Professional Documents
Culture Documents
Microsoft Corporation Published: November 2009 Writer: Justin Hall Editor: Jim Becker
Abstract
This guide explains the process for upgrading Active Directory domains to Windows Server 2008 and Windows Server 2008 R2, how to upgrade the operating system of domain controllers, and how to add domain controllers that run Windows Server 2008 or Windows Server 2008 R2 to an existing domain.
Copyright Information
This document supports a preliminary release of a software product that may be changed substantially prior to final commercial release, and is the confidential and proprietary information of Microsoft Corporation. It is disclosed pursuant to a non-disclosure agreement between the recipient and Microsoft. This document is provided for informational purposes only and Microsoft makes no warranties, either express or implied, in this document. Information in this document, including URL and other Internet Web site references, is subject to change without notice. The entire risk of the use or the results from the use of this document remains with the user. Unless otherwise noted, the example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, e-mail address, logo, person, place, or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. 2009 Microsoft Corporation. All rights reserved. Active Directory, Microsoft, Windows, and Windows Server are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. All other trademarks are property of their respective owners.
Contents
Upgrading Active Directory Domains to Windows Server 2008 and Windows Server 2008 R2 AD DS Domains................................................................................................................................1 Abstract....................................................................................................................................1 Copyright Information......................................................................................................................2 Contents..........................................................................................................................................3 Upgrading Active Directory Domains to Windows Server 2008 and Windows Server 2008 R2 AD DS Domains................................................................................................................................6 About this guide...........................................................................................................................6 In this guide.................................................................................................................................6 Related information......................................................................................................................6 Overview of Upgrading Active Directory Domains...........................................................................7 Planning to Upgrade Active Directory Domains..............................................................................7 In this guide.................................................................................................................................7 Checklist: Preupgrade Tasks...........................................................................................................8 Assign Appropriate Credentials.......................................................................................................9 Introduce a Member Server That Runs Windows Server 2008 or Windows Server 2008 R2.......11 Determine Supported Software Upgrades....................................................................................12 Assess Hardware Requirements...................................................................................................14 Disk space requirements for upgrading to Windows Server 2008.............................................15 Disk space requirements for upgrading to Windows Server 2008 R2........................................16 Determine Domain Controller Upgrade Order...............................................................................19 Develop a Test Plan for Your Domain Upgrade Process...............................................................20 Determine Service Pack Levels....................................................................................................21 Back Up Domain Data...................................................................................................................23 Resolve Upgrade and Application Compatibility Problems............................................................23 Known issues for upgrading to Windows Server 2003...............................................................24 Performing the Upgrade of Active Directory Domains...................................................................25 In this guide...............................................................................................................................25
Checklist: Upgrade Tasks..............................................................................................................25 Prepare Your Infrastructure for Upgrade.......................................................................................26 Install Active Directory Domain Services on the Member Server That Runs Windows Server 2008 or Windows Server 2008 R2......................................................................................................27 Upgrade Existing Domain Controllers...........................................................................................29 Unattended upgrade .................................................................................................................30 Modify Default Security Policies....................................................................................................34 Update Group Policy Permissions................................................................................................37 Perform Clean-up Tasks................................................................................................................38 Completing the Upgrade of Active Directory Domains..................................................................38 In this guide...............................................................................................................................39 Checklist: Post-Upgrade Tasks.....................................................................................................39 Raise the Functional Levels of Domains and Forests...................................................................40 Move DNS Data into DNS Application Directory Partitions...........................................................41 Redirect Users and Computers.....................................................................................................43 Complete the Upgrade..................................................................................................................44 Finding Additional Information About Upgrading Active Directory Domains..................................45 Appendix A: Background Information for Upgrading Active Directory Domains............................46 Active Directory preparation tool................................................................................................46 Application directory partitions for DNS.....................................................................................47 Service (SRV) resource records.............................................................................................47 _msdcs.domain_name subdomain.........................................................................................48 _msdcs.forest_root_domain subdomain.................................................................................48 Intrasite replication frequency.................................................................................................49 New groups and new group memberships that are created after upgrading the PDC...............50 Security policy considerations when upgrading from Windows 2000 to Windows Server 2003. 52 SMB packet signing................................................................................................................52 Secure channel signing and encryption..................................................................................52 Microsoft Support Quick Start for Adding Windows Server 2008 or Windows Server 2008 R2 Domain Controllers to Existing Domains...................................................................................53 Whats new in AD DS in Windows Server 2008 and Windows Server 2008 R2........................53 System requirements for installing Windows Server 2008 and Windows Server 2008 R2........55 Supported in-place upgrade paths.............................................................................................56 Functional level features and requirements...............................................................................56
Client, server, and application interoperability...........................................................................57 Secure default settings in Windows Server 2008 and Windows Server 2008 R2......................57 Virtualized domain controllers on Hyper-V, VMware, and other virtualization software..........58 Administration, remote administration, and cross-version administration..................................58 Configuring the Windows Time service for Windows Server 2008 and Windows Server 2008 R2 ...............................................................................................................................................59 Known issues for upgrades to Windows Server 2008 and Windows Server 2008 R2...............61 Verifications you can make and recommended hotfixes you can install before you begin.........61 Run Adprep commands.............................................................................................................65 Add schema changes using adprep /forestprep.....................................................................65 If you are deploying RODCs, run adprep /rodcprep...............................................................66 Run adprep /domainprep /gpprep...........................................................................................67 Upgrade domain controllers.......................................................................................................67 Background information about the in-place upgrade process................................................68 Upgrading and promoting new domain controllers into an existing domain............................68 Post-installation tasks.............................................................................................................70 Fixes to install after AD DS installation...................................................................................70 Troubleshooting errors...............................................................................................................71 Adprep errors.........................................................................................................................71 Forestprep errors................................................................................................................71 Domainprep errors..............................................................................................................72 Rodcprep errors..................................................................................................................72 Dcpromo errors......................................................................................................................72
Upgrading Active Directory Domains to Windows Server 2008 and Windows Server 2008 R2 AD DS Domains
Upgrading your network operating system requires minimal network configuration and typically has a low impact on user operations. The upgrade process is straightforward, efficient, and allows your organization to take advantage of the improved security that is offered by the Windows Server 2008 and Windows Server 2008 R2 operating systems.
In this guide
Overview of Upgrading Active Directory Domains Planning to Upgrade Active Directory Domains Performing the Upgrade of Active Directory Domains Completing the Upgrade of Active Directory Domains Finding Additional Information About Upgrading Active Directory Domains Appendix A: Background Information for Upgrading Active Directory Domains
Microsoft Support Quick Start for Adding Windows Server 2008 or Windows Server 2008 R2 Domain Controllers to Existing Domains
Related information
For more information about the AD DS logical structure and the Domain Name System (DNS) infrastructure that is necessary to support AD DS, see Designing the Logical Structure for Windows Server 2008 AD DS [LH]. For more information about AD DS functional levels, see Enabling Advanced Features for AD DS. For more information about installing and configuring a DNS server, see Deploying Domain Name System (DNS) (http://go.microsoft.com/fwlink/?LinkId=93656).
In this guide
Checklist: Preupgrade Tasks Assign Appropriate Credentials Introduce a Member Server That Runs Windows Server 2008 or Windows Server 2008 R2 Determine Supported Software Upgrades Assess Hardware Requirements Determine Domain Controller Upgrade Order Develop a Test Plan for Your Domain Upgrade Process Determine Service Pack Levels Back Up Domain Data
7
Assign appropriate credentials to Assign Appropriate the users who are responsible for Credentials preparing the forest and domain for an Active Directory upgrade. Introduce a newly installed member Introduce a Member Server server into the forest. That Runs Windows Server 2008 or Windows Server 2008 R2 Identify the editions of Determine Supported Windows 2000 or Software Upgrades Windows Server 2003 that are running in your environment. Then determine if you can upgrade these editions or if you must perform a complete reinstallation for each. Review and document the existing hardware configuration of each domain controller that you plan to upgrade. Determine the order in which you will upgrade your domain controllers before you begin the domain upgrade process. Develop a test plan for your domain upgrade process. Determine service pack levels. Back up your Windows 2000 or Windows Server 2003 domain data Assess Hardware Requirements
Develop a Test Plan for Your Domain Upgrade Process Determine Service Pack Levels Back Up Domain Data
8
Task
Reference
before you begin the upgrade. Resolve upgrade and application compatibility problems. Resolve Upgrade and Application Compatibility Problems
Enterprise Admins in forest root domain Domain Admins in forest root domain Builtin\Administrators in forest root domain Domain Admins in
9
Credential
regional domain Builtin\Administrators in regional domain You also need to ensure that the administrator who is upgrading the domain controllers has the following rights: Backup files and directories (SE_BACKUP_NAME) Modify firmware environment values (SE_SYSTEM_ENVIRONMENT_NAME) Restore files and directories (SE_RESTORE_NAME) Shut down the system (SE_SHUTDOWN_NAME)
The setup program cannot run properly if these rights are not defined or if they are disabled by a domain Group Policy setting on the computer. Membership in the local Administrator account, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477. To verify if user rights assignments are disabled by a domain Group Policy setting 1. In the Run dialog box, type mmc, and then click OK. 2. Click File, and then click Add/Remove snap-in. 3. In the Available snap-ins dialog box, select Group Policy Management Editor, and then click Add. 4. On the Welcome to the Group Policy Wizard page, verify that Local Computer appears in the Group Policy Object box, and then click Finish. 5. In the console tree, navigate to the Local Computer Policy\Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment folder. 6. In the details pane, verify that the user who will perform the upgrade is a member in one of the groups that has the necessary rights assigned. The policies are named identically to the user rights listed above. Assign the appropriate credentials in advance to allow both Active Directory domain upgrade testing and deployment to proceed without unexpected security delays.
