Discussion:
Upgrading from windows 2003 to windows 2008.
(too old to reply)
unknown
2009-07-28 14:40:30 UTC
Permalink
We are running a naive windows 2003 domain, and now want to upgrade to
windows 2008. We have one forest with 2 domains and have several sites and
each site has several domain controllers. My question is how do we upgrade
to windows 2008 domain. Is there any schema update we do , if so what is
the procedure.
Also what functional levels are there in windows 2008 and what features we
would get with w2008 DC's running in a windows 2003 domain.

Also are there any known issues with upgrading from w2003 to w2008, or with
doing any schema updates.

Thanks
Meinolf Weber [MVP-DS]
2009-07-28 14:52:52 UTC
Permalink
Hello guv,

You have to upgrade the schema on the schema master with an account of the
schema admins. 2008 will be schme aversion 44 and 2008 R2 needs also a schema
upgrade to version 47. You can check with "schupgr" in a command line the
version.

As long as you not raise the functional levels to Windows server 2008/Windows
server 2008 R2 you wan't have additional options for DCs, but you have additional
functionalities like group policy preferences also with having 2008 member
servers.

Fine grained password policies for example requires all DCs to be 2008 and
functional levels as Windows server 2008.

Active directory recycle bin for example requires Windows server 2008 R2.

You should install additioanl DCs instead of using in-place upgrade in my
opinion. It is always better to use a fresh install with clean OS version.

Adprep 2008:
http://technet.microsoft.com/en-us/library/cc731728(WS.10).aspx

Functional levels 2008:
http://technet.microsoft.com/en-us/library/cc771132(WS.10).aspx


See here for starting with a new installed DC:
!!!NEVER START BEFORE HAVING CREATED AND TESTED A BACKUP OF YOUR DATA/MACHINE!!!

- On the old server open DNS management console and check that you are running
Active directory integrated zone (easier for replication, if you have more
then one DNS server)

- run replmon from the run line or repadmin /showrepl(only if more then one
DC exist), dcdiag and netdiag from the command prompt on the old machine
to check for errors, if you have some post the complete output from the command
here or solve them first. For this tools you have to install the support\tools\suptools.msi
from the 2003 installation disk.

- run adprep /forestprep and adprep /domainprep and adprep /rodcprep from
the 2008 installation disk against the 2003 schema master, with an account
that is member of the Schema admins, to upgrade the schema to the new version
(44), you can check the version with "schupgr" in a command prompt.

- Install the new machine as a member server in your existing domain

- configure a fixed ip and set the preferred DNS server to the old DNS server
only

- run dcpromo and follow the wizard to add the 2008 server to an existing
domain, make it also Global catalog and DNS server.

- for DNS give the server time for replication, at least 15 minutes. Because
you use Active directory integrated zones it will automatically replicate
the zones to the new server. Open DNS management console to check that they
appear

- if the new machine is domain controller and DNS server run again replmon,
dcdiag and netdiag (copy the netdiag from the 2003 to 2008, will work) on
both domain controllers

- Transfer, NOT seize the 5 FSMO roles to the new Domain controller (http://support.microsoft.com/kb/324801
applies also for 2008), FSMO should always be on the newest OS DC

- you can see in the event viewer (Directory service) that the roles are
transferred, also give it some time

- reconfigure the DNS configuration on your NIC of the 2008 server, preferred
DNS itself, secondary the old one

- if you use DHCP do not forget to reconfigure the scope settings to point
to the new installed DNS server

- export and import of DHCP database for 2008 choose "netshell dhcp backup"
and "netshell dhcp restore" command (http://technet.microsoft.com/en-us/library/cc772372.aspx)



Demoting the old DC

- reconfigure your clients/servers that they not longer point to the old
DC/DNS server on the NIC

- to be sure that everything runs fine, disconnect the old DC from the network
and check with clients and servers the connectivity, logon and also with
one client a restart to see that everything is ok

- then run dcpromo to demote the old DC, if it works fine the machine will
move from the DC's OU to the computers container, where you can delete it
by hand. Can be that you got an error during demoting at the beginning, then
uncheck the Global catalog on that DC and try again

- check the DNS management console, that all entries from the machine are
disappeared or delete them by hand if the machine is off the network for ever

- also you have to start AD sites and services and delete the old servername
under the site, this will not be done during demotion

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
Post by unknown
We are running a naive windows 2003 domain, and now want to upgrade to
windows 2008. We have one forest with 2 domains and have several sites and
each site has several domain controllers. My question is how do we upgrade
to windows 2008 domain. Is there any schema update we do , if so what is
the procedure.
Also what functional levels are there in windows 2008 and what
features we
would get with w2008 DC's running in a windows 2003 domain.
Also are there any known issues with upgrading from w2003 to w2008, or
with doing any schema updates.
Thanks
unknown
2009-07-29 12:31:26 UTC
Permalink
Thanks for the great explanation.

