upgrading domain controllers from Server 2000 to Server 2008

Brantley Allen · External Since: Jan 14, 2009 Posts: 1

What is the process to upgrade my domain and domain controllers to Windows
Server 2008? Do I just run the forestprep and domainprep before the install
or is there more to this?
--
Brantley Allen
System Administrator
Pounds Photographic Labs

Meinolf Weber [MVP-DS] · External Since: Jan 14, 2009 Posts: 2

Hello Brantley,

You can not do an inplace upgrade, only possible with 2003 SP1 and higher.
See this way:

!!!NEVER START BEFORE HAVING CREATED AND TESTED A BACKUP OF YOUR DATA/MACHINE!!!

One question first:
Is there also an Exchange server in the domain? If yes which version and
on what server role?

- On the old server open DNS management console and check that you are running
Active directory integrated zone (easier for replication, if you have more
then one DNS server)

- run replmon from the run line or repadmin /showrepl, dcdiag and netdiag
from the command prompt on the old machine to check for errors, if you have
some post the complete output from the command here or solve them first.
For this tools you have to install the support\tools\suptools.msi from the
2000 installation disk.

- run adprep /forestprep and adprep /domainprep and adprep /rodcprep from
the 2008 installation disk against the 2000 schema master, with an account
that is member of the Schema admins, to upgrade the schema to the new version
(44), you can check the version with "schupgr" in a command prompt.

- Install the new machine as a member server in your existing domain

- configure a fixed ip and set the preferred DNS server to the old DNS server
only

- run dcpromo and follow the wizard to add the 2008 server to an existing
domain, make it also Global catalog.

- if you are prompted for DNS configuration choose Yes. If not, install DNS
role after promotion.

- for DNS give the server time for replication, at least 15 minutes. Because
you use Active directory integrated zones it will automatically replicate
the zones to the new server. Open DNS management console to check that they
appear

- if the new machine is domain controller and DNS server run again replmon,
dcdiag and netdiag (copy the netdiag from the 2003 to 2008, will work) on
both domain controllers

- Transfer, NOT seize the 5 FSMO roles to the new Domain controller (http://support.microsoft.com/kb/324801
applies also for 2008)

- you can see in the event viewer (Directory service) that the roles are
transferred, also give it some time

- reconfigure the DNS configuration on your NIC of the 2008 server, preferred
DNS itself, secondary the old one

- if you use DHCP do not forget to reconfigure the scope settings to point
to the new installed DNS server

- export and import of DHCP database for 2008 choose "netshell dhcp backup"
and "netshell dhcp restore" command (http://technet.microsoft.com/en-us/library/cc772372.aspx)

- for additional DC's choose the same way, except the FSMO, DHCP and WINS
part

Demoting the old DC's

- reconfigure your clients/servers that they not longer point to the old
DC/DNS server on the NIC

- to be sure that everything runs fine, disconnect the old DC from the network
and check with clients and servers the connectivity, logon and also with
one client a restart to see that everything is ok

- then run dcpromo to demote the old DC, if it works fine the machine will
move from the DC's OU to the computers container, where you can delete it
by hand. Can be that you got an error during demoting at the beginning, then
uncheck the Global catalog on that DC and try again

- check the DNS management console, that all entries from the machine are
disappeared or delete them by hand if the machine is off the network for ever

- also you have to start AD sites and services and delete the old servername
under the site, this will not be done during demotion

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

> What is the process to upgrade my domain and domain controllers to
> Windows Server 2008? Do I just run the forestprep and domainprep
> before the install or is there more to this?
>

Jorge Silva · External Since: May 02, 2006 Posts: 138

Hi
Each scenario/network is different and may require different approaches. I
suggest that you read, plan and test before implementing.
You can start here:
http://technet.microsoft.com/en-us/library/cc755199.aspx

--
I hope that the information above helps you.
Have a Nice day.

Jorge Silva
MCSE, MVP Directory Services

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.
"Brantley Allen" <pounds DeleteThis @news.postalias> wrote in message
news:606C2FE3-500C-4569-ABFC-B460EA8CD0C9@microsoft.com...
> What is the process to upgrade my domain and domain controllers to Windows
> Server 2008? Do I just run the forestprep and domainprep before the
> install
> or is there more to this?
> --
> Brantley Allen
> System Administrator
> Pounds Photographic Labs

Cyril · External Since: Jan 16, 2009 Posts: 2

Hello

When we upgrade AD from 2000 to 2008, some groups are not created, like the
group "Serveurs de licences des services Terminal Server" (in english
Terminal server service licence server) in builtin
Did you encounter the problem?
Thank you