10
Introduce a Member Server That Runs Windows Server 2008 or Windows Server 2008 R2
You can upgrade your Active Directory environment in the following ways: Introduce newly installed domain controllers that run Windows Server 2008 or Windows Server 2008 R2 into the forest, and then retire or upgrade all existing domain controllers. Perform an in-place upgrade of all existing domain controllers. Important If you want to upgrade the operating system of a Windows 2000 domain controller to Windows Server 2008, you must first perform an in-place upgrade of a Windows 2000 operating system to a Windows Server 2003 operating system. Then, perform an in-place upgrade of this Windows Server 2003 operating system to a Windows Server 2008 operating system. A direct Windows 2000to Windows Server 2008 operating system upgrade is not supported. The information in this guide also applies to Windows Server 2008 R2. If you perform an inplace upgrade of the existing domain controllers running Windows Server 2003 in the forest to Windows Server 2008 R2, remember that Windows Server 2008 R2 is an x64-based operating system. If your server is running an x64-based version of Windows Server 2003, you can successfully perform an in-place upgrade of this computer's operating system to Windows Server 2008 R2. If your server is running an x86-based version of Windows Server 2003, you cannot upgrade this computer to Windows Server 2008 R2. Use the following procedure to introduce a member server that runs Windows Server 2008 or Windows Server 2008 R2 into your environment. Membership in the local Administrator account, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477. To install Windows Server 2008 or Windows Server 2008 R2 1. Insert the operating system DVD into the DVD drive, and then select the option to install the operating system. As an alternative, you can use an unattended installation method. 2. Use the NTFS file system to format the partitions. Enter the computer name, static IP address, and subnet mask that are specified by your design. Enter a strong administrator password. 3. Enable Remote Desktop to enable administrators to log on remotely, if necessary. To enable Remote Desktop, in Server Manager, click Configure Remote Desktop, and then click Allow connections from computers running any version of Remote
11
Desktop (less secure) or Allow connections only from computers running Remote Desktop with Network Level Authentication (more secure). You can introduce this member server to any domain in the forest. However, if your forest root domain is a dedicated root, introduce the member server into the forest root domain. Placing this member server into a dedicated root domain has the lowest impact on your environment because users generally do not log on to a dedicated forest root domain. Therefore, user authentications are minimal. After you prepare your forest and domains for the upgrade (see Prepare Your Infrastructure for Upgrade), install AD DS on the new member server (see Install Active Directory Domain Services on the Member Server That Runs Windows Server 2008 or Windows Server 2008 R2).
Windows 2000 Professional Windows 2000 Server Windows 2000 Advanced Server Windows 2000 Datacenter Server
12
The following table lists Windows Server 2003 editions and indicates what editions can be upgraded directly to each edition of Windows Server 2008. Notes With the exception of Windows Server 2008 editions for Itanium-Based Systems, this table applies equally to 32-bit and 64-bit Windows Server 2008 editions. However, upgrades from 32-bit to 64-bit (and from 64-bit to 32-bit) are not supported. The information in this guide also applies to Windows Server 2008 R2. If you perform an in-place upgrade of the existing domain controllers running Windows Server 2003 in the forest to Windows Server 2008 R2, remember that Windows Server 2008 R2 is an x64based operating system. If your server is running an x64-based version of Windows Server 2003, you can successfully perform an in-place upgrade of this computer's operating system to Windows Server 2008 R2. If your server is running an x86-based version of Windows Server 2003, you cannot upgrade this computer to Windows Server 2008 R2. For more information about supported upgrade options, see Supported in-place upgrade paths.
13
Windows Server 2003 Standard Edition with Service Pack 1 (SP1) Windows Server 2003 Standard Edition with Service Pack 2 (SP2) Windows Server 2003 R2 Standard Edition Windows Server 2003 Enterprise Edition with SP1 Windows Server 2003 Enterprise Edition with SP2 Windows Server 2003 R2 Enterprise Edition Windows Server 2003 Datacenter Edition with SP1 Windows Server 2003 Datacenter Edition with SP2 Windows Server 2003 R2 Datacenter Edition
do not meet the necessary hardware requirements to serve as rollback servers if you must roll back your deployment. In most cases, a Windows 2000based domain controller meets the requirements to be upgraded to Windows Server 2008 as long as it has adequate disk space. At minimum, a domain controller requires available free disk space for the Active Directory Domain Services (AD DS) database, AD DS log files, SYSVOL, and the operating system. Use the following guidelines to determine how much disk space to allot for your AD DS installation: On the drive that will contain the AD DS database, NTDS.dit, provide 0.4 gigabytes (GB) of storage for each 1,000 users. For example, for a forest with two domains (domain A and domain B) with 10,000 users and 5,000 users, respectively, provide a minimum of 4 GB of disk space for each domain controller that hosts domain A and provide a minimum of 2 GB of disk space for each domain controller that hosts domain B. Available space must equal at least 10 percent of your existing database size or at least 250 megabytes (MB), whichever is greater. On the drive containing the AD DS log files, provide at least 500 MB of available space. On the drive containing the SYSVOL shared folder, provide at least 500 MB of available space. On the drive containing the operating system files, to run setup, provide at least 1.25 GB to 2 GB of available space.
The free space on the %WinDir% volume must be equal or greater than the current size of the resources listed above and their subordinate folders when they are located on the %WinDir% volume. By default, Dcpromo.exe places the Active Directory database and log files under %Windir%, in which case, their size is included in the free disk space requirements for the %Windir% folder. For example, suppose that you have the following resources located on the %WinDir% volume, with the sizes listed in the following table.
15
Resource
Size
Application Data (%AppData%) Program Files (%ProgramFiles%) Users Data (%SystemDrive%\Documents and Settings) Windows Directory (%WinDir%) Total size
In this example, the free space on the %WinDir% volume must be equal to 1.25 GB or greater. However, if the Active Directory database is hosted outside any of the folders above, then the hosting volume or volumes must only contain additional free space equal to at least 10 percent of the current database size or 250 MB, whichever is greater. Finally, the free space on the volume that hosts the log files must be at least 50 MB. A default installation of Active Directory in Windows Server 2003 has the Active Directory database and log files under %WinDir%\NTDS. With this configuration, the Ntds.dit database file and all the log files are temporarily copied over to the quarantine location and then copied back to their original location; this is why additional free space is required for those resources. Although the SYSVOL directory is also under %WinDir% (that is, %WinDir%\SYSVOL), it is moved and not copied. Therefore, it does not require any additional free space. After the upgrade, the space that was reserved for the copied resources will be returned to the file system.
The Active Directory Recycle Bin Windows Server 2008 R2 preserves attributes on deleted objects for the Recycle object lifetime. For Active Directory Recycle Bin, the database increases in size at the following moments: After Windows Server 2008 R2 adprep /forestprep completes and the first Windows Server 2008 R2 domain controller is installed, there is a new indexed attribute, isRecycled, whose value is set for all deleted objects. After the Active Directory Recycle Bin is enabled, all attributes are kept on deleted objects. More disk space is required as more object deletions occur. In a production Windows Server 2008 R2 domain at Microsoft, the Active Directory Recycle Bin feature increased the size of the AD DS database by an additional 15 to 20 percent of the
16
original database size, using the default deletedObjectLifetime and recycledObjectLifetime values of 180 days. Additional space requirements depend on the size and count of the objects that are recycled. An in-place upgrade of a domain controller to Windows Server 2008 R2 requires sufficient disk space for the upgrade process to copy the following folders: %SystemRoot% %ProgramFiles% %SystemDrive%\Program Files %ProgramFiles(x86)% %SystemDrive%\build %SystemDrive%\InstalledRepository %ProfilesFolder% %ProgramData% %SystemDrive%\Documents and Settings
The following table shows the test results for an upgrade of a domain controller from Windows Server 2008 to Windows Server 2008 R2. In this table: <i> = 15 GB (the minimum amount of free space on a Windows hard drive that Windows setup requires) The original size of Ntds.dit was 5 GB.
Free space (GB) on the system drive Result
Ntds.dit location
Ntds.dit is located on the same drive as the system, but it is out of %windir%.
In this scenario, Ntds.dit does not have to be copied from the Windows.old folder to the Windows folder, but there is not enough space to copy Windows setup files. The compatibility report finds there is not enough space to copy Windows files. The upgrade is blocked at the compatibility report.
<i>
In this scenario, the disk meets the minimum free-space requirements for the Windows files to be installed, and Ntds.dit does not have to be copied from the Windows.old folder to the Windows folder. The compatibility report warns the user that the amount of free space meets the minimum requirements and that the upgrade process would take longer.
17
Ntds.dit location
Result
The domain controller is upgraded successfully. Ntds.dit is located on the default folder: %windir%\ntds\ <i> + 1 In this scenario, the disk meets the minimum free-space requirements for the Windows Files to be installed, which causes the compatibility report to be bypassed. However, Ntds.dit is located under the Windows folder, which causes the upgrade to copy it from the Windows.old folder to the Windows folder. This last step fails because there is not enough space on the disk to fit Ntds.dit because the database was not copied to the new operating system. On its first start, Windows Server 2008 R2 is not able to locate Ntds.dit, which causes an error and forces the computer to roll back to the previous operating system. ERROR_CODE: (NTSTATUS) 0xc00002ec Directory Services could not start because of the following error: %hs Error Status: 0x %x. Click OK to shut down the system. You can use the recovery console to diagnose the system further. Err 0xc00002ec = STATUS_DS_INIT_FAILURE_CONSOLE The domain controller is rolled back to Windows Server 2008 successfully. Ntds.dit is located on the same drive as the system, but it is out of %windir%. <i> In this scenario, the disk meets the minimum free-space requirements for the Windows Files to be installed, and Ntds.dit does not have to be copied from the Windows.old folder to the Windows folder. The compatibility report warns the user that the amount of free space meets the minimum requirements and that the upgrade process would take longer. The domain controller is upgraded successfully.
18
19
Repadmin.exe
Checks replication %systemroot%\Windows\System32 consistency and Note monitors both inbound This tool is added to the server as part and outbound of the AD DS installation. replication partners. Displays replication status of inbound replication partners and directory partitions. Diagnoses the state of domain controllers in a forest or enterprise, tests for successful Active Directory connectivity and functionality, and returns the results as passed or failed. Queries and checks the status of trusts and can forcibly shut down domain controllers. Provides domain controller location capabilities. %systemroot%\Windows\System32 Note This tool is added to the server as part of the AD DS installation.
Dcdiag.exe
Nltest.exe
%systemroot%\Windows\System32 Note This tool is added to the server as part of the AD DS installation.
