Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 82
  • Last Modified:

Retiring the First DNS/DC in the enterprise

I am ready to retire the first two Domain controllers/DNS servers (collocated) in the enterprise as they are Server2003.

I have moved the FSMO roles to 2008R2 servers.

DNS replicates to all in name server tab, which I'll check after removing that role from the 2003 Servers.

I'm looking for items to check or move before removing the founding DC/DNS servers.

Thanks
0
whoam
Asked:
whoam
4 Solutions
 
Benjamin MOREAUProject ManagerCommented:
Check you have a global catalog on your AD.
Check you have updated your DHC server (with new DNS).

If you are "stressed", you can test to shutdown your old server for 1/2 days et check if all acces are OK (files access, creating new account...)
0
 
footechCommented:
I'll typically do the following:
- transfer FSMO roles and verify (netdom query fsmo) from multiple servers
- run repadmin /showrepl and check for errors
- run dcdiag /v and dcdiag /v /test:dns on each DC and check for errors
- make sure DHCP is handing out correct addresses for DNS if those are changing
- best practice is to make all DCs a global catalog
- configure PDCe to sync time from external source
- reset w32tm config on old PDCe
  net stop w32time
   w32tm /unregister
   w32tm /register
   net start w32time

- you may have to update some DNS info manually, like any delegations for the _msdcs zone
- verify DNS config on new servers such as use of forwarders, any zones on the old DCs which may not be AD-integrated (and so wouldn't have been copied by AD replication)

I also think it's a good idea to turn off the old DCs for a period to verify everything functions.
0
 
Lee W, MVPTechnology and Business Process AdvisorCommented:
My steps:
1. Run DCDIAG /C /E V
2. make sure FSMO roles are moved off any DC about to be removed
3. make sure global catalogs are set for other DCs that will remain
4. make sure any system using the DNS of the server to be retired has been redirected to a new server
5. make sure DHCP settings are adjusted for ay scopes that might otherwise use the DNS server of the DCs about to be retired.
6. Turn OFF the DC to be retired for 1 week (unless something stops working, then turn it on)
7.  After 1 week, turn on the DC and decommission properly using DCPROMO and removing the DC functionality.
8.  get rid of the server
0
 
MaheshArchitectCommented:
After movement of FSMO, force AD replication and run netdom query fsmo command on all domain controllers and ensure output is same on all domain controllers
If output is not same, this is 1st thing you need to fix. In that case it is might be replication issue

After that on old PDC server run below command
w32tm /config /syncfromflags:domhier /reliable:no /update
net stop w32time
net start w32time
https://technet.microsoft.com/en-us/library/cc816748(v=ws.10).aspx

on new PDC configure server to poll time from external time source
w32tm /config /manualpeerlist:<peers> /syncfromflags:manual /reliable:yes /update
net stop w32time
net start w32time

Replace peers with single \ multiple NTP servers
format for entering multiple servers:
/Manualpeerlist:"server1.pool.org server2.pool.org"
https://technet.microsoft.com/en-us/library/cc786897(v=ws.10).aspx

On client machines, you may run below command thru GPO startup .bat script
w32tm /config /syncfromflags:domhier /update
0
 
MaheshArchitectCommented:
U may choose appropriate internet time servers from below article:
http://www.pool.ntp.org/en/
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now