Just few questions, for w2008 R2 do i need to another schema update, after I
have done one for w2008, or is it best I do the w2008 R2 only ( if its
released yet). Also I have 2 domains, so I have to do a domainprep for each
domain.

Also does it affect our exchange upgrade, as we want to upgrade from
exchange 2003 to exchange 2007. As I know there are schema updates required
there.
Post by Meinolf Weber [MVP-DS]
Hello guv,
You have to upgrade the schema on the schema master with an account of the
schema admins. 2008 will be schme aversion 44 and 2008 R2 needs also a
schema upgrade to version 47. You can check with "schupgr" in a command
line the version.
As long as you not raise the functional levels to Windows server
2008/Windows server 2008 R2 you wan't have additional options for DCs, but
you have additional functionalities like group policy preferences also
with having 2008 member servers.
Fine grained password policies for example requires all DCs to be 2008 and
functional levels as Windows server 2008.
Active directory recycle bin for example requires Windows server 2008 R2.
You should install additioanl DCs instead of using in-place upgrade in my
opinion. It is always better to use a fresh install with clean OS version.
http://technet.microsoft.com/en-us/library/cc731728(WS.10).aspx
http://technet.microsoft.com/en-us/library/cc771132(WS.10).aspx
!!!NEVER START BEFORE HAVING CREATED AND TESTED A BACKUP OF YOUR DATA/MACHINE!!!
- On the old server open DNS management console and check that you are
running Active directory integrated zone (easier for replication, if you
have more then one DNS server)
- run replmon from the run line or repadmin /showrepl(only if more then
one DC exist), dcdiag and netdiag from the command prompt on the old
machine to check for errors, if you have some post the complete output
from the command here or solve them first. For this tools you have to
install the support\tools\suptools.msi from the 2003 installation disk.
- run adprep /forestprep and adprep /domainprep and adprep /rodcprep from
the 2008 installation disk against the 2003 schema master, with an account
that is member of the Schema admins, to upgrade the schema to the new
version (44), you can check the version with "schupgr" in a command
prompt.
- Install the new machine as a member server in your existing domain
- configure a fixed ip and set the preferred DNS server to the old DNS
server only
- run dcpromo and follow the wizard to add the 2008 server to an existing
domain, make it also Global catalog and DNS server.
- for DNS give the server time for replication, at least 15 minutes.
Because you use Active directory integrated zones it will automatically
replicate the zones to the new server. Open DNS management console to
check that they appear
- if the new machine is domain controller and DNS server run again
replmon, dcdiag and netdiag (copy the netdiag from the 2003 to 2008, will
work) on both domain controllers
- Transfer, NOT seize the 5 FSMO roles to the new Domain controller
(http://support.microsoft.com/kb/324801 applies also for 2008), FSMO
should always be on the newest OS DC
- you can see in the event viewer (Directory service) that the roles are
transferred, also give it some time
- reconfigure the DNS configuration on your NIC of the 2008 server,
preferred DNS itself, secondary the old one
- if you use DHCP do not forget to reconfigure the scope settings to point
to the new installed DNS server
- export and import of DHCP database for 2008 choose "netshell dhcp
backup" and "netshell dhcp restore" command
(http://technet.microsoft.com/en-us/library/cc772372.aspx)
Demoting the old DC
- reconfigure your clients/servers that they not longer point to the old
DC/DNS server on the NIC
- to be sure that everything runs fine, disconnect the old DC from the
network and check with clients and servers the connectivity, logon and
also with one client a restart to see that everything is ok
- then run dcpromo to demote the old DC, if it works fine the machine will
move from the DC's OU to the computers container, where you can delete it
by hand. Can be that you got an error during demoting at the beginning,
then uncheck the Global catalog on that DC and try again
- check the DNS management console, that all entries from the machine are
disappeared or delete them by hand if the machine is off the network for ever
- also you have to start AD sites and services and delete the old
servername under the site, this will not be done during demotion
Best regards
Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and
confers no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
Post by unknown
We are running a naive windows 2003 domain, and now want to upgrade to
windows 2008. We have one forest with 2 domains and have several sites and
each site has several domain controllers. My question is how do we upgrade
to windows 2008 domain. Is there any schema update we do , if so what is
the procedure.
Also what functional levels are there in windows 2008 and what features we
would get with w2008 DC's running in a windows 2003 domain.
Also are there any known issues with upgrading from w2003 to w2008, or
with doing any schema updates.
Thanks
Meinolf Weber [MVP-DS]
2009-07-29 22:49:33 UTC
Permalink
Hello guv,

2008 R2 requires again a schema update on the 2008 schema master. Therefore
you find adprep32.exe(32bit) and adprep.exe(64bit) on the 2008 R2 installation
disk, so you can use the needed version depending on your current OS architecture.