Dnscmd.exe
Provides the properties %systemroot%\Windows\System32 of Domain Name Note System (DNS) servers, This tool is added to the server as part zones, and resource
20
Tool/log file
Description
Location
records. Adprep.log Provides a detailed progress report of the forest and domain preparation process. Provides a detailed progress report of the Active Directory installation. Includes information regarding replication and services in addition to applicable error messages. A Microsoft Management Console (MMC) snap-in that acts as a low-level editor for AD DS and allows you to view, add, delete, and move objects and attributes within the directory.
%systemroot%\Windows\debug Note These logs are added to the server as part of the AD DS installation.
Adsiedit.exe
%systemroot%\Windows\System32 Note This tool is added to the server as part of the AD DS installation.
For more information about support tools for Windows, see Help and Support for Windows Server 2008.
21
To determine the operating system and service pack revision level on all domain controllers For each domain in the forest, type the following command at the command line of a computer that has the support tools for Windows Server 2008 installed, and then press ENTER: repadmin /showattr <domain_controller_in_target_domain> ncobj:domain: /filter:"(&(objectcategory=computer)(primaryGroupID=516)) /subtree /atts:operatingSystem,operatingSystemVersion,operatingSystemServicePack The following text is sample output from this command:
DN: CN=NA-DC-01,OU=Domain Controllers,DC=company,DC=com 1> operatingSystem: Windows Server 2008 Standard 1> operatingSystemVersion: 6.0 (6001) 1> operatingSystemServicePack: Service Pack 1, v.624
Note The repadmin /showattr command does not show any hotfixes that might be installed on a domain controller.
Parameter Description
repadmin /showattr
Displays the attributes on an object. Specifies the fully qualified domain name (FQDN) of the domain controller.
domain_controller_in_target_domain
/filter:"(&(objectcategory=computer)(primaryGroupID=516)) /subtree Filters the output /atts:operatingSystem,operatingSystemVersion,operatingSystemServicePack to display the object's operating system, operating system version, and operating system service pack. Upgrade domain controllers to the appropriate service pack as necessary.
22
23
This error occurs because Windows Server 2003 creates machine account objects differently from Windows 2000. To prevent this error from occurring when creating machine accounts, configure the Windows 2000based Windows Deployment Services servers in your environment to point to a domain controller running Windows 2000. This is done by adding the DefaultServer registry parameter to the Windows 2000based Windows Deployment Services servers. For more information about configuring optional registry parameters for the Boot Information Negotiation Layer (BINL) service, see article 235979 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkId=106488). You must remove the Windows 2000 Administration Tools Pack before upgrading to Windows Server 2003. For more information about Windows 2000 administration tools and upgrade issues, see article 304718 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkId=106490). Membership in the local Administrator account, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477. To identify potential upgrade and compatibility problems At the command line, connect to the I386 directory at your installation source, type the following command, and then press ENTER:
24
winnt32 /checkupgradeonly
Parameter Description
winnt32 /checkupgradeonly
Checks your computer for upgrade compatibility with products in the Windows Server 2003 family.
In this guide
Checklist: Upgrade Tasks Prepare Your Infrastructure for Upgrade Install Active Directory Domain Services on the Member Server That Runs Windows Server 2008 or Windows Server 2008 R2 Upgrade Existing Domain Controllers Modify Default Security Policies Update Group Policy Permissions Perform Clean-up Tasks
Prepare your Active Directory infrastructure for upgrade. Install Active Directory Domain Services (AD DS) on a member server that runs Windows
Prepare Your Infrastructure for Upgrade Install Active Directory Domain Services on the Member Server That Runs
25
Task
Reference
Server 2008 or Windows Server 2008 R2 in the forest root domain. Upgrade existing domain controllers. Modify default security policies as needed. Update Group Policy permissions. Note This step is required only if you are upgrading Windows 2000 Active Directory domains. Perform clean-up tasks.
Windows Server 2008 or Windows Server 2008 R2 Upgrade Existing Domain Controllers Modify Default Security Policies Update Group Policy Permissions
26
Install Active Directory Domain Services on the Member Server That Runs Windows Server 2008 or Windows Server 2008 R2
Install Active Directory Domain Services (AD DS) on a member server that runs Windows Server 2008 or Windows Server 2008 R2 by using the Active Directory Domain Services Installation Wizard (Dcpromo.exe). The member server should be located in the forest root domain. After you install AD DS successfully, the member server will become a domain controller. You can install AD DS on any member server that meets the domain controller hardware requirements. You can install AD DS using the Windows user interface (UI). The Windows UI provides two wizards that guide you through the installation process for AD DS. One wizard is the Add Roles Wizard, which you can access in Server Manager. The other wizard is the Active Directory Domain Services Installation Wizard (Dcpromo.exe), which you can access in either of the following ways: When you complete the steps in the Add Roles Wizard, click the link to start the Active Directory Domain Services Installation Wizard. Click Start, click Run, type dcpromo.exe, and then click OK. Membership in the local Administrator account, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477. Depending on the operating system installation options that you selected for the computer, the local Administrator password might be blank or it might not be required. In this case, run the following command at a command prompt before you start to install AD DS: net user Administrator password/passwordreq:yes Replace password with a strong password. To install AD DS on a member server by using the Windows interface 1. Click Start, and then click Server Manager. 2. In Roles Summary, click Add Roles. 3. If necessary, review the information on the Before You Begin page, and then click Next. 4. On the Select Server Roles page, select the Active Directory Domain Services check box, and then click Next. 5. If necessary, review the information on the Active Directory Domain Services page, and then click Next. 6. On the Confirm Installation Selections page, click Install. 7. On the Installation Results page, click Close this wizard and launch the Active Directory Domain Services Installation Wizard (dcpromo.exe).
27
8. On the Welcome to the Active Directory Domain Services Installation Wizard page, click Next. If you want to install from media, identify the source domain controller for AD DS replication, or specify the Password Replication Policy (PRP) for an RODC as part of the installation of the additional domain controller, click Use advanced mode installation. 9. On the Operating System Compatibility page, review the warning about the default security settings for Windows Server 2008 domain controllers, and then click Next. 10. On the Choose a Deployment Configuration page, click Existing forest, click Add a domain controller to an existing domain, and then click Next. 11. On the Network Credentials page, type the name of any existing domain in the forest where you plan to install the additional domain controller. Under Specify the account credentials to use to perform the installation, click My current logged on credentials or click Alternate credentials, and then click Set. In the Windows Security dialog box, provide the user name and password for an account that can install the additional domain controller. To install an additional domain controller, you must be a member of the Enterprise Admins group or the Domain Admins group. When you are finished providing credentials, click Next. 12. On the Select a Domain page, select the domain of the new domain controller, and then click Next. 13. On the Select a Site page, select a site from the list or select the option to install the domain controller in the site that corresponds to its IP address, and then click Next. 14. On the Additional Domain Controller Options page, make the following selections, and then click Next: DNS server: This option is selected by default so that your domain controller can function as a DNS server. If you do not want the domain controller to be a DNS server, clear this option. Note If you select the option to install DNS server, you might receive a message that indicates that a DNS delegation for the DNS server could not be created and that you should manually create a DNS delegation to the DNS server to ensure reliable name resolution. If you are installing an additional domain controller in either the forest root domain or a tree root domain, you do not have to create the DNS delegation. In this case, click Yes and disregard the message. Global Catalog: This option is selected by default. It adds the global catalog, read-only directory partitions to the domain controller, and it enables global catalog search functionality. Read-only domain controller. This option is not selected by default. It makes the additional domain controller read only. 15. If you selected Use advanced mode installation on the Welcome page, the Install from Media page appears. You can provide the location of installation media to be used
28
to create the domain controller and configure AD DS, or you can have all the replication done over the network. Note that some data will be replicated over the network even if you install from media. For information about using this method to install the domain controller, see Installing AD DS From Media. 16. If you selected Use advanced mode installation on the Welcome page, the Source Domain Controller page appears. Click Let the wizard choose an appropriate domain controller or click Use this specific domain controller to specify a domain controller that you want to provide as a source for replication to create the new domain controller, and then click Next. If you do not choose to install from media, all data will be replicated from this source domain controller. 17. On the Location for Database, Log Files, and SYSVOL page, type or browse to the volume and folder locations for the database file, the directory service log files, and the system volume (SYSVOL) files, and then click Next. Windows Server Backup backs up the directory service by volume. For backup and recovery efficiency, store these files on separate volumes that do not contain applications or other nondirectory files. 18. On the Directory Services Restore Mode Administrator Password page, type and confirm the restore mode password, and then click Next. This password must be used to start AD DS in Directory Service Restore Mode (DSRM) for tasks that must be performed offline. 19. On the Summary page, review your selections. Click Back to change any selections, if necessary. To save the settings that you have selected to an answer file that you can use to automate subsequent Active Directory operations, click Export settings. Type the name for your answer file, and then click Save. When you are sure that your selections are accurate, click Next to install AD DS. 20. On the Completing the Active Directory Domain Services Installation Wizard page, click Finish. 21. You can either select the Reboot on completion check box to have the server restart automatically or you can restart the server to complete the AD DS installation when you are prompted to do so. For information about installing AD DS by using a command line or an answer file, see Installing an Additional Domain Controller.
Important If you want to upgrade the operating system of a Windows 2000 domain controller to Windows Server 2008, you must first perform an in-place upgrade of a Windows 2000 operating system to a Windows Server 2003 operating system. Then, perform an in-place upgrade of this Windows Server 2003 operating system to a Windows Server 2008 operating system. A direct Windows 2000toWindows Server 2008 operating system upgrade is not supported. Important The information in this guide also applies to Windows Server 2008 R2. If you want to perform an in-place upgrade of the existing domain controllers running Windows Server 2003 in the forest to Windows Server 2008 R2, remember that Windows Server 2008 R2 is an x64-based operating system. If your server is running an x64-based version of Windows Server 2003, you can successfully perform an in-place upgrade of this computer's operating system to Windows Server 2008 R2. If your server is running an x86-based version of Windows Server 2003, you cannot upgrade this computer to Windows Server 2008 R2. To initiate the installation of the Windows Server 2003 operating system on a Windows 2000 based domain controller, insert the Windows Server 2003 operating system CD on the domain controller. Or, if the Windows Server 2003 media are shared over the network, run the Winnt32.exe command-line tool. You can also perform an unattended installation of Windows Server 2003. Instructions for creating an answer file for an Active Directory installation are located in the Deploy.cab file in the Support\Tools folder on the Windows Server 2003 operating system CD. Inside the Deploy.cab file, open Ref.chm to access the Unattend.txt file. Expand Unattend.txt in the left pane, and then click DCInstall. To initiate the installation of the Windows Server 2008 or Windows Server 2008 R2 operating system on a Windows Server 2003based domain controller, insert the operating system DVD on the domain controller. Or, if the operating system installation media are shared over the network, run the Setup.exe command-line tool.
