Download pdf - How to migrate Windows 2003 Active Directory to Windows 2008 Active Directory—–Step by Step guide _ Information Technology Blog

1/28/14 How to migrate Windows 2003 Active Directory to Windows 2008 Active Directory—–Step by Step guide | Information Technology Blog

araihan.wordpress.com/2009/08/25/migrate-from-windows-2003-active-directory-to-windows-2008-active-directory-step-by-step/ 1/24

Ads by safesaver. More Info | Hide These Ads

Information Technology Blog

By Raihan Al-Beruni

How to migrate Windows 2003 Active Directory toWindows 2008 Active Directory—–Step by Step guide

i

35 Votes

Microsoft’s new baby in their server family is Windows Server 2008. The Windows Server® 2008 operating

system ease operation of IT administrator and enterprise IT planner and designer. Windows 2008 Active

Directory got improved roles, AD domain services, federation services, AD rights management services,

compliances and BPA. Its time to shift to Windows 2008 Active Directory. In this article, I will show how to

migrate from windows 2003 AD to windows 2008 AD.

On Windows Server 2003 DC, insert the Windows Server 2008 DVD, then open command prompt and

change directory to d:\sources\adprerp directory. Here D:\ is my dvd rom drive. In your case do as

appropriate. note: you need to log on to windows 2003 domain controller as enterprise admin to run thesecommand.

http://araihan.wordpress.com/2009/08/25/migrate-from-windows-2003-active-directory-to-windows-2008-active-directory-step-by-step/#


http://araihan.wordpress.com/



Now run following command adprep/ forestprep

(http://araihan.files.wordpress.com/2009/08/01.jpg)



After finishing forestprep run adprep/ domainprep



adprep/ rodcprep (Optional)

Install windows 2008 server and promote windows 2008 server as additional domain controller in windows

2003 forest

http://araihan.files.wordpress.com/2009/08/01.jpg









This is a trial version of windows 2008, I do not find any necessity to mention any cd key for this article. If

you have proper cd key, you can mention here.









Windows 2008 will ask you to reset password for the first time. note: password complexity is enabled by

default.









Now you have completed installing Windows 2008 machine. Log on as an administrator. Add active

directory role in windows 2008 server. follow the screenshot as shown below






































Mention your existing domain name, provide domain admin credentials to add this server to domain.





















A restore password is required in case you need to restore AD.
















Now restart windows 2008 server. It takes few minutes to replicate all AD container, AD object and DNSrecords. I would prefer to wait more then hours and see all the records are available in windows 2008 activedirectory. or you can force replicate all record if necessary.

Now transfer all the FSMO roles from windows 2003 AD domain controller to windows 2008 AD domaincontroller. Log on to windows 2003 domain controller as enterprise admin. open command prompt type asfollows:

ntdsutil

roles

connections

connect to server WIN2008SERVERNAME

q

Transfer domain naming master

Transfer PDC

Transfer Schema Master

Transfer RID master

Transfer infrastructure master











Now you are ready to demod windows 2003 domain controller. log on to windows 2003 domain controlleras domain admin . Open AD sites and services from administrative tools, expand default first site name,expand windows 2003 domain controller, right click on NTDS settings and go to properties. uncheck globalcatalog, click ok.









(http://araihan.files.wordpress.com/2009/08/untitled7.jpg)

open run from start menu type dcpromo



LEAVE THIS ABOVE BOX UNCHECKED, this will enable windows 2003 domain controller transfer allAD database to windows 2008 domain controller.


Click next, provide password and follow next prompt, wait until demotion completed. Restart…. That’s all.

http://araihan.files.wordpress.com/2009/08/untitled7.jpg






You May Like

1.

This entry was posted on Tuesday, August 25th, 2009 at 12:31 PM and is filed under Microsoft ActiveDirectory, Windows 2003 Server, Windows 2008 Server. You can follow any responses to this entry through

the RSS 2.0 feed. You can leave a response, or trackback from your own site.

34 Responses to How to migrate Windows 2003 Active Directory to

Windows 2008 Active Directory—–Step by Step guide

Bikram says:

March 7, 2011 at 12:57 AMHI, Thats a very good Step by Step, thanks for the efforts put in for this..

I have some questions

1) Are the steps same for domain having exchange 2003 part of it.2) are the steps same for migrating 2003 32 bit to 2008 r2 64 bit.