Exchange upgrade requires also a schema update from the exchange 2007 installation
disk, just follow the wizard when you insert the disk.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
Post by unknown
Thanks for the great explanation.
Just few questions, for w2008 R2 do i need to another schema update,
after I have done one for w2008, or is it best I do the w2008 R2 only
( if its released yet). Also I have 2 domains, so I have to do a
domainprep for each domain.
Also does it affect our exchange upgrade, as we want to upgrade from
exchange 2003 to exchange 2007. As I know there are schema updates required
there.
Post by Meinolf Weber [MVP-DS]
Hello guv,
You have to upgrade the schema on the schema master with an account
of the schema admins. 2008 will be schme aversion 44 and 2008 R2
needs also a schema upgrade to version 47. You can check with
"schupgr" in a command line the version.
As long as you not raise the functional levels to Windows server
2008/Windows server 2008 R2 you wan't have additional options for
DCs, but you have additional functionalities like group policy
preferences also with having 2008 member servers.
Fine grained password policies for example requires all DCs to be
2008 and functional levels as Windows server 2008.
Active directory recycle bin for example requires Windows server 2008 R2.
You should install additioanl DCs instead of using in-place upgrade
in my opinion. It is always better to use a fresh install with clean
OS version.
http://technet.microsoft.com/en-us/library/cc731728(WS.10).aspx
http://technet.microsoft.com/en-us/library/cc771132(WS.10).aspx
!!!NEVER START BEFORE HAVING CREATED AND TESTED A BACKUP OF YOUR DATA/MACHINE!!!
- On the old server open DNS management console and check that you
are running Active directory integrated zone (easier for replication,
if you have more then one DNS server)
- run replmon from the run line or repadmin /showrepl(only if more
then one DC exist), dcdiag and netdiag from the command prompt on the
old machine to check for errors, if you have some post the complete
output from the command here or solve them first. For this tools you
have to install the support\tools\suptools.msi from the 2003
installation disk.
- run adprep /forestprep and adprep /domainprep and adprep /rodcprep
from the 2008 installation disk against the 2003 schema master, with
an account that is member of the Schema admins, to upgrade the schema
to the new version (44), you can check the version with "schupgr" in
a command prompt.
- Install the new machine as a member server in your existing domain
- configure a fixed ip and set the preferred DNS server to the old
DNS server only
- run dcpromo and follow the wizard to add the 2008 server to an
existing domain, make it also Global catalog and DNS server.
- for DNS give the server time for replication, at least 15 minutes.
Because you use Active directory integrated zones it will
automatically replicate the zones to the new server. Open DNS
management console to check that they appear
- if the new machine is domain controller and DNS server run again
replmon, dcdiag and netdiag (copy the netdiag from the 2003 to 2008,
will work) on both domain controllers
- Transfer, NOT seize the 5 FSMO roles to the new Domain controller
(http://support.microsoft.com/kb/324801 applies also for 2008), FSMO
should always be on the newest OS DC
- you can see in the event viewer (Directory service) that the roles
are transferred, also give it some time
- reconfigure the DNS configuration on your NIC of the 2008 server,
preferred DNS itself, secondary the old one
- if you use DHCP do not forget to reconfigure the scope settings to
point to the new installed DNS server
- export and import of DHCP database for 2008 choose "netshell dhcp
backup" and "netshell dhcp restore" command
(http://technet.microsoft.com/en-us/library/cc772372.aspx)
Demoting the old DC
- reconfigure your clients/servers that they not longer point to the
old DC/DNS server on the NIC
- to be sure that everything runs fine, disconnect the old DC from
the network and check with clients and servers the connectivity,
logon and also with one client a restart to see that everything is ok
- then run dcpromo to demote the old DC, if it works fine the machine
will move from the DC's OU to the computers container, where you can
delete it by hand. Can be that you got an error during demoting at
the beginning, then uncheck the Global catalog on that DC and try
again
- check the DNS management console, that all entries from the machine
are disappeared or delete them by hand if the machine is off the
network for ever
- also you have to start AD sites and services and delete the old
servername under the site, this will not be done during demotion
Best regards
Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and
confers no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
Post by unknown
We are running a naive windows 2003 domain, and now want to upgrade to
windows 2008. We have one forest with 2 domains and have several sites and
each site has several domain controllers. My question is how do we upgrade
to windows 2008 domain. Is there any schema update we do , if so
what
is
the procedure.
Also what functional levels are there in windows 2008 and what features we
would get with w2008 DC's running in a windows 2003 domain.
Also are there any known issues with upgrading from w2003 to w2008, or
with doing any schema updates.
Thanks
Comfysofa
2009-10-05 10:55:44 UTC
Permalink
Hi - looking to tag on to the rest of this thread if thats ok....im i
the middle of the same thing. Ive successully got my 2008r2 server o
and am looking to decommission the old 2003 server (not R2), reforma
and bring up as 2008R2. My first question is, if i move the RID and PD
fsmo roles to my 2008r2 server will the xp machines (90% of the company
be able to read from the 2008r2 server??

--
Comfysof
-----------------------------------------------------------------------
Comfysofa's Profile: http://forums.techarena.in/members/141265.ht
View this thread: http://forums.techarena.in/windows-2000-active-directory/1221945.ht

http://forums.techarena.i
Meinolf Weber [MVP-DS]
2009-10-05 11:26:11 UTC
Permalink
Hello Comfysofa,

What do you mean with 'read from the 2008r2 server'? Decommissioning a DC
requires moving of all FSMO roles from the DC and also make another GC and
DNS server. Also clients have to be reconfigured for the new DNS server with
DHCP or fixed ip addresses on the NIC.

Demoting the old DC

- reconfigure your clients/servers that they not longer point to the old
DC/DNS server on the NIC

- to be sure that everything runs fine, disconnect the old DC from the network
and check with clients and servers the connectivity, logon and also with
one client a restart to see that everything is ok

- then run dcpromo to demote the old DC, if it works fine the machine will
move from the DC's OU to the computers container, where you can delete it
by hand. Can be that you got an error during demoting at the beginning, then
uncheck the Global catalog on that DC and try again

- check the DNS management console, that all entries from the machine are
disappeared or delete them by hand if the machine is off the network for ever

- also you have to start AD sites and services and delete the old servername
under the site, this will not be done during demotion


Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
Hi - looking to tag on to the rest of this thread if thats ok....im in
the middle of the same thing. Ive successully got my 2008r2 server on
and am looking to decommission the old 2003 server (not R2), reformat
and bring up as 2008R2. My first question is, if i move the RID and
PDC fsmo roles to my 2008r2 server will the xp machines (90% of the
company) be able to read from the 2008r2 server???
http://forums.techarena.in
Comfysofa
2009-10-05 13:51:58 UTC
Permalink
Firstly - thanks very much for the reply (nice to see someones looking
in)

When i say read, what i mean is group policy control, forcing all
machines to run from that. The machine i have put in as a 2008r2 server
is only a temporary machine. Its doesnt have 2 psu's, only the one and
no raid but i have mirrored the drive in software and set it to do a
full backup every day. Not the best solution but while i free up the 2
forest controllers in use at the moment (2003) to in turn get them off
and then back up in 2008r2. I only have the one 2008r2 machine at the
moment and another 2008(64bit) server in a remote server farm that we
have a rack in....

As for the DNS...so what youre describing is the movement of the master
DNS (ours is AD integrated.)

I have to make sure as obviously if anything goes wrong my neck is on
the block....

Again, thanks for the reply...
--
Comfysofa
------------------------------------------------------------------------
Comfysofa's Profile: http://forums.techarena.in/members/141265.htm
View this thread: http://forums.techarena.in/windows-2000-active-directory/1221945.htm

http://forums.techarena.in
unknown
2009-10-06 06:28:26 UTC
Permalink
Hello Comfysofa,