Unattended upgrade
You can also perform an unattended upgrade by using an answer file. For more information about how to create a new answer file, see "Step 2: Building an Answer File" in the Windows Vista Deployment Step-by-Step Guide (http://go.microsoft.com/fwlink/?LinkID=66066). Here is a sample of an answer file that can be used to perform an unattended upgrade to Windows Server 2008:
<?xml version='1.0' encoding='utf-8'?> <unattend xmlns="urn:schemas-microsoft-com:unattend" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State"> <settings pass="specialize" wasPassProcessed="true"> 30
<component name="Microsoft-Windows-Shell-Setup" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" processorArchitecture="amd64"> <ComputerName>Machine Name</ComputerName> </component> </settings> <settings pass="windowsPE" wasPassProcessed="true"> <component name="Microsoft-Windows-Setup" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" processorArchitecture="amd64"> <UserData> <ProductKey>Product-Key</ProductKey> <AcceptEula>True</AcceptEula> <FullName>User Name</FullName> <Organization>Organization Name</Organization> </UserData> <ImageInstall> <OSImage> <WillShowUI>Never</WillShowUI> <InstallTo> <DiskID>0</DiskID> <PartitionID>1</PartitionID> </InstallTo> <InstallFrom> <MetaData> <Key>Image/Name</Key> <Value>W2K8S</Value> </MetaData> </InstallFrom> </OSImage> </ImageInstall> <DiskConfiguration> <WillShowUI>Never</WillShowUI> <Disk> <DiskID>0</DiskID> <WillWipeDisk>False</WillWipeDisk> <ModifyPartitions> 31
<ModifyPartition> <Order>1</Order> <PartitionID>1</PartitionID> <Letter>C</Letter> <Active>True</Active> </ModifyPartition> </ModifyPartitions> </Disk> </DiskConfiguration> <UpgradeData> <Upgrade>True</Upgrade> </UpgradeData> <Diagnostics> <OptIn>True</OptIn> </Diagnostics> </component> <component name="Microsoft-Windows-International-Core-WinPE" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" processorArchitecture="amd64"> <UILanguage>EN-US</UILanguage> </component> </settings> <settings pass="oobeSystem" wasPassProcessed="true"> <component name="Microsoft-Windows-Shell-Setup" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" processorArchitecture="amd64"> <UserAccounts> <DomainAccounts> <DomainAccountList> <Domain>Domain Name</Domain> <DomainAccount> <Name>Administrator</Name> <Group>Administrators</Group> </DomainAccount> </DomainAccountList> </DomainAccounts> 32
</UserAccounts> <AutoLogon> <Enabled>True</Enabled> <Domain>Domain Name</Domain> <Username>User Name</Username> <Password>User Password</Password> <LogonCount>9999</LogonCount> </AutoLogon> <FirstLogonCommands> <SynchronousCommand> <Order>1</Order> <CommandLine>Command To Execute</CommandLine> <Description>"RunOnceItem0"</Description> </SynchronousCommand> <SynchronousCommand> <Order>2</Order> <CommandLine>Command To Execute</CommandLine> <Description>"Post Install Command Execute"</Description> </SynchronousCommand> </FirstLogonCommands> <OOBE> <SkipMachineOOBE>True</SkipMachineOOBE> <SkipUserOOBE>True</SkipUserOOBE> </OOBE> </component> </settings> </unattend>
After you create the answer file, use the following procedure to perform an unattended upgrade of a Windows Server 2003based domain controller. Membership in the local Administrator account, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477. Depending on the operating system installation options that you selected for the computer, the local Administrator password might be blank or it might not be required. In this case, run the following command at a command prompt before you start to install AD DS: net user Administrator password/passwordreq:yes
33
Replace password with a strong password. To perform an in-place domain controller upgrade by using an answer file 1. At the command prompt, type the following: setup.exe /unattend:"path to the answer file" 2. Press ENTER.
Back up the Default Domain Controllers Policy Group Policy object (GPO) before you modify it. Use the Group Policy Management Console (GPMC) to back up the GPO so that it can be restored, if necessary. Membership in Domain Admins or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477.
34
To disable SMB packet signing enforcement based domain controllers 1. To open GPMC, click Start, click Run, type gpmc.msc, and then click OK. 2. In the console tree, right-click Default Domain Controllers Policy in Domains\Current Domain Name\Group Policy objects\Default Domain Controllers Policy, and then click Edit. 3. In the Group Policy Management Editor window, in the console tree, go to Computer Configuration/Policies/Windows Settings/Security Settings/Local Policies/Security Options. 4. In the details pane, double-click Microsoft network server: Digitally sign communications (always). 5. Verify that the Define this policy setting check box is selected, click Disabled to prevent SMB packet signing from being required, and then click OK. To apply the Group Policy change immediately, either restart the domain controller or open a command prompt, type the following command, and then press ENTER:
gpupdate /force
Note Modifying these settings in the Domain Controllers container will change the Default Domain Controllers Policy. Policy changes that you make here will be replicated to all other domain controllers in the domain. Therefore, you only have to modify these policies one time to affect the Default Domain Controllers Policy on all domain controllers. Membership in Domain Admins or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477. To disable secure channel signing enforcement on domain controllers 1. To open GPMC, click Start, click Run, type gpmc.msc, and then click OK. 2. In the console tree, right-click Default Domain Controllers Policy in Domains/Current Domain Name/Group Policy objects/Default Domain Controllers Policy, and then click Edit. 3. In the Group Policy Management Editor window, in the console tree, go to Computer Configuration/Policies/Windows Settings/Security Settings/Local Policies/Security Options. 4. In the details pane, double-click Domain member: Digitally encrypt or sign secure channel data (always), click Disabled to prevent secure channel signing from being required, and then click OK. To apply the Group Policy change immediately, either restart the domain controller or open a command prompt, type the following command, and then press ENTER:
35
gpupdate /force
Note Modifying these settings in the Domain Controllers container will change the Default Domain Controllers Policy. Policy changes that you make here will be replicated to all other domain controllers in the domain. Therefore, you only have to modify these policies one time to affect the Default Domain Controllers Policy on all domain controllers. For more information about SMB packet signing and secure channel signing, see Appendix A: Background Information for Upgrading Active Directory Domains. By default, domain controllers that run Windows Server 2008 and Windows Server 2008 R2 also prohibit clients running non-Microsoft operating systems or Windows NT 4.0 operating systems to establish security channels using weak Windows NT 4.0 style cryptography algorithms. Any security channel dependent operation that is initiated by clients running older versions of the Windows operating system or non-Microsoft operating systems that do not support strong cryptographic algorithms will fail against a Windows Server 2008-based domain controller. Until you are able to upgrade all of the clients in your infrastructure, you can temporarily relax this requirement by modifying the following default domain policy setting on your domain controllers: Allow cryptography algorithms compatible with Windows NT 4.0 Membership in Domain Admins or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477. To allow cryptography algorithms that are compatible with Windows NT 4.0 1. To open GPMC, click Start, click Run, type gpmc.msc, and then click OK. 2. In the console tree, right-click Default Domain Controllers Policy in Domains/Current Domain Name/Group Policy objects/Default Domain Controllers Policy, and then click Edit. 3. In the Group Policy Management Editor window, in the console tree, go to Computer Configuration/Administrative Templates: Policy definitions (ADMX files) retrieved from the local machine/System/Net Logon. 4. In the details pane, double-click Allow cryptography algorithms compatible with Windows NT 4.0, and then click Enabled. Note By default, the Not Configured option is selected, but, programmatically, after you upgrade a server to Windows Server 2008 domain controller status, this policy is set to Disabled. To apply the Group Policy change immediately, either restart the domain controller or open command line, type the following command, and then press ENTER:
gpupdate /force
36
Note Modifying these settings in the Domain Controllers container will change the Default Domain Controllers Policy. Policy changes that are made here will be replicated to all other domain controllers in the domain. Therefore, you only have to modify these policies one time to affect the Default Domain Controllers Policy on all domain controllers. For more information, see Effects of netlogon cryptographic support changes in Windows Server 2008 (http://go.microsoft.com/fwlink/?LinkId=106380). For more information about additional security policy changes in Windows 7 and Windows Server 2008 R2, see Secure default settings in Windows Server 2008 and Windows Server 2008 R2.
cd /d %programfiles%\Microsoft Group Policy\GPMC Sample Scripts 2. Type the following, and then press ENTER: Cscript GrantPermissionOnAllGPOs.wsf Enterprise Domain Controllers /permission:read /domain:DNSDomainName /Replace Using the Replace switch removes existing permissions for the group or user before making the change. If a group or user is already granted a permission type that is higher than the new permission type, and you do not specify Replace, no change is made.
