Upgrade Active Directory from WS03 to WS08 R2

First of all thanks to everyone that attended my session ” Upgrade Active Directory from WS03 to WS08 R2″ at Microsoft Tech Days 2011 in Sweden. For those of you that couldn’t attend on site I did a session on upgrading a Windows Server 2003 Active Directory environment to Window Server 2008 R2 with a focus on automated processes. The scripts used in this session (also available for download at this blog) were developed by the Enfo Zipper – Directory Services Team and used in a real world scenario to upgrade an enterprise customer’s forest.

FYI: The session will be available online later during the spring.

 

Note: The steps below including the sample scripts is provided “AS-IS” with no warranties. Some of the sample scripts have a dependence that the Windows Support Tools for Windows Server 2003 – Service Pack 2 are installed on all Domain Controllers.

 

Table 1.1 Upgrade Active Directory from WS03 to WS08 R2 Sample Scripts

 

 

 

 

In addition to the presentation slide’s I will also share some additional information about compatibility between a forest/domain running Windows Server 2003 DCs compared to running Windows Server 2008 R2 and how this can effect LOB apps, services and your business.

 

Prepare a new Windows Server 2008 R2 Domain Controller

 

Operating System Configuration

 

We generally recommend that customers apply its standard Windows Server 2008 R2 Standard Edition image as long as your desired “Domain Controller Configuration” (Disk layout, Unnecessary agents are uninstalled) is applied.
Note: If you’re going to reuse the name that the previous Windows Server 2003 DC you’re replacing had, assign a temporary name.

 

The following hotfixes should be installed to prevent known issues when introducing Windows Server 2008 R2 Domain Controllers:

 

Note: The listed hotfixes has to be installed before the machine is promoted to domain controller (Or Windows Server 2008 R2 Service Pack 1).

 

Table 3.2   Required Domain Controller Hotfixes before promotion

 

 

We recommend that in addition to those hotfixes, the customer should ensure that the machine has reached the desired/approved patch level within the organization.

 

 

1. Replace an existing Windows Server 2003 Domain Controller

   DHCP Service
   If the particular domain controller also acting as a DHCP Server, Logon using Domain Admin or DHCP Administrator credentials (the later also requires the logon locally right).
   Use the following steps to backup the DHCP database:

 

 

• Click Start, click Run, type cmd in the Open box, and then click OK.

 

• Type md C:migdata and then press enter.

 

• Type net use X: \serverprojectshare <TBD>

 

• Type CD scripts and press enter.

 

• Type GetDHCPConfig.BAT -export and press enter.

  Note: While the export command runs, DHCP server is stopped and does not respond to clients seeking new leases or lease renewals. (Verify if there is another DHCP server with overlapping scopes in the same site and/or service interruption is approved)

 

DNS Service

 

If the particular domain controller also acting as a DNS Server and hosting additional none Active Directory Integrated Zones. (Active Directory Integrated Zones are stored in Active Directory and will be replicated to the destination domain controller)

 

Logon using Domain Admins or DNS Admins (the later also requires the logon locally right).Use the following steps to backup none Active Directory Integrated Zones:

 

 

• Click Start, click Run, type cmd in the Open box, and then click OK.

 

• Type md C:migdata and then press enter (if not already created in a previous step)

 

• Type net use X: \serverprojectshare <TBD> (if not already created in a previous step)

 

• Type CD scripts and press enter.

 

• Type GetDNSConfig.BAT and press enter.

  
  Note: While the export command runs, The DNS Services is stopped and started.

 

Event Logs

 

We recommend to backup the event logs of the domain controller prior to the replacement since it can help with troubleshooting.

 

 

1. Click Start, click Run, type cmd in the Open box, and then click OK.

 

1. Type md C:migdata and then press enter (if not already created in a previous step)

 

1. Type net use X: \serverprojectshare <TBD> (if not already created in a previous step)

 

1. Type CD scripts and press enter.

 

1. Type script copyLogs.vbs and press enter (make sure the logs where successfully backed up)

 

TCP/IP Settings

 

Save the TCP/IP Settings configuration so those can be applied to the destination domain controller.

