I'm getting new servers, and one of the boxes is the FSMO domain controller running Active Directory, DNS, and Global Catalog. I know this is terribly anal and insecure, but I do this once every four years (lease). Sound like a good game plan or does anyone have suggestions for improvements?
1. Install server 2003
2. Install updates
3. Make domain controller (dcpromo)
4. Make global catalog holder:
a. Open Active Directory Sites and Services
b. Expand Sites
c. Expand Default-First-Site-Name
d. Expand servers
e. Expand new server just created
f. Right-click NTDS settings and click global catalog box
5. Transfer roles: (Article ID : 255504)
a. Log on to the Server 2003-based member computer or domain controller that is located in the forest that you are assigning FSMO roles to. The logged-on user should be a member of the Domain Admin Group.
b. Click Start, click Run, type ntdsutil in the Open box, and then click OK.
c. Type roles, and then press ENTER.
d. Type connections, and then press ENTER.
e. Type connect to server servername, and then press ENTER, where servername is the name of the domain controller you want to assign the FSMO role to.
f. At the server connections prompt, type q, and then press ENTER.
g. Type transfer role, where role is the role that you want to transfer. For a list of roles that you can transfer, type ? at the fsmo maintenance prompt, and then press ENTER, or see the list of roles at the start of this article. For example, to transfer the RID master role, type transfer rid master. The one exception is for the PDC emulator role, whose syntax is transfer pdc, not transfer pdc emulator.
i. Transfer schema master
ii. Transfer domain naming master
iii. Transfer rid master
iv. Transfer pdc
v. Transfer infrastructure master
h. At the fsmo maintenance prompt, type q, and then press ENTER to gain access to the ntdsutil prompt.
i. Type q, and then press ENTER to quit the Ntdsutil utility.
6. Install DNS on new machine
7. Uninstall DNS on old machine
8. Demote old domain controller by completing the following steps:
a. Log on to the server you want to demote.
b. Click Start and then select Run.
c. Type dcpromo and then click OK. This starts the Active Directory Installation Wizard.
d. If the computer is currently a domain controller, the Active Directory Installation Wizard takes you through the process of demoting the server
9. Copy over profiles to new machine
10. To show transfers on all dcs: Netcom query fsmo
11. Turn off old machine
12. To clean up metadata
a. At the command line, type Ntdsutil and press ENTER.
b. At the Ntdsutil: prompt, type metadata cleanup and press Enter.
c. At the metadata cleanup: prompt, type connections and press Enter.
d. At the server connections: prompt, type connect to server <servername>, where <servername> is the domain controller (any functional domain controller in the same domain) from which you plan to clean up the metadata of the failed domain controller. Press Enter.
e. (Note: Windows Server 2003 Service Pack 1 eliminates the need for the above step.)
f. Type quit and press Enter to return you to the metadata cleanup: prompt.
g. Type select operation target and press Enter.
h. Type list domains and press Enter. This lists all domains in the forest with a number associated with each.
i. Type select domain <number>, where <number> is the number corresponding to the domain in which the failed server was located. Press Enter.
j. Type list sites and press Enter.
k. Type select site <number>, where <number> refers to the number of the site in which the domain controller was a member. Press Enter.
l. Type list servers in site and press Enter. This will list all servers in that site with a corresponding number.
m. Type select server <number> and press Enter, where <number> refers to the domain controller to be removed.
n. Type quit and press Enter. The Metadata cleanup menu is displayed.
o. Type remove selected server and press Enter.
p. You will receive a warning message. Read it, and if you agree, press Yes.
q. At this point, Active Directory confirms that the domain controller was removed successfully. If you receive an error that the object could not be found, Active Directory might have already removed from the domain controller.
r. Type quit, and press Enter until you return to the command prompt.
13. To remove the failed server object from the sites
a. In Active Directory Sites and Services, expand the appropriate site.
b. Delete the server object associated with the failed domain controller.
14. To remove the failed server object from the domain controllers container
a. In Active Directory Users and Computers, expand the domain controllers container.
b. Delete the computer object associated with the failed domain controller.
c. Windows Server 2003 AD might display a new type of question window, asking you if you want to delete the server object without performing a DCPROMO operation (which, of course, you cannot perform, otherwise you wouldn't be reading this article, would you...) Select "This DC is permanently offline..." and click on the Delete button.
d. AD will display another confirmation window. If you're sure that you want to delete the failed object, click Yes.
15. To remove the failed server object from DNS
a. In the DNS snap-in, expand the zone that is related to the domain from where the server has been removed.
b. Remove the CNAME record in the _msdcs.root domain of forest zone in DNS. You should also delete the HOSTNAME and other DNS records.
c. If you have reverse lookup zones, also remove the server from these zones.
