Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions

Move DHCP from W2003 to w2008 r2

Posted on 2016-08-17
Last Modified: 2016-09-17
Followed several KB articles to move our DHCP from an older 2003 server to a 2008 R2 server that is also our 2nd DC.
Since we needed to preserve already existing scopes on the 2008 R2 I opted to use a 'merge' option (as discussed here https://support.microsoft.com/en-us/kb/281626) thus exporting only the scopes we need from the old server and importing the scopes (instead of ALL) on the new 2008 R2 server.
export c:\temp\dhcpdb
import c:\temp\dhcpdb
The export on the 2003 server worked fine and I managed to import on a 2008 R2 member server without issues as a test. However, when I try exactly the same process on the intended server (which is a DOMAIN CONTROLLER) I get an 'Access Denied" error. Please note that I have already looked at this article and similar one's (https://support.microsoft.com/en-us/kb/890480) and I AM LOGGED IN AS DOMAIN ADMIN which is a member of the local administrators group on the server. I even tried with an account that I made ENTERPRISE ADMIN, but same 'access denied' result. The exported data was copied to the 2008 R2 DC server, so it was not coming over the network. I tried importing using a regular cmd prompt (run as admin) and powershell but no luck. I did see this article (https://www.experts-exchange.com/questions/28645917/NETSH-DHCP-SERVER-Access-Denied.html) about changing the account as I do suspect it is running within a local context as no account etc. is specified, but since the server I am moving it to hosts live scopes for other subnets I am reluctant to make changes without some feedback. Help :-)
Question by:Laszlo Denes
  • 4
  • 2
LVL 39

Expert Comment

by:Adam Brown
ID: 41759980
Just to make sure...are you running CMD as administrator when running the import? UAC may be blocking you here.

Author Comment

by:Laszlo Denes
ID: 41760897
I did run it as admin and UAC is turned off completely :-(

Author Comment

by:Laszlo Denes
ID: 41761001
Could it have to do with this (see below) even though the server is a DC not just a member server?


This is caused by permission issues on the user’s account.  To fix this, first right click on IPv4 and then select Properties.  Click on the Advanced tab and then click on Credentials.  Inside of here, enter in the credentials you want to use as the service account to run DHCP.

DHCP Credentials

Next, open up Server Manager, expand Configuration, expand Local Users and Groups.  Click on DHCPAdministrators, and then add your service account.

DHCP Administrators group

Next, restart the DHCP Server service.  Inside of server manager, right click on the DHCP server and click Authorize.  Restart the service one last time, and each of your DHCP scopes should now be up (with green checkmarks).
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.


Author Comment

by:Laszlo Denes
ID: 41761004
oh and I noted event 1056 under DHCP role on the 2008 R2 target server.
The DHCP service has detected that it is running on a DC and has no credentials configured for use with Dynamic DNS registrations initiated by the DHCP service.   This is not a recommended security configuration.  Credentials for Dynamic DNS registrations may be configured using the command line "netsh dhcp server set dnscredentials" or via the DHCP Administrative tool.
LVL 39

Accepted Solution

Adam Brown earned 500 total points
ID: 41761096
The local groups don't exist on a DC, so the permission settings you note won't work the way it is shown there. You would go to AD Users and Computers, go to the Builtin Container, and make sure whatever account you're using is in the Administrators group there. The Builtin container is a replacement for the Local Users and Groups snapin for all the DCs in the environment (by default, anyway). Just note that adding a user account to the Administrators group will effectively turn them into Domain Admins as well. If the DHCP admins group is in the Builtin container, you can use that.

The credentials for the error you're getting wouldn't prevent you from importing DHCP information.

Author Comment

by:Laszlo Denes
ID: 41761185
Okay thanks. So I am trying it again.
Logged into source server (2003) as domain admin that has scopes I want to export.
Opened cmd prompt (run as administrator)
Ran command as shown and it worked

netsh>dhcp server \\mailman
netsh dhcp server>export c:\dhcpmailmanscopes\dhcpdb

Command completed successfully.
netsh dhcp server>

Then stopped DHCP on the 2003 source server.
Copied over the exported data/folder into the c: root of the target 2008 DC

Logged into target Domain Controller (2008 R2) with domain admin account (that is also member of local admin group) that I want to import DHCP scope into.
That DC already has existing scopes and an authorized DHCP server hence the merge not a full export/import of all scopes from the 2003.
Opened a cmd prompt as admin and ran import command as shown below

netsh>dhcp server \\tghdc2
netsh dhcp server>import c:\dhcpmailmanscopes\dhcpdb
Access is denied.

netsh dhcp server>

Administrators have full control of that folder and file on both systems.
and it is then that I see the 1056 error
The DHCP service has detected that it is running on a DC and has no credentials configured for use with Dynamic DNS registrations initiated by the DHCP service.   This is not a recommended security configuration.  Credentials for Dynamic DNS registrations may be configured using the command line "netsh dhcp server set dnscredentials" or via the DHCP Administrative tool.

P.S. The merge import of the single scope works on a test 2008 R2 member server that had a test scope configured but its DHCP is not authorized as I did not want to cause conflicts!

What am I missing or doing wrong.
LVL 34

Expert Comment

by:Seth Simmons
ID: 41802877
No comment has been added to this question in more than 21 days, so it is now classified as abandoned.

I have recommended this question be closed as follows:

Accept: Adam Brown (https:#a41761096)

If you feel this question should be closed differently, post an objection and the moderators will review all objections and close it as they feel fit. If no one objects, this question will be closed automatically the way described above.

Experts-Exchange Cleanup Volunteer

Featured Post

Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Where to find file on SBS 2008 4 30
Setting up RAID5 on HP ProLiant DL380G5 15 72
powershell script 9 63
Word 2016 Installation Problem on Terminal Server 9 39
New Windows 7 Installations take days for Windows-Updates to show up and install. This can easily be fixed. I have finally decided to write an article because this seems to get asked several times a day lately. This Article and the Links apply to…
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…

861 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question