 

 

1. Click Start, click Run, type cmd in the Open box, and then click OK

 

1. Type md C:migdata and then press enter (if not already created in a previous step)

 

1. Type net use X: \serverprojectshare <TBD> (if not already created in a previous step)

 

1. Type CD scripts and press enter.

 

1. Type GetIPConfig.bat and press enter

 

System State Backup

 

Ensure there is enough and health system backups before proceeding to next step.

 

Backup the captured configuration in previous step by taking the following steps:

 

 

1. Type net use X: \serverprojectshare <TBD>

 

1. Type xcopy C:migdata X:DCs%computername% /E and then press enter.

 

Directory Services

 

This is the final step and enters the critical point of no return where the Windows Server 2003 Domain Controller is going to be demoted to a member server and will no longer acting as a Directory Service Agent (DSA) or a replica (Replication Partner) and won’t keep an instance of the Directory Services Database.

 

Enfo Zipper recommends to run the demotion process unattended and automated to avoid mistakes and errors.

 

 

1. Click Start, click Run, type cmd in the Open box, and then click OK.

 

1. Type net use X: \serverprojectshare <TBD> (if not already created in a previous step)

 

1. Type CD scripts and press enter.

 

1. Type cscript RunDCPromo.VBS . (The demotion process should now start, please wait while the Windows Server 2003 Domain Controller being demoted and restarts)

 

Decommissioning

 

Logon to the server as local administrator using the password specified in the unattended_demote.txt file above and either shutdown the server and/or disconnect it from the network. For safety reasons we recommend that the server is renamed to something else before its shutdown and that the IP-address is changed from static to dynamic.

 

 

1. Click Start, click Run, type cmd in the Open box, and then click OK

 

1. Type netdom renamecomputer %computername% /NewName:%computername%_retired and press enter

 

1. Type netsh interface ip set address “Local Area Connection” dhcp and press enter.
   Note: The name “Local Area Connection” may differ from server to server.

 

1. Type shutdown –s –t 00 and press enter.

 

 

1. 
   Promote a new Windows Server 2008 R2 Domain Controller

   Configure TCP/IP Settings and Names
   Logon locally to the domain controller and take the following steps in order to restore the name and TCP/IP Settings from the retired Windows Server 2003 Domain Controller that this domain controller is intend to replace:

   1. Click Start, click Run, type cmd in the Open box, and then click OK
   1. Type net use X: \serverprojectshare <TBD>
   1. Type CD scripts and press enter.
   1. Type xcopy X:DCs<NAME OF SOURCE DC> C:restore /E
   1. Type netdom renamecomputer %computername% /NewName:<NAME> and press enter (if you wish to re-use the same name)
   1. Type netsh interface ip set dns “Local Area Connection” static <IP_OF_WIN2K3DC>
      Note: The name “Local Area Connection” may differ from server to server
   1. Type netsh interface ip set dns “Local Area Connection” static <IP_OF_NEARESTBYDC>
      Note: The name “Local Area Connection” may differ from server to server
   1. Type shutdown –r –t 00

   Promote the server to a Domain Controller
   Logon locally to the domain controller and take the following steps in order to promote the server to Domain Controller, Enfo Zipper recommends to run the promotion process unattended and automated to avoid mistakes and errors.

