Domain Migration

Hi Experts,

I have a client whose AD forest has two trees. The forest root domain is a Windows 2003 domain, another tree is a Windows 2008. Now they are planning to upgrade to domain 2016.
The 2003 domain exists merely because that it's the forest root domain. In fact, all production resources are already in the 2008 domain.

I was wondering if they should create a new forest with a fresh setup 2016 domain, then migrate everything from the other forest to the new domain; or they should setup another tree within the same forest?

Which approach is least interruptive to the production environment?


Thanks
JV
Jimmy VadAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Alex Green3rd Line Server SupportCommented:
Personally, I'd build  new 2016 DC's in the forest, DCPromo out your old 2003 boxes, ensure they have a clean removal, then upgrade the rest. Then update the forest and domain functional levels from there.

If you build a new forest, you'll have to use something like the quest ad migration manager to get all your objects over, its a lot of work for not much benefit.

Thanks
Alex
0
Jimmy VadAuthor Commented:
Hi Alex,

Thanks for your comment.  It's possible to demote a forest root domain? Im under an impression that we cannot remove forest root domain ...

Thanks
JV
0
Alex Green3rd Line Server SupportCommented:
You need to build a new DC there first, then migrate the FSMO roles to it, then demote the old domain controller.

You can't remove it, but what you're doing is preparing your forest root for the 2016 forest functional level. You can DCPromo out an old DC without any issues as long as you have another there.

I'd build a new 2016 box in your forest root, leave it for a week or two to make sure it's working and then remove the old 2003 box. You're not removing the root, just a single DC
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

Jimmy VadAuthor Commented:
Hi Alex,

I see your point. Thanks.

JV
0
Alex Green3rd Line Server SupportCommented:
0
Alex Green3rd Line Server SupportCommented:
Also,

I've just done some more digging

https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/active-directory-functional-levels

That states you cannot go direct from 2003 to 2016, so you need to go to either 2008r2 or 2012, then to 2016.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows OS

From novice to tech pro — start learning today.