In this guide
Checklist: Post-Upgrade Tasks Raise the Functional Levels of Domains and Forests Move DNS Data into DNS Application Directory Partitions Redirect Users and Computers Complete the Upgrade
Raise the functional levels of domains and forests to enable all advanced features of Active Directory Domain Services (AD DS). Move Domain Name System (DNS) zones into DNS application directory partitions. Note This step is optional. If you are upgrading Windows Server 2003 Active Directory domains, your DNS zones have already been stored in the DNS application directory partitions. However, if you are upgrading Windows 2000 Active Directory domains, you might choose to move your DNS zones into the newly created DNS application directory partitions. Redirect users and computers to organizational units (OUs). Note
Raise the Functional Levels of Domains and Forests Move DNS Data into DNS Application Directory Partitions
39
Task
Reference
The procedures described in this section are required only if you are upgrading Windows 2000 Active Directory domains. A Windows Server 2003 Active Directory domain OU structure will remain the same after the upgrade is complete. Complete the upgrade. Complete the Upgrade
40
Membership in Domain Admins or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477. To raise the forest functional level 1. Open the Active Directory Domains and Trusts snap-in. Click Start, click Administrative Tools, and then click Active Directory Domains and Trusts. 2. In the console tree, right-click Active Directory Domains and Trusts, and then click Raise Forest Functional Level. 3. In Select an available forest functional level, do one of the following: To raise the forest functional level to Windows Server 2003, click Windows Server 2003, and then click Raise. To raise the forest functional level to Windows Server 2008, click Windows Server 2008, and then click Raise. To raise the forest functional level to Windows Server 2008 R2, click Windows Server 2008 R2, and then click Raise. For more information about Windows Server 2008 advanced AD DS features, see Enabling Advanced Features for AD DS.
Important Before you attempt to move DNS data to an application directory partition, make sure that the domain naming operations master is hosted on at least a Windows Server 2003 based version domain controller. If the _msdcs.forest_root_domain zone is not present as a separate zone on your DNS server, you do not need to perform this procedure because the DNS data that is stored in the _msdcs.forest_root_domain is moved with the forest root domain zone to the domain-wide application directory partition, DomainDnsZones. Note For more information about DNS and application directory partitions, see Appendix A: Background Information for Upgrading Active Directory Domains. Membership in Domain Admins or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477. To change the replication scope of the domain-wide DNS zone by using a DNS application directory partition 1. On a domain controller that hosts a DNS server in a particular domain, click Start, click Administrative Tools, and then click DNS to open the DNS Manager. 2. Right-click the DNS zone that uses the fully qualified domain name (FQDN) of the Active Directory domain, and then click Properties. 3. Click the Change button next to Replication: All DNS servers in this domain. 4. Click To all DNS servers in this domain:<domain_name>, and then click OK. Membership in Domain Admins or Enterprise Admins, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at http://go.microsoft.com/fwlink/?LinkId=83477. To change the replication scope of the _msdcs.forest_root_domain DNS zone by using a DNS application directory partition 1. On a domain controller that hosts a DNS server in the forest root domain, click Start, click Administrative Tools, and then click DNS to open DNS Manager. 2. Right-click the _msdcs.<forest_root_domain> DNS zone, and then click Properties. 3. Click the Change button next to Replication: All DNS servers in this forest. 4. Click To all DNS servers in this forest:<forest_name>, and then click OK. For more information, see Deploying Domain Name System (DNS) (http://go.microsoft.com/fwlink/?LinkId=93656).
42
c.
d. Type the name of the OU. 2. At the command line, change to the System32 folder by typing: cd %systemroot%\system32 3. Type the following, where <newuserou> is the name of the new user OU, and <domainname> is the name of the domain: redirusr ou=<newuserou>,DC=<domainname>,dc=com To redirect the CN=Computers container 1. Use the Active Directory Users and Computers snap-in to create an OU container to which you will redirect computer objects that were created with earlier versions of UI and command-line management tools. a. To open Active Directory Users and Computers, click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Users and Computers. b. In the console tree, right-click the domain name. c. Point to New, and then click Organizational Unit. d. Type the name of the OU. 2. At the command line, change to the System32 folder by typing: cd %systemroot%\system32 3. Type the following, where <newcomputerou> is the name of the new computer OU, and <domainname> is the name of the domain: redircmp ou=<newcomputerou>,DC=<domainname>,dc=com
Important Although the default behavior for Windows Server 2008 and Windows Server 2008 R2 is that Windows Firewall is turned on, if you upgrade a Windows Server 2003 computer that had Windows Firewall turned off, the firewall will remain off after the upgrade unless you turn it on using the Windows Firewall control panel. Continuously monitor your domain controllers and Active Directory Domain Services (AD DS). Using a monitoring solution (such as Microsoft Operations Manager (MOM)) to monitor distributed Active Directory Domain Services (AD DS)and the services that it relies onhelps maintain consistent directory data and a consistent level of service throughout the forest. After these tasks have been completed successfully, you will have completed the in-place upgrade process.
45
For more information about Windows Services for UNIX 2.0 application compatibility issues and the hotfix installation file, see article 293783 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkID=106317). For information about installing AD DS by using a command line or an answer file, see Installing a New Forest (http://go.microsoft.com/fwlink/?LinkId=101704). For more information, see Effects of netlogon cryptographic support changes in Windows Server 2008 (http://go.microsoft.com/fwlink/?LinkId=164558). For more information, see Compact the directory database file (offline defragmentation) (http://go.microsoft.com/fwlink/?LinkID=106343). For more information about backing up AD DS, see the AD DS Backup and Recovery Step-by-Step Guide (http://go.microsoft.com/fwlink/?LinkID=93077). For more information about DNS, see Deploying Domain Name System (DNS) (http://go.microsoft.com/fwlink/?LinkId=93656). For more information about creating an organizational unit (OU) design, see Designing the Logical Structure for Windows Server 2008 AD DS [LH].
46
For more information about using Adprep.exe to prepare your environment, see Prepare Your Infrastructure for Upgrade.
Where <Service> is the service requested, <Protocol> is the protocol requested, and <DnsDomainName> is the fully qualified DNS name of the AD DS domain. AD DS servers offer the LDAP service over the TCP protocol; therefore, client computers find an LDAP server by querying DNS for a record of the form:
_ldap._tcp.<DnsDomainName>
The service and protocol strings require an underscore ( _ ) prefix to prevent potential Note
47
This format is applicable for implementations of LDAP servers other than Windows Server 2008 based domain controllers and also possible implementations of LDAP directory services that employ global catalog servers other than servers running Windows Server 2008.
_msdcs.domain_name subdomain
This Microsoft-specific subdomain allows location of domain controllers that have Windows Server 2008specific roles in the domain. This subdomain also allows location of domain controllers by the globally unique identifier (GUID) when a domain has been renamed. To facilitate location of Windows Server 2008based domain controllers, the Net Logon service (in addition to the standard _Service._Protocol.<DnsDomainName> format records) also registers service (SRV) resource records that identify the well-known server-type pseudonyms "dc" (domain controller), "gc" (global catalog), "pdc" (primary domain controller), and "domains" (GUID) as prefixes in the _msdcs.<domain_name> subdomain. To accommodate the location of domain controllers by server type or by GUID (abbreviated "dctype"), Windows Server 2008 based domain controllers register service (SRV) resource records in the following form in the _msdcs.<domain_name> subdomain:
_Service._Protocol.DcTyle._msdcs.<DnsDomainName>
_msdcs.forest_root_domain subdomain
The _msdcs.forest_root_domain subdomain stores forest-wide resource records that are of interest to client computers and domain controllers from all parts of the forest. For example, all domain controllers in the forest register alias (CNAME) and LDAP, Kerberos, and gc service (SRV) resource records in the _msdcs.forest_root_domain subdomain. The alias (CNAME) resource records are used by the replication system to locate replication partners, and the gc service (SRV) resource records are used by client computers to look up global catalog servers. For any two domain controllers to replicate with each other, including two domain controllers from the same domain, they must be able to look up forest-wide locator records. For a newly created domain controller to participate in replication, it must be able to register its forest-wide records in DNS, and other domain controllers must be able to look up these records. Therefore, the DNS servers that are authoritative for the _msdcs.forest_root_domain subdomain need to be available for replication and global catalog lookups. For this reason, we recommend that you create a separate _msdcs.forest_root_domain zone and define its replication scope so that it is replicated to all DNS servers in the forest. Some organizations running Windows 2000 Active Directory have already created an _msdcs.forest_root_domain to help client computers locate domain controllers more efficiently. If an _msdcs.forest_root_domain already exists in your Windows 2000 environment, we recommend that you move the zone to the ForestDnsZones application directory partition after all domain controllers in the forest are upgraded. In addition, for each domain in the forest, move the _msdcs.<domain_name> zone to the DomainDnsZones application directory partition for that domain. Moving the Active Directoryintegrated DNS zones into the domain and forest-wide application directory partitions provides the following benefits:
48
Because the forest-wide application directory partition can replicate outside a specified domain, and because moving the _msdcs.forest_root_domain into the forest-wide application directory partition replicates it to all domain controllers in the forest that are running the DNS Server service, you do not have to use DNS zone transfer to replicate the zone file information to DNS servers that are outside the domain. Domain-wide replication can be targeted to minimize replication traffic because administrators can specify which of the domain controllers running the DNS Server service can receive the DNS zone data. Forest-wide replication can be targeted to minimize replication traffic because DNS data is no longer replicated to the global catalog. DNS records located on global catalog servers in the forest are removed, minimizing the amount of information replicated with the global catalog. For more information about using application directory partitions to store DNS data, see Move DNS Data into DNS Application Directory Partitions.
New groups and new group memberships that are created after upgrading the PDC
After you upgrade the Windows 2000based domain controller holding the role of the primary domain controller (PDC) emulator operations master (also known as flexible single master operations or FSMO) in each domain in the forest to Windows Server 2003, several new, wellknown, and built-in groups are created. Also, some new group memberships are established. If
49
you transfer the PDC emulator operations master role to a Windows Server 2003based or a Windows Server 2008based domain controller instead of upgrading it, these groups will be created when the role is transferred. The new, well-known, and built-in groups include the following: Builtin\Remote Desktop Users Builtin\Network Configuration Operators Performance Monitor Users Performance Log Users Builtin\Incoming Forest Trust Builders Builtin\Performance Monitoring Users Builtin\Performance Logging Users Builtin\Windows Authorization Access Group Builtin\Terminal Server License Servers
The newly established group memberships include the following: If the Everyone group is in the PreWindows 2000 Compatible Access group, the Anonymous Logon group and the Authenticated Users group are also added to the Pre Windows 2000 Compatible Access group. The Network Servers group is added to the Performance Monitoring alias. The Enterprise Domain Controllers group is added to the Windows Authorization Access group. In addition, when upgrading the Windows 2000based domain controller that holds the role of the PDC emulator master in the forest root domain, the following additional security principals are created: LocalService NetworkService NTLM Authentication Other Organization Remote Interactive Logon SChannel Authentication This Organization
After you upgrade the Windows Server 2003based domain controller holding the role of the PDC emulator master in each domain in the forest to Windows Server 2008, or after you move the PDC emulator operations master role to a Windows Server 2008-based domain controller, or after you add a read-only domain controller (RODC) to your domain, the following new well-known and built-in groups are created: Builtin\IIS_IUSRS Builtin\Cryptographic Operators Allowed RODC Password Replication Group Denied RODC Password Replication Group
50
Read-only Domain Controllers Builtin\Event Log Readers Enterprise Read-only Domain Controllers (created only on the forest root domain) Builtin\Certificate Service DCOM Access IUSR security principal added to the Builtin\IIS_IUSRS group The following groups added to the Denied RODC Password Replication Group: Group Policy Creator Owners Domain Admins Cert Publishers Domain Controllers Krbtgt Enterprise Admins Schema Admins Read-only Domain Controllers
Also, the following new, additional security principals are created in the forest root domain: IUSR Owner Rights Well-Known-Security-Id-System security principal is renamed to System Note If you move the PDC emulator master role from a Windows 2000based domain controller to a Windows Server 2008-based domain controller, all the new, wellknown, and built-in groups and newly established group memberships mentioned above will be created.