16. Wait a half hour, then give new machine old server name and ip and restart.
1. Install server 2003
2. Install updates
3. Make domain controller (dcpromo)
4. Make global catalog holder:
a. Open Active Directory Sites and Services
b. Expand Sites
c. Expand Default-First-Site-Name
d. Expand servers
e. Expand new server just created
f. Right-click NTDS settings and click global catalog box
5. Transfer roles: (Article ID : 255504)
a. Log on to the Server 2003-based member computer or domain controller that is located in the forest that you are assigning FSMO roles to. The logged-on user should be a member of the Domain Admin Group.
b. Click Start, click Run, type ntdsutil in the Open box, and then click OK.
c. Type roles, and then press ENTER.
d. Type connections, and then press ENTER.
e. Type connect to server servername, and then press ENTER, where servername is the name of the domain controller you want to assign the FSMO role to.
f. At the server connections prompt, type q, and then press ENTER.
g. Type transfer role, where role is the role that you want to transfer. For a list of roles that you can transfer, type ? at the fsmo maintenance prompt, and then press ENTER, or see the list of roles at the start of this article. For example, to transfer the RID master role, type transfer rid master. The one exception is for the PDC emulator role, whose syntax is transfer pdc, not transfer pdc emulator.
i. Transfer schema master
ii. Transfer domain naming master
iii. Transfer rid master
iv. Transfer pdc
v. Transfer infrastructure master
h. At the fsmo maintenance prompt, type q, and then press ENTER to gain access to the ntdsutil prompt.
i. Type q, and then press ENTER to quit the Ntdsutil utility.
6. Install DNS on new machine
7. Uninstall DNS on old machine
8. Demote old domain controller by completing the following steps:
a. Log on to the server you want to demote.
b. Click Start and then select Run.
c. Type dcpromo and then click OK. This starts the Active Directory Installation Wizard.
d. If the computer is currently a domain controller, the Active Directory Installation Wizard takes you through the process of demoting the server
9. Copy over profiles to new machine
10. To show transfers on all dcs: Netcom query fsmo
11. Turn off old machine
12. To clean up metadata
a. At the command line, type Ntdsutil and press ENTER.
b. At the Ntdsutil: prompt, type metadata cleanup and press Enter.
c. At the metadata cleanup: prompt, type connections and press Enter.
d. At the server connections: prompt, type connect to server <servername>, where <servername> is the domain controller (any functional domain controller in the same domain) from which you plan to clean up the metadata of the failed domain controller. Press Enter.
e. (Note: Windows Server 2003 Service Pack 1 eliminates the need for the above step.)
f. Type quit and press Enter to return you to the metadata cleanup: prompt.
g. Type select operation target and press Enter.
h. Type list domains and press Enter. This lists all domains in the forest with a number associated with each.
i. Type select domain <number>, where <number> is the number corresponding to the domain in which the failed server was located. Press Enter.
j. Type list sites and press Enter.
k. Type select site <number>, where <number> refers to the number of the site in which the domain controller was a member. Press Enter.
l. Type list servers in site and press Enter. This will list all servers in that site with a corresponding number.
m. Type select server <number> and press Enter, where <number> refers to the domain controller to be removed.
n. Type quit and press Enter. The Metadata cleanup menu is displayed.
o. Type remove selected server and press Enter.
p. You will receive a warning message. Read it, and if you agree, press Yes.
q. At this point, Active Directory confirms that the domain controller was removed successfully. If you receive an error that the object could not be found, Active Directory might have already removed from the domain controller.
r. Type quit, and press Enter until you return to the command prompt.
13. To remove the failed server object from the sites
a. In Active Directory Sites and Services, expand the appropriate site.
b. Delete the server object associated with the failed domain controller.
14. To remove the failed server object from the domain controllers container
a. In Active Directory Users and Computers, expand the domain controllers container.
b. Delete the computer object associated with the failed domain controller.
c. Windows Server 2003 AD might display a new type of question window, asking you if you want to delete the server object without performing a DCPROMO operation (which, of course, you cannot perform, otherwise you wouldn't be reading this article, would you...) Select "This DC is permanently offline..." and click on the Delete button.
d. AD will display another confirmation window. If you're sure that you want to delete the failed object, click Yes.
15. To remove the failed server object from DNS
a. In the DNS snap-in, expand the zone that is related to the domain from where the server has been removed.
b. Remove the CNAME record in the _msdcs.root domain of forest zone in DNS. You should also delete the HOSTNAME and other DNS records.
c. If you have reverse lookup zones, also remove the server from these zones.
16. Wait a half hour, then give new machine old server name and ip and restart.