"Meinolf Weber [MVP-DS]" wrote:

> Hello Brantley,
>
> You can not do an inplace upgrade, only possible with 2003 SP1 and higher.
> See this way:
>
>
> !!!NEVER START BEFORE HAVING CREATED AND TESTED A BACKUP OF YOUR DATA/MACHINE!!!
>
> One question first:
> Is there also an Exchange server in the domain? If yes which version and
> on what server role?
>
> - On the old server open DNS management console and check that you are running
> Active directory integrated zone (easier for replication, if you have more
> then one DNS server)
>
> - run replmon from the run line or repadmin /showrepl, dcdiag and netdiag
> from the command prompt on the old machine to check for errors, if you have
> some post the complete output from the command here or solve them first.
> For this tools you have to install the support\tools\suptools.msi from the
> 2000 installation disk.
>
> - run adprep /forestprep and adprep /domainprep and adprep /rodcprep from
> the 2008 installation disk against the 2000 schema master, with an account
> that is member of the Schema admins, to upgrade the schema to the new version
> (44), you can check the version with "schupgr" in a command prompt.
>
> - Install the new machine as a member server in your existing domain
>
> - configure a fixed ip and set the preferred DNS server to the old DNS server
> only
>
> - run dcpromo and follow the wizard to add the 2008 server to an existing
> domain, make it also Global catalog.
>
> - if you are prompted for DNS configuration choose Yes. If not, install DNS
> role after promotion.
>
> - for DNS give the server time for replication, at least 15 minutes. Because
> you use Active directory integrated zones it will automatically replicate
> the zones to the new server. Open DNS management console to check that they
> appear
>
> - if the new machine is domain controller and DNS server run again replmon,
> dcdiag and netdiag (copy the netdiag from the 2003 to 2008, will work) on
> both domain controllers
>
> - Transfer, NOT seize the 5 FSMO roles to the new Domain controller (http://support.microsoft.com/kb/324801
> applies also for 2008)
>
> - you can see in the event viewer (Directory service) that the roles are
> transferred, also give it some time
>
> - reconfigure the DNS configuration on your NIC of the 2008 server, preferred
> DNS itself, secondary the old one
>
> - if you use DHCP do not forget to reconfigure the scope settings to point
> to the new installed DNS server
>
> - export and import of DHCP database for 2008 choose "netshell dhcp backup"
> and "netshell dhcp restore" command (http://technet.microsoft.com/en-us/library/cc772372.aspx)
>
> - for additional DC's choose the same way, except the FSMO, DHCP and WINS
> part
>
>
> Demoting the old DC's
>
> - reconfigure your clients/servers that they not longer point to the old
> DC/DNS server on the NIC
>
> - to be sure that everything runs fine, disconnect the old DC from the network
> and check with clients and servers the connectivity, logon and also with
> one client a restart to see that everything is ok
>
> - then run dcpromo to demote the old DC, if it works fine the machine will
> move from the DC's OU to the computers container, where you can delete it
> by hand. Can be that you got an error during demoting at the beginning, then
> uncheck the Global catalog on that DC and try again
>
> - check the DNS management console, that all entries from the machine are
> disappeared or delete them by hand if the machine is off the network for ever
>
> - also you have to start AD sites and services and delete the old servername
> under the site, this will not be done during demotion
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and confers
> no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>
> > What is the process to upgrade my domain and domain controllers to
> > Windows Server 2008? Do I just run the forestprep and domainprep
> > before the install or is there more to this?
> >
>
>
>

Meinolf Weber [MVP-DS] · External Since: Jan 16, 2009 Posts: 29

Hello Cyril,

This will happen if the PDCEmulator role is still on the 2000 DC. So did
you move the 5 FSMO roles to the new 2008 DC? If not you should move the
FSMO roles.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