Security policy considerations when upgrading from Windows 2000 to Windows Server 2003
Server Message Block (SMB) packet signing and secure channel signing are security policies that are enabled by default on Windows Server 2008based domain controllers. To allow client computers running earlier versions of Windows to communicate with domain controllers running Windows Server 2008, you might have to temporarily disable these security policies during the upgrade process.
51
52
Microsoft Support Quick Start for Adding Windows Server 2008 or Windows Server 2008 R2 Domain Controllers to Existing Domains
This topic explains the process for upgrading domain controllers to Windows Server 2008 or Windows Server 2008 R2. This information is based on the experience of the Microsoft Customer Service and Support team. This topic includes links to related information about the upgrade process. Whats new in AD DS in Windows Server 2008 and Windows Server 2008 R2 System requirements for installing Windows Server 2008 and Windows Server 2008 R2 Supported in-place upgrade paths Functional level features and requirements Client, server, and application interoperability Secure default settings in Windows Server 2008 and Windows Server 2008 R2 Virtualized domain controllers on Hyper-V, VMWARE, and other virtualization software Administration, remote administration, and cross-version administration
Configuring the Windows Time service for Windows Server 2008 and Windows Server 2008 R2 Known issues for upgrades to Windows Server 2008 and Windows Server 2008 R2 Verifications you can make and recommended hotfixes you can install before you begin Run Adprep commands Upgrade domain controllers Troubleshooting errors
For information about each feature, special considerations, and how to prepare for deployment, see Changes in Functionality from Windows Server 2003 with Service Pack 1 (SP1) to Windows Server 2008
53
Operating system
Whats new
(http://go.microsoft.com/fwlink/?LinkId=164410). For information about specific features in Active Directory Domain Services (AD DS) in Windows Server 2008, see Active Directory Domain Services Role (http://go.microsoft.com/fwlink/?LinkId=164414). Some functionality that was available in previous versions of Windows Server is deprecated in Windows Server 2008. For example, SMTP Replication is removed by default. For more information, see article 947057 in the Microsoft Knowledge base (http://go.microsoft.com/fwlink/?LinkId=164416). The Browser Service is disabled by default in Windows Server 2008 and Windows Server 2008 R2 domain controllers. Windows Server 2008 R2 For information about each feature, special considerations, and how to prepare for deployment, see Changes in Functionality from Windows Server 2008 to Windows Server 2008 R2 (http://go.microsoft.com/fwlink/?LinkID=139049). For information about specific features in AD DS in Windows Server 2008 R2, see What's New in Active Directory Domain Services (http://go.microsoft.com/fwlink/?LinkID=139655). In Windows Server 2008 R2, Dcpromo.exe does not allow the creation of a domain that has a single-label Domain Name System (DNS) name. If you try to promote an additional domain controller in a domain that has a single-label DNS name (such as contoso, instead of contoso.com), the check box to install a DNS server is not available in Dcpromo.exe. Upgrading Windows Server 2003 domain controllers in Windows Server 2008 R2 and Windows Server 2008 R2 single-label domains is supported. Promoting additional Windows Server 2008 R2 and Windows Server 2008 R2 domain controllers into existing single-label DNS domains is supported.
54
Operating system
Whats new
Windows Server 2008 R2 does not support MSMQ in domain mode for Windows NT 4 and Windows 2000 MSMQ clients running against Windows Server 2008 R2 domain controllers that have no Windows Server 2003 or Windows Server 2008 domain controllers in the same environment. For more information about other functionality in Windows Server 2003 that is deprecated in Windows 7 and Windows Server 2008 R2, see Deprecated Features for Windows 7 and Windows Server 2008 R2 (http://go.microsoft.com/fwlink/?LinkId=177815). For more information about other known issues for AD DS, see Known Issues for Installing and Removing AD DS (http://go.microsoft.com/fwlink/?LinkId=164418).
System requirements for installing Windows Server 2008 and Windows Server 2008 R2
For system requirements for Windows Server 2008, see System Requirements in Installing Windows Server 2008 (http://go.microsoft.com/fwlink/?LinkId=164421). For disk-space requirements for AD DS in Windows Server 2008, see Disk space and component location issues in Known Issues for Installing and Removing AD DS (http://go.microsoft.com/fwlink/?LinkId=164423). For system requirements for Windows Server 2008 R2, see Installing Windows Server 2008 R2 (http://go.microsoft.com/fwlink/?LinkID=160341). For disk-space requirements for AD DS in Windows Server 2008 R2, see Disk space and component location issues in Known Issues for Installing and Removing AD DS (http://go.microsoft.com/fwlink/?LinkID=164423). The AD DS database (Ntds.dit) on Windows Server 2008 R2 domain controllers can be larger than in previous versions of Windows, for the following reasons: There are changes in the online defragmentation process on Windows Server 2008 R2 domain controllers. Windows Server 2008 R2 Adprep /forestprep adds two new indices on the large link table. The Windows Server 2008 R2 Active Directory Recycle Bin feature, when it is enabled, preserves attributes on deleted objects for the recycled object lifetime.
55
The Active Directory database on a Windows Server 2008 domain controller that is promoted into a Windows 2000 domain should be a size that is similar to the size of the Active Directory databases on the Windows 2000 domain controllers. While Windows Server 2008 R2 additions increase the database size, the addition of a single-instance store that is supported by domain controllers that run Windows Server 2003, Windows Server 2003 R2, Windows Server 2008, or Windows Server 2008 R2 offsets that increase. Windows Server 2008 R2 domain controllers are estimated to be 10 percent larger than Windows Server 2008 domain controllers, not counting the Active Directory Recycle Bin. In a production Windows Server 2008 R2 domain at Microsoft, the Active Directory Recycle Bin feature increased the database size by an additional 15 to 20 percent of the original AD DS database size, using the default deletedObjectLifetime and recycledObjectLifetime values of 180 days. Additional space requirements depend on the size and count of the objects that can be recycled. If an in-place upgrade to Windows Server 2008 or Windows Server 2008 R2 rolls back silently to the previous operating system version, check for sufficient free disk space on the partitions that host the AD DS database and log files.
56
for the deployment of Windows Server 2008 and Windows Server 2008 R2 domain controllers are as follows: Adprep /forestprep does not have any domain or forest functional level requirements. Adprep /domainprep requires a Windows 2000 native or higher domain functional level in each target domain. Adprep /rodcprep does not have any functional-level requirements. You can install Windows 2000, Windows Server 2003, Windows Server 2008, and Windows Server 2008 R2 domain controllers in the same domain or forest without any functional-level requirement. For installation of a read-only domain controller (RODC), the forest functional level must be Windows Server 2003 or higher.
Secure default settings in Windows Server 2008 and Windows Server 2008 R2
Windows Server 2008 and Windows Server 2008 R2 domain controllers have the following secure default settings, compared to Windows 2000 and Windows Server 2003 domain controllers. Encryption type or policy AllowNT4Crypt o Windows Server 200 8 default Disabled Windows Server 2008 R 2 default Disabled Comment
Third-party Server Message Block (SMB) clients may be incompatible with the secure default settings on Windows Server 2008 and Windows Server 2008 R2 domain controllers. In
57
all cases, these settings can be relaxed to allow interoperability at the expense of security. For more information, see article 942564 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/? LinkId=164558). DES CBT/Extended Protection for Integrated Authentication LMv2 Enabled N/A Disabled Enabled Article 977321 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkId=177717) See Microsoft Security Advisory (937811) (http://go.microsoft.com/fwlink/?LinkId=164559) and article 976918 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/? LinkId=178251). Article 976918 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkId=178251)
Enabled
Disabled
The installation of a server role, such as Active Directory Domain Services, by Server Manager also locally installs all GUI and command-line tools that you can use to administer that role. To install tools locally to manage other server roles, click Add Features in Server Manager. The GUI and command-line tools that were formerly in the Administrative Tools Pack (ADMINPACK.MSI), Support Tools (SUPPTOOLS.MSI), and Resource Kit tools have been consolidated into a single collection called Remote Server Administration Tools (RSAT), which you can obtaine from the Microsoft Download Center. As 64-bit hardware and operating systems became more popular, x86-based (32-bit) and x64-based (64-bit) versions of administration tools were released. Additional steps are required to make the administration tools that RSAT installs appear in the Start menu of Windows Vista computers. For these additional steps, see the following procedure. As a general rule, the administrative tools only install and run correctly on the operating system versions with which they were released. For example, the Windows Server 2008 administration tools install and run only on Windows Vista client computers and Windows Server 2008 server computers. Administration tools whose files are copied from the server operating system disk will generally not execute on the corresponding client operating system and are not supported. For example, tools that are copied from the Windows Server 2008 operating system disk to Windows Vista will not work. Instead of copying the tools, download the correct version of RSAT for the client computers that you use to administer servers. For more information, see How to Administer Microsoft Windows Client and Server Computers Locally and Remotely (http://go.microsoft.com/fwlink/?LinkId=177813). To display the administration tools on the Start menu 1. Right-click Start, and then click Properties. 2. On the Start Menu tab, click Customize. 3. In the Customize Start Menu dialog box, scroll down to System administrative tools, and then click Display on the All Programs menu and the Start menu. 4. Click OK. For more information, see Installing Remote Server Administration Tools (http://go.microsoft.com/fwlink/?LinkID=153624).
Configuring the Windows Time service for Windows Server 2008 and Windows Server 2008 R2
Make sure that you have the following domain controller roles configured properly to synchronize the Windows Time service (W32time).
59
The forest-root primary domain controller (PDC) on a physical computer should synchronize time from a reliable external time source. For more information, see Configure the Windows Time service on the PDC emulator (http://go.microsoft.com/fwlink/?LinkId=91969). All other domain controllers that are installed on physical hardware or Hyper-V should use the default domain hierarchy (no configuration change required). For domain controllers running on non-Microsoft virtualization software, consult the vendor. Windows Server 2008 and Windows Server 2008 R2 domain controllers added time-rollback protection to help prevent domain controllers from adopting bad time. Microsoft recommend that you add time-rollback protection on Windows Server 2003 domain controllers by using Group Policy, making sure that you have the policy detail fixes in place before you do. . For more information, see article 884776 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/? LinkId=178255). Finally, time on workgroup and domain-joined virtual host computers should be configured as follows: For workgroup host computers: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\W32Time\Parameters\T YPE (REG_SZ) = NTP HKLM\system\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer (REG_DWORD) = <fully qualified host name of time server. such as time.windows.com>,0x08 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider s\NtpClient\SpecialPollInterval (REG_DWORD) = 900 (decimal) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\MaxPo sPhaseCorrection (REG_DWORD): 2a300 (hexadecimal) or 172800 (decimal) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\MaxNe gPhaseCorrection (REG_DWORD): 2a300 (hexadecimal) or 172800 (decimal) For domain-joined host computers: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32time\Config\MinPol lInterval (REG_DWORD): 6 (decimal)
60
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32time\Config\MaxPol lInterval (REG_DWORD): 10 (decimal) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\MaxPo sPhaseCorrection (REG_DWORD): 2a300 (hexadecimal) or 172800 (decimal) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config\MaxNe gPhaseCorrection (REG_DWORD): 2a300 (hexadecimal) or 172800 (decimal)
Known issues for upgrades to Windows Server 2008 and Windows Server 2008 R2
Read the following release notes for more information about specific issues that can affect these versions of Windows Server: Release notes for Windows Server 2008 (http://go.microsoft.com/fwlink/?LinkID=99299) Release notes for Windows Server 2008 R2 (http://go.microsoft.com/fwlink/?LinkID=139330) Extension mechanisms for DNS (EDNS) are enabled by default on Windows Server 2008 R2. If you notice queries that used to work on DNS servers that run Windows 2000, Windows Server 2003, or Windows Server 2008 fail after those DNS servers are upgraded or replaced with DNS servers that run Windows Server 2008 R2, or queries that the old DNS servers can resolve cannot be resolved by Windows Server 2008 R2 DNS servers, then disable EDNS using the command:dnscmd /Config /EnableEDnsProbes 0
Verifications you can make and recommended hotfixes you can install before you begin
1. All domain controllers in the forest should meet the following conditions: a. Be online. b. Be healthy (Run dcdiag /v to see if there are any problems.) c. Have successfully inbound-replicated and outbound-replicated all locally held Active Directory partitions (repadmin /showrepl * /csv viewed in Excel). For more information, see CSV Format in Repadmin Requirements, Syntax, and Parameter Descriptions (http://go.microsoft.com/fwlink/?LinkID=147380). d. Have successfully inbound-replicated and outbound-replicated SYSVOL. e. Metadata for stale or nonexistent domain controllers, or domain controllers that cannot be made to replicate, should be removed from their respective domains. For more information, see Cleaning metadata of removed writable domain controllers in
61
Appendix A: Forest Recovery Procedures (http://go.microsoft.com/fwlink/? LinkID=164553). f. All domains must be at the Windows 2000 native functional level or higher to run adprep /domainprep. Windows NT 4.0 domain controllers are not permitted in this functional level. g. Have sufficient free disk space to accommodate the upgrade. For more information about disk-space requirements for Windows Server 2008 and Windows Server 2008 R2, see System requirements for installing Windows Server 2008 and Windows Server 2008 R2. The task for administrators is to accurately forecast the immediate and long-term growth for Ntds.dit files on Windows Server 2008 and Windows Server 2008 R2 domain controllers so that hard drives and partitions that host Active Directory files can be sized properly on physical and virtual domain controllers. 2. Check for incompatibilities with secure defaults in Windows Server 2008 and Windows Server 2008 R2. For more information, see Secure default settings in Windows Server 2008 and Windows Server 2008 R2. 3. Download the latest service pack and relevant hotfixes that apply to your Active Directory forest before you deploy Windows Server 2008 or Windows Server 2008 R2 domain controllers. a. For upgrades to either Windows Server 2008 or Windows Server 2008 R2, create integrated installation media (slipstream) by adding the latest service pack and hotfixes for your operating system. As of September 2009, the latest service pack for Windows Server 2008 is Service Pack 2 (SP2). For information about obtaining the latest service pack, see article 968849 in the Microsoft Knowledge base (http://go.microsoft.com/fwlink/?LinkId=164585) and see Installing Windows Server 2008 with Service Pack 2 (http://go.microsoft.com/fwlink/?LinkId=164586). Windows Server 2008 R2 includes updates from Windows Server 2008 SP2. To make sure that you have all of the latest updates, see Windows Update (http://go.microsoft.com/fwlink/? LinkID=47290) or see article 968849 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkID=164585) for download information. i. If you are deploying RODCs, review article 944043 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkID=122974). Download and install the hotfixes on the Windows computers and scenarios that apply to your computing environment. ii. For Windows Server 2008 R2: If Active Directory Management Tool (ADMT) 3.1 is installed on Windows Server 2008 computers that are being upgraded in-place to Windows Server 2008 R2, remove ADMT 3.1 before the upgrade; otherwise, it cannot be uninstalled. In addition, ADMT 3.1 cannot be installed on Windows Server 2008 R2 computers. iii. The following table lists hotfixes for Windows Server 2008. You can install a hotfix individually, or you can install the service pack that includes it. Description Microsoft Knowledge Base article Service pack
62
Domain controllers that are configured to use the Japanese language locale EFS file access encrypted on a Windows Server 2003 file server upgraded to Windows Server 2008 Records on Windows Server 2008 secondary DNS server are deleted following zone transfer Use root hints if no forwarders are available Setting Locale info in GPP causes Event Log and dependent services to fail. If you change Regional Option User Locale enabled, the Windows Event Log Service, DNS Server Service, task Scheduler Service fail to start. GPMC Filter fix If you use devolution to resolve DNS names (instead of suffix search list), apply the DNS devolution hotfix. Group Policy Preferences rerelease
Windows Server 2008 SP2 Not included in any Windows Server 2008 Service Pack Windows Server 2008 SP2
2001154 (http://go.microsoft.com/fwlink/? LinkId=165959) For prevention and resolution, see 951430 (http://go.microsoft.com/fwlink/?LinkId=165960). To be included in Windows Server 2008 SP3
Synchronize the Directory Services Restore Mode (DSRM) Administrator password with a domain
63
user account The following table lists hotfixes for Windows Server 2008 R2. Description Windows Server 2008 R2 Dynamic DNS updates to BIND servers log NETLOGON event 5774 with error status 9502 Event ID 1202 logged with status 0x534 if security policy modified Microsoft Knowledge Base article 2002490 (http://go.microsoft.com/fwlink/? LinkId=178225) Comment [The article will include a hotfix.]
Hotfix is in progress. Also scheduled for Windows Server 2008 R2 SP1. Occurs only on x64based server upgrades in Dynamic DST time zones. To see if your servers are affected, click the taskbar clock. If the clock fly-out indicates a time zone problem, click the link to open the date and time control panel.
Deploying the first Windows Server 2008 R2 domain controller in an existing Active Directory forest may temporarily halt Active Directory replication to strict-mode destination domain controllers.
2002034
64
If you encounter errors when you run an Adprep command, see Adprep errors.
If you copy Adprep.exe from the installation media to a local computer or a network share, copy the entire adprep folder and provide the full path to the Adprep.exe file. 3. Update the forest schema with adprep /forestprep. While you are still logged on to the console of the schema master with an account that has Enterprise Admins, Schema Admin, and Domain Admin credentials, run the appropriate version of adprep /forestprep from the Windows Server 2008 or Windows Server 2008 R2 installation media. Specify the full path to Adprep.exe to prevent running another version of Adprep that may be present in the PATH environment variable. For example, if you are running the Windows Server 2008 version of Adprep from a DVD drive or network path that is assigned the drive letter D:, the command to run is as follows:
>D:\sources\adprep\adprep /forestprep
The syntax for running Windows Server 2008 R2 Adprep on a 64-bit schema master is as follows:
<dvd drive letter>:\support\adprep\adprep /forestprep
The syntax for running Windows Server 2008 R2 Adprep on a 32-bit, x86-based schema master is as follows:
D:\support\adprep\adprep32 /forestprep
For a list of operations that Windows Server 2008 adprep /forestprep performs, see Windows Server 2008: Forest-Wide Updates (http://go.microsoft.com/fwlink/?LinkId=164636). For a list of operations that Windows Server 2008 R2 adprep /forestprep performs , see Windows Server 2008 R2: Forest-Wide Updates (http://go.microsoft.com/fwlink/? LinkId=164637). If you encounter errors, see Forestprep errors later in this topic.
For Windows Server 2008 R2: 1. If the computer where you run Rodcprep is a 64-bit computer, run the following command:
D:\support\adprep\adprep /rodcprep
2. If the computer where you run Rodcprep is a 32-bit computer, run the following command:
D:\support\adprep\adprep32 /rodcprep
For example, if the DVD or network path is assigned drive D, use the following syntax:
D:\sources\adprep\adprep /domainprep /gpprep
For Windows Server 2008 R2: If the infrastructure master is 64-bit, use the following syntax:
D:\support\adprep\adprep /domainprep /gpprep
Upgrading and promoting new domain controllers into an existing domain Post-installation tasks Fixes to install after AD DS installation
A writable (or full) domain controller that runs Windows Server 2008 or Windows Server 2008 R2 must exist in the target domain.
