Upgrade to 2003 AD best practices 3

[anson9]

Upgrading AD from 2000 SP4. Questions:

- Upgrading existing 2000 DC's vs. building a new 2003 box to dcpromo and replicate to. Which is cleaner?

- Any drawbacks to upgrading directly to R2, or should I use an SP1 or older adprep and dcpromo as an intermediate step?

- I see this confusing recommendation in Microsoft's official 2000 to 2003 AD upgrade guide:

Early Microsoft documentation recommends that you isolate the schema operations master on a private network before you run adprep /forestprep. Real-world experience suggests that this step is not necessary and may cause a schema operations master to reject schema changes when it is restarted on a private network.

What is the actual best practice here?

Thanks,
Jaime

 

[FloDiggs]

We just did the same thing last year. What we did was add the new DCs to run in parallel to the old until we were sure everything was kosher. Then, we started moving roles one by one during scheduled maintenance and addressed any issues as they arose. The only real issues we had were machines and appliance that had DNS manually configured and weren't documented. Those made for pretty easy fixes. I would not try to upgrade the OS on your current DCs. I've never had a good experience with upgrades.

 

[LWComputingMVP]

I have a series of links for this (that one day, I still do hope to turn into a web page).

Here are some links that should get you going for upgrading a 2000 domain to 2003:

Common Mistakes When Upgrading a Windows 2000 Domain To a Windows 2003 Domain

http://support.microsoft.com/default.aspx?scid=kb;en-us;555040

How to upgrade Windows 2000 domain controllers to Windows Server 2003

http://support.microsoft.com/kb/325379

[If using R2 release of Windows 2003] Extending Your Active Directory Schema for New Features in Windows Server 2003 R2

http://www.microsoft.com/downloads/...03-84DD-480F-98F9-526EC09E9BA8&displaylang=en

Hotfixes to install before you run adprep /Forestprep on a Windows 2000 domain controller to prepare the Forest and domains for the addition of Windows Server 2003-based domain controllers

http://support.microsoft.com/?kbid=331161

Commodore.ca | Windows | How To Upgrade Windows 2000 Domain to Windows 2003 Server
Quote from the top of this article: "Several glossy Microsoft presenters have stated that all you need to do to complete a Windows 2003 Domain upgrade is run ADPREP and then upgrade away. This may work for very small / simple environments but it is definitely not good advice for most companies. After upgrading five servers in two unrelated domains and installing many fresh copies of 2003 I can say that I personally would not skip a single step in the process I have developed below."

http://www.commodore.ca/windows/windows_2003_upgrade.htm

Windows Server 2003 Upgrade Assistance Center

http://www.microsoft.com/windowsserver2003/upgrading/nt4/upgradeassistance/default.mspx

Here are some links that should help you in replacing existing domain controllers and/or transferring services and Active Directory functions to another/new system:

How can I transfer some or all of the FSMO Roles from one DC to another?

http://www.petri.co.il/transferring_fsmo_roles.htm

How To Create or Move a Global Catalog in Windows 2000

http://support.microsoft.com/?kbid=313994

How to move a DHCP database from a computer that is running Windows NT Server 4.0, Windows 2000, or Windows Server 2003 to a computer that is running Windows Server 2003

http://support.microsoft.com/?id=325473

How can I move a DHCP database from one server to another?

http://www.windowsitpro.com/Article/ArticleID/13473/13473.html

How can I move DNS from one Windows 2000 Server to another Windows 2000 Server?
(Two Related if going 2000 to 2003 - read both before moving)

http://www.jsifaq.com/subG/TIP3300/rh3357.htm

http://www.jsifaq.com/SUBN/tip6700/rh6731.htm

Exchange Considerations:
[If you run Exchange 2000] Windows Server 2003 adprep /forestprep Command Causes Mangled Attributes in Windows 2000 Forests That Contain Exchange 2000 Servers

http://support.microsoft.com/default.aspx?kbid=314649

-Lee

Those who ask why, learn

http://www.lwcomputing.com

 

[anson9]

Thanks for the input. We have all our FSMO roles on a single DC, any problem moving them all at the same time?

Oh, also, we have all our DC's as a global catalog (4 of them, all on a single domain). Anything horrible wrong in keeping it this way?