> Hello
>
> When we upgrade AD from 2000 to 2008, some groups are not created,
> like the
> group "Serveurs de licences des services Terminal Server" (in english
> Terminal server service licence server) in builtin
> Did you encounter the problem?
> Thank you
> "Meinolf Weber [MVP-DS]" wrote:
>
>> Hello Brantley,
>>
>> You can not do an inplace upgrade, only possible with 2003 SP1 and
>> higher. See this way:
>>
>> !!!NEVER START BEFORE HAVING CREATED AND TESTED A BACKUP OF YOUR
>> DATA/MACHINE!!!
>>
>> One question first:
>> Is there also an Exchange server in the domain? If yes which version
>> and
>> on what server role?
>> - On the old server open DNS management console and check that you
>> are running Active directory integrated zone (easier for replication,
>> if you have more then one DNS server)
>>
>> - run replmon from the run line or repadmin /showrepl, dcdiag and
>> netdiag from the command prompt on the old machine to check for
>> errors, if you have some post the complete output from the command
>> here or solve them first. For this tools you have to install the
>> support\tools\suptools.msi from the 2000 installation disk.
>>
>> - run adprep /forestprep and adprep /domainprep and adprep /rodcprep
>> from the 2008 installation disk against the 2000 schema master, with
>> an account that is member of the Schema admins, to upgrade the schema
>> to the new version (44), you can check the version with "schupgr" in
>> a command prompt.
>>
>> - Install the new machine as a member server in your existing domain
>>
>> - configure a fixed ip and set the preferred DNS server to the old
>> DNS server only
>>
>> - run dcpromo and follow the wizard to add the 2008 server to an
>> existing domain, make it also Global catalog.
>>
>> - if you are prompted for DNS configuration choose Yes. If not,
>> install DNS role after promotion.
>>
>> - for DNS give the server time for replication, at least 15 minutes.
>> Because you use Active directory integrated zones it will
>> automatically replicate the zones to the new server. Open DNS
>> management console to check that they appear
>>
>> - if the new machine is domain controller and DNS server run again
>> replmon, dcdiag and netdiag (copy the netdiag from the 2003 to 2008,
>> will work) on both domain controllers
>>
>> - Transfer, NOT seize the 5 FSMO roles to the new Domain controller
>> (http://support.microsoft.com/kb/324801 applies also for 2008)
>>
>> - you can see in the event viewer (Directory service) that the roles
>> are transferred, also give it some time
>>
>> - reconfigure the DNS configuration on your NIC of the 2008 server,
>> preferred DNS itself, secondary the old one
>>
>> - if you use DHCP do not forget to reconfigure the scope settings to
>> point to the new installed DNS server
>>
>> - export and import of DHCP database for 2008 choose "netshell dhcp
>> backup" and "netshell dhcp restore" command
>> (http://technet.microsoft.com/en-us/library/cc772372.aspx)
>>
>> - for additional DC's choose the same way, except the FSMO, DHCP and
>> WINS part
>>
>> Demoting the old DC's
>>
>> - reconfigure your clients/servers that they not longer point to the
>> old DC/DNS server on the NIC
>>
>> - to be sure that everything runs fine, disconnect the old DC from
>> the network and check with clients and servers the connectivity,
>> logon and also with one client a restart to see that everything is ok
>>
>> - then run dcpromo to demote the old DC, if it works fine the machine
>> will move from the DC's OU to the computers container, where you can
>> delete it by hand. Can be that you got an error during demoting at
>> the beginning, then uncheck the Global catalog on that DC and try
>> again
>>
>> - check the DNS management console, that all entries from the machine
>> are disappeared or delete them by hand if the machine is off the
>> network for ever
>>
>> - also you have to start AD sites and services and delete the old
>> servername under the site, this will not be done during demotion
>>
>> Best regards
>>
>> Meinolf Weber
>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>> confers
>> no rights.
>> ** Please do NOT email, only reply to Newsgroups
>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>> What is the process to upgrade my domain and domain controllers to
>>> Windows Server 2008? Do I just run the forestprep and domainprep
>>> before the install or is there more to this?
>>>

Cyril · External Since: Jan 16, 2009 Posts: 2

Thank you.
But, if i move the fsmo role, how to recreate the group ?

"Meinolf Weber [MVP-DS]" wrote:

> Hello Cyril,
>
> This will happen if the PDCEmulator role is still on the 2000 DC. So did
> you move the 5 FSMO roles to the new 2008 DC? If not you should move the
> FSMO roles.
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and confers
> no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>
> > Hello
> >
> > When we upgrade AD from 2000 to 2008, some groups are not created,
> > like the
> > group "Serveurs de licences des services Terminal Server" (in english
> > Terminal server service licence server) in builtin
> > Did you encounter the problem?
> > Thank you
> > "Meinolf Weber [MVP-DS]" wrote:
> >
> >> Hello Brantley,
> >>
> >> You can not do an inplace upgrade, only possible with 2003 SP1 and
> >> higher. See this way:
> >>
> >> !!!NEVER START BEFORE HAVING CREATED AND TESTED A BACKUP OF YOUR
> >> DATA/MACHINE!!!
> >>
> >> One question first:
> >> Is there also an Exchange server in the domain? If yes which version
> >> and
> >> on what server role?
> >> - On the old server open DNS management console and check that you
> >> are running Active directory integrated zone (easier for replication,
> >> if you have more then one DNS server)
> >>
> >> - run replmon from the run line or repadmin /showrepl, dcdiag and
> >> netdiag from the command prompt on the old machine to check for
> >> errors, if you have some post the complete output from the command
> >> here or solve them first. For this tools you have to install the
> >> support\tools\suptools.msi from the 2000 installation disk.
> >>
> >> - run adprep /forestprep and adprep /domainprep and adprep /rodcprep
> >> from the 2008 installation disk against the 2000 schema master, with
> >> an account that is member of the Schema admins, to upgrade the schema
> >> to the new version (44), you can check the version with "schupgr" in
> >> a command prompt.
> >>
> >> - Install the new machine as a member server in your existing domain
> >>
> >> - configure a fixed ip and set the preferred DNS server to the old
> >> DNS server only
> >>
> >> - run dcpromo and follow the wizard to add the 2008 server to an
> >> existing domain, make it also Global catalog.
> >>
> >> - if you are prompted for DNS configuration choose Yes. If not,
> >> install DNS role after promotion.
> >>
> >> - for DNS give the server time for replication, at least 15 minutes.
> >> Because you use Active directory integrated zones it will
> >> automatically replicate the zones to the new server. Open DNS
> >> management console to check that they appear
> >>
> >> - if the new machine is domain controller and DNS server run again
> >> replmon, dcdiag and netdiag (copy the netdiag from the 2003 to 2008,
> >> will work) on both domain controllers
> >>
> >> - Transfer, NOT seize the 5 FSMO roles to the new Domain controller
> >> (http://support.microsoft.com/kb/324801 applies also for 2008)
> >>
> >> - you can see in the event viewer (Directory service) that the roles
> >> are transferred, also give it some time
> >>
> >> - reconfigure the DNS configuration on your NIC of the 2008 server,
> >> preferred DNS itself, secondary the old one
> >>
> >> - if you use DHCP do not forget to reconfigure the scope settings to
> >> point to the new installed DNS server
> >>
> >> - export and import of DHCP database for 2008 choose "netshell dhcp
> >> backup" and "netshell dhcp restore" command
> >> (http://technet.microsoft.com/en-us/library/cc772372.aspx)
> >>
> >> - for additional DC's choose the same way, except the FSMO, DHCP and
> >> WINS part
> >>
> >> Demoting the old DC's
> >>
> >> - reconfigure your clients/servers that they not longer point to the
> >> old DC/DNS server on the NIC
> >>
> >> - to be sure that everything runs fine, disconnect the old DC from
> >> the network and check with clients and servers the connectivity,
> >> logon and also with one client a restart to see that everything is ok
> >>
> >> - then run dcpromo to demote the old DC, if it works fine the machine
> >> will move from the DC's OU to the computers container, where you can
> >> delete it by hand. Can be that you got an error during demoting at
> >> the beginning, then uncheck the Global catalog on that DC and try
> >> again
> >>
> >> - check the DNS management console, that all entries from the machine
> >> are disappeared or delete them by hand if the machine is off the
> >> network for ever
> >>
> >> - also you have to start AD sites and services and delete the old
> >> servername under the site, this will not be done during demotion
> >>
> >> Best regards
> >>
> >> Meinolf Weber
> >> Disclaimer: This posting is provided "AS IS" with no warranties, and
> >> confers
> >> no rights.
> >> ** Please do NOT email, only reply to Newsgroups
> >> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
> >>> What is the process to upgrade my domain and domain controllers to
> >>> Windows Server 2008? Do I just run the forestprep and domainprep
> >>> before the install or is there more to this?
> >>>
>
>
>

Meinolf Weber [MVP-DS] · External Since: Jan 16, 2009 Posts: 29

Hello Cyril,

Think it will do automatically, just move the FSMO roles. That should be
done in any case.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

