NT4 to New AD and its Impact on SQL

[maynarja]

Currently have an NT4 domain called "OLDDOMAIN" and I want to move to AD.

I would ideally like to do a clean AD and run NT4.0 domain simultaneously but I am wondering what is the impact to SQL.

NT4 domain has multiple SQL servers running multiple databases on windows 2000 and 2003 servers. I would like to create a brand new AD called "NEWDOMAIN" and then remove the SQL servers from the "OLDDOMAIN" and connect them to the "NEWDOMAIN"

What is the impact on the SQL server and what are the Gotha’s I need to be aware of?

Thanks

 

[mrdenny]

There shouldn't be much impact to SQL Server. However you will need to add back into the SQL Server all domain users and groups which need access from the new domain.

If you have removed sysadmin permissions from the BUILTIN\Administrators group be sure that you know the sa password or you will lock your self out of the machine.

While transactioning users and machines from the old NT4 domain to the new domain will you be maintaining a domain trust between the two, or if everything being moved in a single night?

Denny
MCSA (2003) / MCDBA (SQL 2000)
MCTS (SQL 2005 / Microsoft Windows SharePoint Services 3.0: Configuration / Microsoft Office SharePoint Server 2007: Configuration)
MCITP Database Administrator (SQL 2005) / Database Developer (SQL 2005)

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com

 

[maynarja]

No, this will be a few months before all users are moved into the new domain.

At this point I am thinking to create a "NEWDOMAIN" at HQ and then move the remote sites over from the "OLDDOMAIN" into the "NEWDOMAIN" while leaving HQ on the old domain and exchange servers. Creating a trust relationship as needed. Once this is complete then I will move HQ into the "NEWDOMAIN" and also move SQL into the new domain. Again once this is complete then I will move the "OLDDOMAIN" mailboxes from the exchange server into a brandnew exchange server in the "NEWDOMAIN".

Is there anything I need to do as far as referencing the old domain or this should not be an issue, as the server name will remain the same?

Any thought on the above is appreciated.

Thanks

 

[mrdenny]

Frankly SQL doesn't care about what domain it's in as long as the NT user groups are granted access to the SQL Server and domain trusts are in place you will be fine.

Denny
MCSA (2003) / MCDBA (SQL 2000)
MCTS (SQL 2005 / Microsoft Windows SharePoint Services 3.0: Configuration / Microsoft Office SharePoint Server 2007: Configuration)
MCITP Database Administrator (SQL 2005) / Database Developer (SQL 2005)

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com

 

[maynarja]

I am working with a vendor that claims that you should not change an SQL servers domain.

The information they sent me is all over the place and not a direct link to this being an issue.

As stated earlier, I have an NT 4 domain running SQL servers using NT 4 Authentication and SQL authentication depending on the database server. I want to create an brand new domain running windows 2003 and create a trust relationship between the two domains. I then would like to migrate all the users and users computers (Using ADMT) into the new domain and allow users to continue accessing the resources in the old domain using SIDhistory. Then finally migrate the SQL servers into the new domain by removing them from the old domain and add them to the new domain. Finally clean up the SIDHistory and redo the permissions.

###########################################################
Here is the info I recieved from them.

We received a number of links and some input from Microsoft related to this issue. Migrating a server from one domain to another is possible but not recommended as there are a number of things that could go wrong, especially permission issues. There are a number of scripts that need to be created and a number of applications that need to be run in order to complete the entire migration process.



· “If you want to migrate the SQL Servers from one domain to another and you do not use a new server on the new domain. You could take the server out of the old domain and then join it to the new domain. However, please note that you shall add domain users of the new domain to the SQL logins after migration even if you have used ADMT to migrate users. This is because that SID history does not apply to SQL logins. If old domain has trust relationship with the new domain, the old domain users could still access the SQL Servers if the users exist. Also, you need create new database users to map to the new SQL logins for new domain users. If you want to use a new machine on the new domain and migrate databases from old domain to new domain. You may use backup/restore or detach/attach method to move user databases. You shall also migrate logins/passwords between new domain:



1) Script logins from old domain SQL by using "Q246133 HOW TO: Transfer Logins and Passwords between Instances of SQL Server”

http://support.microsoft.com/?id=246133

2) Generate Permission script

3) Modify script to use new domain name (script result from Q246133)

4) Remove the old logins; Detach all the user DB

5) Run script on SQL Server to create the logins so that you will have new domain\users.

6) Use sp_Sidmap procedure to change domain name in sysusers to the one in sysxlogins per "Q240872



Note: These steps also apply to move server directly to new server situation if you do not want to keep the old domain users as SQL logins.”



· “It’s never "recommended" that you change a cluster’s domain, given the complexities involved” This is also true for a stand-alone SQL server.



“a wide variety of tools are used to perform the actual domain-level change (including security considerations, account migrations, sid mappings, and so forth). Often that’s the toughest part of the process, not the actual change itself” à

http://www.microsoft.com/technet/technetmag/issues/2007/05/SQLQA/

· “When you first install Microsoft SQL Server to run under a Microsoft Windows NT account, SQL Server sets for that Windows NT account various Windows user rights and permissions on certain files, folders, and registry keys” à

http://support.microsoft.com/kb/283811/en-us

All the permissions on the files/folders and registry keys will have to be manually updated if a migration is to be done. Modifications to registry permissions can be a very time consuming, not to mention very sensitive task!



Here are a couple of articles forwarded by Microsoft as well.



314546 HOW TO: Move Databases Between Computers That Are Running SQL Server

http://support.microsoft.com/?id=314546

240872 HOW TO: Resolve Permission Issues When You Move a Database Between

http://support.microsoft.com/?id=240872

HOW TO: Transfer Logins and Passwords Between Instances of SQL Server

http://support.microsoft.com/kb/246133/

224071 INF: Moving SQL Server Databases to a New Location with Detach/Attach

http://support.microsoft.com/?id=224071

###########################################################

 

[mrdenny]

This thread thread962-1386914 has an MSKB article about moving a cluster to another domain.

Denny
MCSA (2003) / MCDBA (SQL 2000)
MCTS (SQL 2005 / Microsoft Windows SharePoint Services 3.0: Configuration / Microsoft Office SharePoint Server 2007: Configuration)
MCITP Database Administrator (SQL 2005) / Database Developer (SQL 2005)

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com

 

[maynarja]

Correct, Which we are not doing and they know that.....

I just want to know hands down that if changing the domain "NOT COMPUTERNAME" will break SQL.

I understand that once I change the domain name of the SQL server I will have to deal with the rights but I am OK with this as long as SQL will function normally.

Does anyone see an issue with the process I will be taking?

###########################################################
As stated earlier, I have an NT 4 domain running SQL servers using NT 4 Authentication and SQL authentication depending on the database server. I want to create an brand new domain running windows 2003 and create a trust relationship between the two domains. I then would like to migrate all the users and users computers (Using ADMT) into the new domain and allow users to continue accessing the resources in the old domain using SIDhistory. Then finally migrate the SQL servers into the new domain by removing them from the old domain and add them to the new domain. Finally clean up the SIDHistory and redo the permissions.
###########################################################

 

[mrdenny]

There will be no problems chaning the domain that the SQL Server runs in.

Denny
MCSA (2003) / MCDBA (SQL 2000)
MCTS (SQL 2005 / Microsoft Windows SharePoint Services 3.0: Configuration / Microsoft Office SharePoint Server 2007: Configuration)
MCITP Database Administrator (SQL 2005) / Database Developer (SQL 2005)

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com