1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

2000 to 2003 Migration Question

Discussion in 'General Microsoft Certifications' started by Methodman85, Nov 12, 2008.

  1. Methodman85

    Methodman85 Byte Poster

    244
    6
    32
    Hello Everyone,
    So we're finally upgrading to a windows 2003 domain here at my company, so naturally I have some questions since this is my first domain migration.

    We have 2 domains within the same forest here (production domain and corporate domain)
    The Corporate domain controllers are the ones I'm migrating (2)
    The main corporate DC holds the PDC, RID and IM.
    The Schema Master and Domain Naming Master on the other hand are on a DC on the production domain (I'm guessing this was the first DC created in our forest)

    My question is, where do I run adprep /forestprep and adprep /domainprep
    Should they be run both from the production domain controll since it's the head of the forest?
    Or can I run this on the master Corporate DC
    Or do I need to run adprep /forestprep on the production domain, and then run adprep /domainprep on the corporate domain?

    Thanks guys!
     
    Certifications: MCTS, MCSE, MCSA:M, CCNA, MCDST, N+
    WIP: 70-680
  2. wagnerk
    Highly Decorated Member Award

    wagnerk aka kitkatninja Moderator

    10,831
    357
    341
    Even though I've been part of two domain/forest upgrades myself (1 as part of a team, 1 as the lead) in real environments (not counting test environments, as tests environment seldom have the complexity as the real world one). I do not want to advise just on the basis on one or two posts, as any mistakes can be costly (the longer your network is down, is time your company will not be doing it's business). However please refer to the following Websites:

    Common Mistakes When Upgrading a Windows 2000 Domain To a Windows 2003 Domain
    Plan a Windows Server 2003 Migration
    Windows Server 2003 Migration Tool Kit - ISO
    Microsoft Windows Server 2003: Upgrading Windows 2000 Domains to Windows Server 2003
    Upgrading Windows 2000 Domains to Win. Server 2003

    Technet search

    I will say this:
    adprep /forestprep is run on the schema master
    adprep /domainprep is run on the infrastructure master


    Another link: Upgrading from a Windows 2000 domain

    Hope this helps

    -Ken
     
    Certifications: CITP, PGCert, BSc, HNC, LCGI, PTLLS, MCT, MCITP, MCTS, MCSE, MCSA:M, MCSA, MCDST, MCP, MTA, MCAS, MOS (Master), A+, N+, S+, ACA, VCA, etc... & 2nd Degree Black Belt
    WIP: PGDip
  3. Methodman85

    Methodman85 Byte Poster

    244
    6
    32
    Thanks wagnerk, you're right you can't be too safe doing something like this. I'll give all of these a read.
     
    Certifications: MCTS, MCSE, MCSA:M, CCNA, MCDST, N+
    WIP: 70-680
  4. wagnerk
    Highly Decorated Member Award

    wagnerk aka kitkatninja Moderator

    10,831
    357
    341
    I added a little more info to my original post :)

    -Ken
     
    Certifications: CITP, PGCert, BSc, HNC, LCGI, PTLLS, MCT, MCITP, MCTS, MCSE, MCSA:M, MCSA, MCDST, MCP, MTA, MCAS, MOS (Master), A+, N+, S+, ACA, VCA, etc... & 2nd Degree Black Belt
    WIP: PGDip
  5. Methodman85

    Methodman85 Byte Poster

    244
    6
    32
    Wonderful thank you :D
    I have a guide that makes the process seem pretty straight forward. But it leaves out some details I would like to see (like the info you just presented)

    Link

    I will definitely go over everything you've posted as well. Thanks!
     
    Certifications: MCTS, MCSE, MCSA:M, CCNA, MCDST, N+
    WIP: 70-680
  6. wagnerk
    Highly Decorated Member Award

    wagnerk aka kitkatninja Moderator

    10,831
    357
    341
    No worries, hope everything goes well :)

    -Ken
     
    Certifications: CITP, PGCert, BSc, HNC, LCGI, PTLLS, MCT, MCITP, MCTS, MCSE, MCSA:M, MCSA, MCDST, MCP, MTA, MCAS, MOS (Master), A+, N+, S+, ACA, VCA, etc... & 2nd Degree Black Belt
    WIP: PGDip
  7. Stoney

    Stoney Megabyte Poster

    731
    23
    69
    Aside from what has already been said I will say that you should definitely make sure you back up everything and ensure the backups work.

    You never know what nasty surprises could pop-up so make sure you have the facility to roll back to the original production state just in case the worst does happen.

    If you have the hardware available it may be worth having a clone of your PDC ready to be put online in case it looks like the DC's are going to be offline for a considerable amount of time.

    HTH
     
    Certifications: 25 + 50 metre front crawl
    WIP: MCSA - Exam 70-270
  8. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,190
    296
    319
    Are you running an in-place upgrade on the existing DCS or are you purchasing new hardware (new servers) to run Server 2003?
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010
  9. Methodman85

    Methodman85 Byte Poster

    244
    6
    32
    Brand new hardware. The old Boxes are a PII and PIII systems. :eek:

    I've taken Windows Backups of both, as well as Acronis Backups which are great due to their Universal Restore capability.

    Looks like I'll need to take a full backup of the production domain's DC as well since it's the chief of the forest, I probably would of overlooked this and just focused on the two corporate domain controllers if I didn't ask my question here :biggrin
     
    Certifications: MCTS, MCSE, MCSA:M, CCNA, MCDST, N+
    WIP: 70-680
  10. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,190
    296
    319
    Cool, to fully understand how you are going to plan the migration I would check how the FMSO roles are distributed in the whole forest.

    You say you are migrating the corporate domain so who is responsible for the production domain? Before you start migrating you will have to wait until the forest is prepped correctly to allow Server 2003 domain controllers.

    What messaging software are you using just now? If it Exchange server then you will have to consider the global catalog as this is *probably* on one of your DCs just now.

    DHCP may have to be reconfigured with the new IPs of the Server 2003 DCs so that DNS will work correctly on the network. Another thing to consider is if any devices have an static references to the old 2k DCs, again this will have to be updated.

    Finally make sure you demote the 2k DCs correctly, don’t just switch them off! :biggrin

    Best of luck! 8)
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010
  11. Methodman85

    Methodman85 Byte Poster

    244
    6
    32
    Hey Sparky,
    My manager is in charge of the production domain.
    We are on Exchange 2000, and all DCs are GCs.

    Tip 15 from The Common Mistakes Article says:
    If you have a multidomain hierarchy, upgrade frist the forest root domain, and only after this upgrade is complete, the rest of the forest.

    Our Corporate domain is not a child domain, it's a seperate domain within the same forest.
    Based on this tip, would running the ADprep on the forest root domain be enough? Or does the forest root domain controller (Production DC) need to be the first to be migrated to a 2003 server?
     
    Certifications: MCTS, MCSE, MCSA:M, CCNA, MCDST, N+
    WIP: 70-680
  12. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,190
    296
    319
    How are the FSMO roles distributed in your domain, the corporate one that is.

    Method 4 is this link should help with the netdom command.

    http://www.petri.co.il/determining_fsmo_role_holders.htm
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010
  13. Methodman85

    Methodman85 Byte Poster

    244
    6
    32
    Hey Sparky,
    I guess I wasn't really that clear in my orginal Post. Ah netdom makes things easy, I checked the manual way before lol.

    Here goes:
    Production Domain

    Schema Owner: Production01.productiondomain.com
    Domain Role Owner: Production01.productionomain.com
    PDC Role: Production01.productionomain.com
    RID Pool manager: Production01.productionomain.com
    Infrastructure Ower: Production01.productionomain.com

    Corporate Domain

    Schema Owner: Production01.productiondomain.com
    Domain Role Owner: Production01.productionomain.com
    PDC Role: Corporate01.corporatedomain.com
    RID Pool manager: Corporate01.corporatedomain.com
    Infrastructure Ower: Corporate01.corporatedomain.com
     
    Certifications: MCTS, MCSE, MCSA:M, CCNA, MCDST, N+
    WIP: 70-680
  14. Methodman85

    Methodman85 Byte Poster

    244
    6
    32
    Well after doing some more reading I presented some info to my manager. Specifically:
    "The follwing computers must be amoung the first domain controllers that run Windows Server 2003 in the forest in each domain:
    The domain naming master in the forest so that you can create default DNS program partitions.

    The primary domain controller of the forest root domain so that the enterprise-wide security prinicipals that Windows Server 2003's forestprep adds become visible in the ACL editor.

    So with that my new question is, how do I put corporatedomain.com into it's own forest? :eek:
    Also would creating a trust relationship after it's in its own forest produce the same results as when it had a default trust from being in the same forest as productiondomain.com? - I can't remember if the results are the same or not.

    Oh man I need to do lots more reading. Help is much appreciated guys.
     
    Certifications: MCTS, MCSE, MCSA:M, CCNA, MCDST, N+
    WIP: 70-680
  15. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,190
    296
    319
    Is there a trust in place between the two domains just now?
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010
  16. Methodman85

    Methodman85 Byte Poster

    244
    6
    32
    Isn't there always a mandatory default trust (one that you don't have to configure) between domains within the same forest?
     
    Certifications: MCTS, MCSE, MCSA:M, CCNA, MCDST, N+
    WIP: 70-680
  17. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,190
    296
    319

    On production01 run adprep /forestprep (let it replicate to the corporate1.com domain) then run adprep /domainprep on production01 and then on corporate01. That should prep everything for you. 8)

    As the for the trust there will be one but there are various types of trust you can have.

    Remember to run adprep /forestprep with an account that is a member of the enterprise admins group and adprep /domainprep needs domain admin rights on whatever domain you are running it on.
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010
  18. Methodman85

    Methodman85 Byte Poster

    244
    6
    32
    Hey Sparky,
    What worries me is this:

    The following computers must be among the first domain controllers that run Windows Server 2003 in the forest in each domain:
    • The domain naming master in the forest so that you can create default DNS program partitions.
    • The primary domain controller of the forest root domain so that the enterprise-wide security principals that Windows Server 2003's forestprep adds become visible in the ACL editor.
    • The primary domain controller in each non-root domain so that you can create new domain-specific Windows 2003 security principals.
    To do so, use WINNT32 to upgrade existing domain controllers that host the operational role you want. Or, transfer the role to a newly-promoted Windows Server 2003 domain controller. Perform the following steps for each Windows 2000 domain controller that you upgrade to Windows Server 2003 with WINNT32 and for each Windows Server 2003 workgroup or member computer that you promote:

    To me this says that production01, or at least the Roles that Production01 hold, must be the first to be on a Server 2003 DC, either by an inplace upgrade of the Server that holds the schema, and domain naming master. Or by transfering those roles to a Server 2003 DC.

    So Is just doing the adprep on production01 and then moving onto corporate01 as the first migration safe and fine? Or do I actually have to migrate production01 first, THEN move on to corporate01?
     
    Certifications: MCTS, MCSE, MCSA:M, CCNA, MCDST, N+
    WIP: 70-680
  19. Sparky
    Highly Decorated Member Award

    Sparky Zettabyte Poster Moderator

    10,190
    296
    319
    If you follow the steps I posted previously then you are then ready to introduce Server 2003 DCs to the domain (s). I generally run this first when I’m migrating domains as you don’t want to overlook this later on in the migration if\when other things crop up.

    After that add your new Server 2003 kit to the relevant domains as member servers and make sure you can log on.

    Run DC promo on the Server in the production domain and follow the relevant steps which relate to adding a DC to an existing domain. If you want you can now add the DC in the production domain.

    At this stage you will have the existing and DCs and new DCs running side by side. Make sure the DNS zones have also replicated correctly.

    Again as I said before you now need to migrate the FMSO roles in the production domain (5 roles) and from the corporate domain (3 roles). Remember to move the global catalogues as well. Check that all the FMSO roles are on the correct DCs and then you are ready to demote the 2k DCs.

    Before you begin I would also reset the directory services restore mode password if you don’t know it already.

    Hope this helps! 8)
     
    Certifications: MSc MCSE MCSA:M MCSA:S MCITP:EA MCTS(x5) Security+ Network+ A+
    WIP: Exchange 2007\2010
  20. Methodman85

    Methodman85 Byte Poster

    244
    6
    32
    Thanks Sparky, I originally had no intention of migrating the production domain and was trying to find out if I could do the corporate one without touching production, but looks like that's not possible with my setup.
    Only way would be to create a new corporate domain in its own forest and migrate everything over. *sigh*
     
    Certifications: MCTS, MCSE, MCSA:M, CCNA, MCDST, N+
    WIP: 70-680

Share This Page

Loading...