See inline.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
Post by Comfysofa
Firstly - thanks very much for the reply (nice to see someones looking
in)
When i say read, what i mean is group policy control, forcing all
machines to run from that. The machine i have put in as a 2008r2
server is only a temporary machine. Its doesnt have 2 psu's, only the
one and no raid but i have mirrored the drive in software and set it
to do a full backup every day. Not the best solution but while i free
up the 2 forest controllers in use at the moment (2003) to in turn get
them off and then back up in 2008r2. I only have the one 2008r2
machine at the moment and another 2008(64bit) server in a remote
server farm that we have a rack in....
GPOs are applied from machines based on to which OU the GPO is linked. Doesn't
matter which OS version the DC has.
Post by Comfysofa
As for the DNS...so what youre describing is the movement of the
master DNS (ours is AD integrated.)
Can not really follow the question with moving DNS, i was tlaking about moving
the 5 FSMO roles, but with AD integrated zones you are fine and should always
make DCs also DNS server. This way all DNS zone information is replicated
with AD and they are fully writable. Also in a single forest domain like
domain.com make all DCs Global catalog server.
Post by Comfysofa
I have to make sure as obviously if anything goes wrong my neck is on
the block....
Again, thanks for the reply...
http://forums.techarena.in
Comfysofa
2009-10-05 14:38:20 UTC
Permalink
Sorry loads of questions, well ive kicked off and moved 3 of the FSMO
roles, RID, PDC and infrastructure....the R2 isnt a GC but there is one
other GC on the physical site.

DNS - if i add the DNS role to the server (2008R2 server) then that
would become just another read only copy of the master on the 2003
server, yes??
--
Comfysofa
------------------------------------------------------------------------
Comfysofa's Profile: http://forums.techarena.in/members/141265.htm
View this thread: http://forums.techarena.in/windows-2000-active-directory/1221945.htm

http://forums.techarena.in
Meinolf Weber [MVP-DS]
2009-10-06 06:33:04 UTC
Permalink
Hello Comfysofa,

Again inline.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
Post by Comfysofa
Sorry loads of questions, well ive kicked off and moved 3 of the FSMO
roles, RID, PDC and infrastructure....the R2 isnt a GC but there is
one other GC on the physical site.
You have 5 FSMO roles, Schema master and domain naming master are missing
in your list, in a forest/domain like domain.com. As said before in a single
forest domain make all DCs Global catalog server.
Post by Comfysofa
DNS - if i add the DNS role to the server (2008R2 server) then that
would become just another read only copy of the master on the 2003
server, yes??
No, 2008R2 is also DC if i understand you correct and with AD integrated
zones it just has to install the DNS server role during promotion and then
copies automatically the DNS zone information form the other DC. When using
AD integrated DNS all DCs are writable DNS servers.
Post by Comfysofa
http://forums.techarena.in
Comfysofa
2009-10-06 07:28:53 UTC
Permalink
ah, sorry, my schema master and domain naming master are on my 2008
server. so, 3 on one 2 on the other.
--
Comfysofa
------------------------------------------------------------------------
Comfysofa's Profile: http://forums.techarena.in/members/141265.htm
View this thread: http://forums.techarena.in/windows-2000-active-directory/1221945.htm

http://forums.techarena.in
Jorge de Almeida Pinto [MVP - DS]
2009-10-14 17:29:25 UTC
Permalink
check out:
http://blogs.dirteam.com/blogs/jorge/archive/2005/11/19/What-information-is-available-when-UPGRADING-from-W2K_2F00_E2K-to-W2K3-_2800_R2_29002F00_E2K3_3F00_.aspx

some of the info also applies to w2k8
--
Cheers,
(HOPEFULLY THIS INFORMATION HELPS YOU!)

# Jorge de Almeida Pinto # MVP Identity & Access - Directory Services #

BLOG (WEB-BASED)--> http://blogs.dirteam.com/blogs/jorge/default.aspx
BLOG (RSS-FEEDS)--> http://blogs.dirteam.com/blogs/jorge/rss.aspx
------------------------------------------------------------------------------------------
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always test ANY suggestion in a test environment before implementing!
------------------------------------------------------------------------------------------
#################################################
#################################################
------------------------------------------------------------------------------------------
Post by unknown
We are running a naive windows 2003 domain, and now want to upgrade to
windows 2008. We have one forest with 2 domains and have several sites
and each site has several domain controllers. My question is how do we
upgrade to windows 2008 domain. Is there any schema update we do , if so
what is the procedure.
Also what functional levels are there in windows 2008 and what features we
would get with w2008 DC's running in a windows 2003 domain.
Also are there any known issues with upgrading from w2003 to w2008, or
with doing any schema updates.
Thanks
__________ Information from ESET Smart Security, version of virus
signature database 4507 (20091014) __________
The message was checked by ESET Smart Security.
http://www.eset.com
__________ Information from ESET Smart Security, version of virus signature database 4507 (20091014) __________

The message was checked by ESET Smart Security.

http://www.eset.com
Loading...