> Thank you.
> But, if i move the fsmo role, how to recreate the group ?
> "Meinolf Weber [MVP-DS]" wrote:
>
>> Hello Cyril,
>>
>> This will happen if the PDCEmulator role is still on the 2000 DC. So
>> did you move the 5 FSMO roles to the new 2008 DC? If not you should
>> move the FSMO roles.
>>
>> Best regards
>>
>> Meinolf Weber
>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>> confers
>> no rights.
>> ** Please do NOT email, only reply to Newsgroups
>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>> Hello
>>>
>>> When we upgrade AD from 2000 to 2008, some groups are not created,
>>> like the
>>> group "Serveurs de licences des services Terminal Server" (in
>>> english
>>> Terminal server service licence server) in builtin
>>> Did you encounter the problem?
>>> Thank you
>>> "Meinolf Weber [MVP-DS]" wrote:
>>>> Hello Brantley,
>>>>
>>>> You can not do an inplace upgrade, only possible with 2003 SP1 and
>>>> higher. See this way:
>>>>
>>>> !!!NEVER START BEFORE HAVING CREATED AND TESTED A BACKUP OF YOUR
>>>> DATA/MACHINE!!!
>>>>
>>>> One question first:
>>>> Is there also an Exchange server in the domain? If yes which
>>>> version
>>>> and
>>>> on what server role?
>>>> - On the old server open DNS management console and check that you
>>>> are running Active directory integrated zone (easier for
>>>> replication,
>>>> if you have more then one DNS server)
>>>> - run replmon from the run line or repadmin /showrepl, dcdiag and
>>>> netdiag from the command prompt on the old machine to check for
>>>> errors, if you have some post the complete output from the command
>>>> here or solve them first. For this tools you have to install the
>>>> support\tools\suptools.msi from the 2000 installation disk.
>>>>
>>>> - run adprep /forestprep and adprep /domainprep and adprep
>>>> /rodcprep from the 2008 installation disk against the 2000 schema
>>>> master, with an account that is member of the Schema admins, to
>>>> upgrade the schema to the new version (44), you can check the
>>>> version with "schupgr" in a command prompt.
>>>>
>>>> - Install the new machine as a member server in your existing
>>>> domain
>>>>
>>>> - configure a fixed ip and set the preferred DNS server to the old
>>>> DNS server only
>>>>
>>>> - run dcpromo and follow the wizard to add the 2008 server to an
>>>> existing domain, make it also Global catalog.
>>>>
>>>> - if you are prompted for DNS configuration choose Yes. If not,
>>>> install DNS role after promotion.
>>>>
>>>> - for DNS give the server time for replication, at least 15
>>>> minutes. Because you use Active directory integrated zones it will
>>>> automatically replicate the zones to the new server. Open DNS
>>>> management console to check that they appear
>>>>
>>>> - if the new machine is domain controller and DNS server run again
>>>> replmon, dcdiag and netdiag (copy the netdiag from the 2003 to
>>>> 2008, will work) on both domain controllers
>>>>
>>>> - Transfer, NOT seize the 5 FSMO roles to the new Domain controller
>>>> (http://support.microsoft.com/kb/324801 applies also for 2008)
>>>>
>>>> - you can see in the event viewer (Directory service) that the
>>>> roles are transferred, also give it some time
>>>>
>>>> - reconfigure the DNS configuration on your NIC of the 2008 server,
>>>> preferred DNS itself, secondary the old one
>>>>
>>>> - if you use DHCP do not forget to reconfigure the scope settings
>>>> to point to the new installed DNS server
>>>>
>>>> - export and import of DHCP database for 2008 choose "netshell dhcp
>>>> backup" and "netshell dhcp restore" command
>>>> (http://technet.microsoft.com/en-us/library/cc772372.aspx)
>>>>
>>>> - for additional DC's choose the same way, except the FSMO, DHCP
>>>> and WINS part
>>>>
>>>> Demoting the old DC's
>>>>
>>>> - reconfigure your clients/servers that they not longer point to
>>>> the old DC/DNS server on the NIC
>>>>
>>>> - to be sure that everything runs fine, disconnect the old DC from
>>>> the network and check with clients and servers the connectivity,
>>>> logon and also with one client a restart to see that everything is
>>>> ok
>>>>
>>>> - then run dcpromo to demote the old DC, if it works fine the
>>>> machine will move from the DC's OU to the computers container,
>>>> where you can delete it by hand. Can be that you got an error
>>>> during demoting at the beginning, then uncheck the Global catalog
>>>> on that DC and try again
>>>>
>>>> - check the DNS management console, that all entries from the
>>>> machine are disappeared or delete them by hand if the machine is
>>>> off the network for ever
>>>>
>>>> - also you have to start AD sites and services and delete the old
>>>> servername under the site, this will not be done during demotion
>>>>
>>>> Best regards
>>>>
>>>> Meinolf Weber
>>>> Disclaimer: This posting is provided "AS IS" with no warranties,
>>>> and
>>>> confers
>>>> no rights.
>>>> ** Please do NOT email, only reply to Newsgroups
>>>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>>>> What is the process to upgrade my domain and domain controllers to
>>>>> Windows Server 2008? Do I just run the forestprep and domainprep
>>>>> before the install or is there more to this?
>>>>>