68
2. If the Active Directory Migration Tool (ADMT) version 3.1 is installed on a Windows Server 2003 or Windows Server 2008 domain controller that is being upgraded to Windows Server 2008 R2, uninstall ADMT 3.1 before the upgrade. 3. When promoting new domain controllers, make sure that object information about the newly promoted domain controllers (the computer account in the domain partition and the NTDS Settings object in the configuration partition) has outbound replicated to a sufficient number of domain controllers that are remaining in the forest before you retire the only domain controller in the forest that has that object information. For example, if you promote DC2 and use DC1 as the helper domain controller, then make sure that DC1 has outbound replicated object information about DC2 to other domain controllers before you retire DC1. This is particularly an issue where the helper domain controllers used by newly promoted domain controllers are rapidly demoted before outbound reapplication takes place. 4. Run <dvd or network path>:\setup.exe. 5. Read article 942564 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/? LinkID=164558) and consider the right setting for the AllowNT4Cryto policy for your environment. 6. If dcpromo.exe fails, see Dcpromo errors. 7. If you have remotely encrypted Encrypting File System (EFS) files on Windows Server 2003 computers that are being upgraded in place to Windows Server 2008, read and comply with article 948690 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkID=106115). This problem does not apply to domain controllers that are upgraded to Windows Server 2008 R2. 8. Consider installing the following fixes after the in-place upgrade unless they are integrated into your installation media: If you are installing Windows Server 2008, install Service Pack 2 (SP2). Windows Server 2008 R2 includes Windows Server 2008 SP2 fixes. If you are using Group Policy Preferences on Windows Vista or Windows Server 2008 computers, download the July 2009 update to article 943729 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkID=164591). Download the fix for a GPMC filter bug in article 949360 in the Microsoft Knowledge Base. If you use devolution (as opposed to suffix search lists) to resolve DNS queries for single-label and non-fully-qualified DNS names, download the DNS devolution fix. See article 957579 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/? LinkId=166140). Complete the following steps if you are performing an in-place upgrade of Windows Server 2008 or Windows Server 2008 R2 writable domain controllers into existing Windows 2000 Server, Windows Server 2003 or Windows Server 2008 domains: 1. Verify that the target domain is at the Windows 2000 native domain functional level or higher.
69
2. If you are promoting Windows Server 2008 domain controllers that are configured to use the Japanese language, read and comply with article 949189 in the Microsoft Knowledge base (http://go.microsoft.com/fwlink/?LinkID=164588). The hotfix should be installed immediately after promotion and before the first boot into normal mode. 3. From the Windows Start menu, run Dcpromo.exe (or install the Active Directory Domain Services Role in Server Manager, and then run Dcpromo). 4. When the AllowNT4Crytpo page appears, read article 942564 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkID=164558) consider the right setting for AllowNT4Cryto for your environment. 5. If you encounter an error, see the list of Dcpromo errors at the end of this topic. Do the following if you are performing an in-place upgrade of Windows Server 2008 RODCs into existing Windows Server 2003 domains, Windows Server 2008 domains, or domains that have a mix of those operating systems: 1. If the option to install RODC is not available in Dcpromo, verify that the forest functional level is Windows Server 2003 or higher. 2. If the option to install RODC is not available and the error message indicates that there is no Windows Server 2008 in the domain, verify that a Windows Server 2008 domain controller exists in the domain and that it is accessible on the network to the RODC that you are promoting. 3. If an error message indicates that access is denied, see the Microsoft Knowledge Base.
Post-installation tasks
For all domain controllers: Configure the forest root PDC with an external time source. For more information, see Configure the forest root PDC with an external time source (http://go.microsoft.com/fwlink/? LinkId=91969). Enable delete protection on organizational units (OUs) and other strategic containers to prevent accidental deletions. Use only Active Directoryaware backup applications to restore domain controllers or roll back the contents of AD DS. Restoring snapshots that were created by imaging software is not supported on domain controllers.
SP1 (RTM) Article 949360: GPMC filter bug Article 957959: DNS devolution fix Article 943729: GPP rerelease Article 949189: Japanese Language Locale For RODCs: Yes Yes Yes Yes
Server 2008 R2 No No No No
If you are deploying RODCs, install the hotfix in article 953392 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkID=150337) on all Windows Server 2008 writable domain controllers. This fix is not required on Windows Server 2008 R2 writable domain controllers. Read article 944043 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/? LinkID=122974), and install the corrective fixes on the Windows client and server computers that are affected by the scenarios that are listed in the Knowledge Base article.
Troubleshooting errors
This section describes errors in Adprep.exe and Dcpromo.exe. If you encounter an error that is not covered, search site:Microsoft.com: error description or post your problem to the following community sites: Directory Services Directory Services (http://go.microsoft.com/fwlink/?LinkId=166141) Discussions in microsoft.public.windows.server.active_directory (http://go.microsoft.com/fwlink/?LinkId=166142)
Adprep errors
These sections describe errors for the forestprep, domainprep, and rodcprep commands.
Forestprep errors
If an error message indicates that the schema operations master is assigned to a deleted domain controller, see the Microsoft Knowledge Base. If the error message says Adprep was unable to extend the schema or Adprep failed to verify whether the schema master has completed a replication cycle after last reboot, verify that the schema master has inbound-replicated the schema partition since the reboot. See
71
Force a replication event with all partners in Forcing Replication (http://go.microsoft.com/fwlink/?LinkId=164668), and run the repadmin /syncall command. If the error message says The callback function failed, see Adprep was unable to complete because the call back function failed in Running Adprep.exe (http://go.microsoft.com/fwlink/?LinkId=164669). If the error message says There is a schema conflict with Exchange 2000. The schema is not upgraded., see article 314649 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkId=166190). If the error message says An attribute with the same link identifier already exists, see article 969307 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/? LinkId=164670). For all other error messages, run a query for the error message that is enclosed in quotation marks at Microsoft Help and Support (http://go.microsoft.com/fwlink/? LinkID=56290).
Domainprep errors
1. If the error message says Adprep detected that the domain is not in native mode, see Raise the domain functional level (http://go.microsoft.com/fwlink/?LinkID=141249). 2. If the error message indicates that the callback function failed, see Adprep was unable to complete because the call back function failed in Running Adprep.exe (http://go.microsoft.com/fwlink/?LinkID=164669). 3. For all other error messages, run a query for the error message that is enclosed in quotation marks at Microsoft Help and Support (http://go.microsoft.com/fwlink/? LinkID=56290).
Rodcprep errors
1. If Rodcprep fails with the error message Adprep could not contact a replica for partition <distinguished name for the forest-wide or domain-wide DNS application partition> that is documented in article 949257 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkID=140285), run the Fixfsmo.vbs script in the same article, and then rerun Rodcprep until it runs successfully. 2. For all other error messages, run a query for the error message that is enclosed in quotation marks at Microsoft Help and Support (http://go.microsoft.com/fwlink/? LinkID=56290).
Dcpromo errors
1. If the upgrade rolls back without any onscreen error or recorded error in a debug log, verify that you have sufficient free disk space on the volumes that are hosting %systemdrive, Ntds.dit, and SYSVOL. 2. If an error message says "To install a domain controller into this Active Directory forest, you must first prepare the forest using ""adprep /forestprep"" ", verify that /forestprep has
72
been run and that the helper domain controller has inbound-replicated /forestprep changes. For more information, see Running adprep.exe (http://go.microsoft.com/fwlink/? LinkID=142597). 3. If an error message says "To install a domain controller into this Active Directory domain, you must first prepare the forest using ""adprep /domainprep"" and verify that /domainprep has been run and that the helper domain controller has inbound-replicated /domainprep changes. For more information, see Running adprep.exe (http://go.microsoft.com/fwlink/?LinkID=142597). 4. If an error message says the specified user already exists, delete the stale machine account and verify that the helper domain controller has inbound-replicated that deletion. As an alternative, try another helper domain controller. 5. If an error message says You cannot install an additional domain controller at this time because the RID master <domain controller name> is offline. or You will not be able to install a writable domain controller at this time because the RID master <domain controller name> is offline. Do you want to continue?, complete the following steps to recover. a. Run NETDOM QUERY FSMO or DCDIAG /TEST:<name of FSMO test> b. If the distinguished name path that is returned from the command in the previous step is mangled or assigned to a deleted domain controller, remove the metadata for that domain controller and seize the role to a live domain controller that hosts a writable copy of the domain partition. c. Verify that RID master role is assigned to a live domain controller that has successfully inbound replicated the domain directory partition since boot from at least one other domain controller in the same domain. d. If the current role holder is the only live domain controller in the domain but its copy of Active Directory refers to domain controllers that no longer exist, remove the stale metadata for those domain controllers and reboot the live domain controller and retry promotion. 6. If a warning indicates that there is no static IP address configured for an IPv6 address on a Windows Server 2008 domain controller, click Yes and complete the wizard. 7. If the check box for installing the DNS Server role is unavailable, either the Active Directory domain has a single-label DNS name or Dcpromo.exe cannot discover another Microsoft DNS server in the domain. 8. If you see the error message A delegation for this DNS Server cannot be created because the authoritative parent zone cannot be found, see Known Issues for Installing and Removing AD DS (http://go.microsoft.com/fwlink/?LinkId=164418). 9. If you see the error message The DNS zone could not be created...," see the Microsoft Knowledge Base. 10. If you see the logging event <unable to obtain local RID pool>, see the Microsoft Knowledge Base. 11. If the system is unable to share SYSVOL, see the Microsoft Knowledge Base.
73
12. If Dcpromo fails with an error message that says Failed to modify the necessary properties for the machine account. Access is denied, make sure that administrators are granted the Enable computer and user accounts to be trusted for delegation permission in Default Domain Controllers Policy and that the policy has been linked to the Domain Controllers OU. Also make sure that the helper domain controllers machine account resides in the Domain Controllers OU and that it has successfully applied policy. For more information, see article 232070 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkId=166198).
74