   1. Click Start, click Run, type cmd in the Open box, and then click OK.
   1. Type net use X: \serverprojectshare <TBD> (if not already created in a previous step)
   1. Type dcpromo /answer: X:scriptsunattended_first.txt and press enter. (The promotion process should now start, please wait while the Windows Server 2008 R2 Domain Controller is being promoted and restarts)

   Verify that the promotion to Doman Controller was successful
   Logon as Domain Admin to the domain controller and take the following steps in order to verify that the promotion of the Domain Controller completed successfully without errors

   1. Once logged on back, Review the DCPROMO.txt log file. Click Start, Click run and type Notepad C:WindowsDebugdcpromo.log and press enter. Search the file for the word error using notepad, ensure there were no errors, close notepad.
   1. Quickly review the DCPROMOUI.log file. Click Start, Click run and type Notepad C:WindowsDebugdcpromoui.log and press enter. Close notepad.

   DNS Service
   Enfo Zipper recommends that full replication has taken place before you proceed with the following step, in order to ensure that please run the DNSConvergeCheck script between the local domain controller and one of the domain controllers in the hub site.
   The DNSConvergeCheck script can be found at: http://go.microsoft.com/fwlink/?LinkId=135502
   If full replication has taken place, please proceed with the following commands in order to import DNS Zone data (None-Active Directory integrated Zones).

   1. Click Start, click Run, type cmd in the Open box, and then click OK
   1. Type net use X: \serverprojectshare <TBD> (if not already created in a previous step)
   1. Type CD scripts and press enter.
   1. Type SetDNSConfig.BAT
   1. All DNS Zones should now successfully have been restored.

   DHCP Service
   Logon as Enterprise Admin and take the following steps to install the DHCP Server service and restore the database and settings for the Windows Server 2003 Domain Controller.

   1. Click Start, click Run, and click Administrative Tools and then Click PowerShell Modules
   1. Type Add-WindowsFeature DHCP and press enter. (if asked to/promoted to restart the server, please follow the instructions given)
   1. If a restart was required, Logon back as Enterprise Admin, Click Start, click Run, type cmd in the Open box, and then click OK
   1. Type net use X: \serverprojectshare <TBD> (if not already created in a previous step)
   1. Type CD scripts and press enter.
   1. Type sc config dhcpserver start= auto
   1. Type SetDHCPConfig.BAT -import

   Post-Operating System Configuration
   The following hotfixes should be installed to prevent known issues when introducing Windows Server 2008 R2 Domain Controllers:
   
   Note: The listed hotfixes has to be installed after the machine is promoted to domain controller (Or Windows Server 2008 R2 Service Pack 1)

   Table 3.6   Required Domain Controller Hotfixes after promotion

   Microsoft KB	Description
   978387 (http://go.microsoft.com/fwlink/?LinkId=184915):	Dcdiag fails with error code 0x621
   978277 (http://go.microsoft.com/fwlink/?LinkId=184911):	The specified account does not exist
   978516 (http://go.microsoft.com/fwlink/?LinkId=185190)	Significant delays when you read the same set of files several times
   978837 (http://go.microsoft.com/fwlink/?LinkId=185191)	Group Policy Management Editor window crashes when you apply some changes for NRPT policy settings

   Disable EDNS
   Disable EDNS to avoid issues with global DNS servers that doesn’t support EDNS, (Not needed if forwarders is configured to handle external DNS queries outside the forest and to the internet)

   1. Click Start, click Run, type cmd in the Open box, and then click OK
   1. Type dnscmd /config /EnableEDNSProbes 0 and press enter.

   Configure Kerberos supported encryption types
   Note this step is only required if the domain contains service accounts and/or computer accounts that are configured to use DES-only encryption.

   1. In the Group Policy Management Console (GPMC), locate the following location: Computer Configuration Windows Settings Security Settings Local Policies Security Options
      
   1. Click to select the Network security: Configure encryption types allowed for Kerberos option.
      
   1. Click to select Define these policy settings and all the six check boxes for the encryption types
      .
   1. Click OK. Close the GPMC.

   Note: The policy sets the SupportedEncryptionTypes registry entry to a value of 0x7FFFFFFF. The SupportedEncryptionTypes registry entry is at the following location:
   HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemKerberosparameters