How to upgrade the AD functional level from 2003 to 2008?


I have the following AD environment:

Functional Level: 2003
2 Sites
1 Windows Server 2003 = Primary DNS, DHCP (old FSMO roles holder)
2 Windows Server 2008 = Domain Controller, PDC, all FSMOs, DNS (New FSMO roles holder)
1 Windows Server 2008 R2 = Domain Controller, DNS

A couple of months back I have transferred all the FSMO roles to one of the Windows Sever 2008 DC.

My goal is to decommission and turn off the Windows 2003 Domain controller and upgrade my functional AD level to 2008.

I know I have to run some commands as well to be ale to synchronize the network time with the new 2008 PDC.

Which would be the cleanest way possible to accomplish this task?

Also the right order of the tasks involved will be helpful.
Who is Participating?
Chris HInfrastructure ManagerCommented:
If you're just trying to decommision the 2003 server, confirm all roles and services are no longer in use and then run DCPROMO  (ALLOW FOR 90 minutes for complete demotion, unless you have altered your synchronization policy)

I'm not sure what you mean about the network time sync.  Nothing in AD will work correctly without time sync'd between domain controllers.

Once the 2003 is decommissioned, you should be good to up your forest level.
Chris HInfrastructure ManagerCommented:
FYI, An easy way to determine if the services are in use is to turn it off...   Lol.  Otherwise, make sure DHCP isn't addressing and any other DHCP servers aren't handing out the 2003 server as a DNS server.
Once the PDC emulator operation master role for the domain has been transferred to the 2008 DC then it will be the authoritative time server in the domain.  Everything will sync to that servers clock so you need to make sure its time is correct.

You can set the time on the 2008 PDC emulator to sync with an online time source using the instructions here...

Once the 2003 server is dcpromoed down then you should be able to raise the functional level up to 2008.
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

LuiLui77Author Commented:
Check out the order I am thinking on going about doing this:

- dcpromo down the 2003
- raise functional level to 2008
- sync PDC to online sources
- check on other services provided by the 2003 and migrate them
- shut down the 2003 box

what do you think?
Chris HInfrastructure ManagerCommented:
I'd make step 3 step 1.  But yeah.
Will SzymkowskiSenior Solution ArchitectCommented:
When you decommission your 2003 server, I would also make sure that you update your dhcp scopes for the DNS section to ensure that users are no longer pointing to this server. I would also do this for any statically assign servers/workstations as well.

Another thing, before you do any changes to the domain (raising the functional level) you need to ensure that replication is completely working before you decommission the 2003 server and test again after.

Once you have completely confirmed this you can raise the functional level to 2008. Use the following commands to check replication and also ensure DC health is good.

Repadmin /replsum
Repadmin /showrepl
Repadmin /bridgeheads
DCdiag /v

Also as  rgorman has stated you need to also make sure that you have a PDC Authoritative time server on your 2008 DC which now holds the PDC role. Do this before doing anything else, if you have not done it already.

 Setup Authoritative Time Source

At this point once everything has been completed you can raise the functional level. It is best to raise the Domain Functional level first followed by the Forest Functional Level.

If you raise the Forest Functional level first it will automatically update the Domain as well.

Lastly make sure that you take a backup (system state backup) of your DC's before raising the functional level. I say this because this operation is not reversible and if you experience issues you will need to restore from backup.

Will SzymkowskiSenior Solution ArchitectCommented:
Follow the steps in my post and it should go smoothly.

LuiLui77Author Commented:
Hi Will Thank you for your post!

I am a little new to the situation so I am a little confused when you said:
"Another thing, before you do any changes to the domain (raising the functional level) you need to ensure that replication is completely working before you decommission the 2003 server and test again after".

Do you mean checking replication only between the DCs that are staying (2008) or including the 2003?
and do you mean "decommissioned" as depromoted or shutdowned?

Chris HInfrastructure ManagerCommented:
The four commands he told you to issue will print log files explaining the health of your domain topology.  There is no harm in running them before the demotion to understand what they'll look like when everything is healthy.
LuiLui77Author Commented:
Thank you All!
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.