  This is part of the multi-master model.  There is no primary and secondary (or backup) as in the NT days.
0
 

Author Comment

by:Rupert Eghardt
ID: 40377179
Thanks Seth,

Why would security policies (made on the new server whilst the old server is off), revert back once the old server is brought online again?
0
 
LVL 34

Expert Comment

by:Seth Simmons
ID: 40377193
what is changing?
0
VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

 

Author Comment

by:Rupert Eghardt
ID: 40377984
For example:

Switching on the Account Lockout Policy, updating the Minimum and Maximum Password Age, also updated-server time will revert back upon switching on the old PDC.
0
 
LVL 16

Expert Comment

by:Joshua Grantom
ID: 40382854
It sounds like the new server did not take over all of the FSMO Roles. Have you verified that all roles are held by the new server?
0
 

Author Comment

by:Rupert Eghardt
ID: 40385424
I verified and all roles are pointing to the new PDC in Windows.
I restart both servers and for some reason the security / password policies are grayed out for changes on the new server.

It there a command that I can run to verify that all roles are held by the new DC?
0
 
LVL 34

Accepted Solution

by:
Seth Simmons earned 500 total points
ID: 40386746
It there a command that I can run to verify that all roles are held by the new DC?

from an elevated command prompt - netdom query fsmo
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
A safe way to clean winsxs folder from your windows server 2008 R2 editions
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question