3) what will be impact on 2003 site to site trust relationships4) will all the user & passwords, policies, login scripts,etc. will be migrated or extra steps are involved init.

have to upgrade my domin 2003 32 bit (also a file server) to 2008 r2 64 bit with exchange 2003 sp2 32bit, to exchange 2010 64 bit. sharepoint 2007 32 bit to 2010 64 bit

phew thats lot of work nd mental pressure

thanks in advance

ReplySnehal says:July 5, 2012 at 4:43 AM

Hi,

when i given command adprep /forestperp on windows 2003 r2 server. it give error the system

About these ads (http://en.wordpress.com/about-

these-ads/)

http://www.digitaltrends.com/cars/cadillac-concept-powered-thorium-lasers-can-last-100-years/

http://araihan.wordpress.com/category/microsoft-active-directory/

http://araihan.wordpress.com/category/windows-2003-server/

http://araihan.wordpress.com/category/windows-2008-server/

http://araihan.wordpress.com/2009/08/25/migrate-from-windows-2003-active-directory-to-windows-2008-active-directory-step-by-step/feed/

http://araihan.wordpress.com/2009/08/25/migrate-from-windows-2003-active-directory-to-windows-2008-active-directory-step-by-step/#respond

http://araihan.wordpress.com/2009/08/25/migrate-from-windows-2003-active-directory-to-windows-2008-active-directory-step-by-step/trackback/

http://araihan.wordpress.com/2009/08/25/migrate-from-windows-2003-active-directory-to-windows-2008-active-directory-step-by-step/#comment-399

http://araihan.wordpress.com/2009/08/25/migrate-from-windows-2003-active-directory-to-windows-2008-active-directory-step-by-step/?replytocom=399#respond


http://en.wordpress.com/about-these-ads/



when i given command adprep /forestperp on windows 2003 r2 server. it give error the systemcannot execute the specified program.

please help

ReplyRoger Eales says:February 19, 2013 at 9:32 PMuse adprep32.exe for 32 bit DC servers

Bikram says:March 7, 2011 at 1:33 AM

HI, Thats a very good Step by Step, thanks for the efforts put in for this..

I have some questions

1) Are the steps same for domain having exchange 2003 part of it.2) are the steps same for migrating 2003 32 bit to 2008 r2 64 bit.3) what will be impact on Domain 2003 site to site trust relationships

4) will all the user & passwords, policies, login scripts,etc. will be migrated or extra steps are involved init.

have to upgrade my domin 2003 32 bit (also a file server) to 2008 r2 64 bit with exchange 2003 sp2 32

bit, to exchange 2010 64 bit. SharePoint 2007 32 bit to 2010 64 bit

phew!!! that’s gonna be lot of work and mental pressure

thanks in advance

ReplyRaihan Al-Beruni says:March 7, 2011 at 12:28 PMYes lot of work to do.

1) Yes. if you have Exchange 2003 and you to upgrade exchange to 2010 you will follow the steps toupgrade AD.2) Yes.3) Trust relationship will be valid for other sites having win2k3 DC.

4)User, password, policies will migrate. no further steps required

Once you have completed transition of AD. Do not raise Forest functional level to win2k8 native you

will do this after exchange 2010 transition. Exchange 2010 & 2003 can co-exist.

Step1: Transition AD from 2k3 to 2k8 with forest level 2k3Step2: follow this http://microsoftguru.com.au/2009/10/29/transitioning-from-exchange-server-2003-

to-exchange-server-2010-step-by-step/Step3: Remove Exchange 2003step4: raise Forest functional to win2k8 NativeStep5: Transition Sharepoint

Hope this help. feel free to contact again. Thanks for visiting my site.







http://microsoftguru.com.au/2009/10/29/transitioning-from-exchange-server-2003-to-exchange-server-2010-step-by-step/



ReplySam says:August 17, 2011 at 12:27 PM

This is an excellent step-by-step. However I can’t seem to get DNS examination part. It said domainname cannot be contacted.

Reply

Suman Pal says:November 23, 2011 at 10:42 PMI’ve also faced the same problem

ReplySam says:August 17, 2011 at 12:27 PM

This is an excellent step-by-step. However I can’t seem to get DNS examination part. It said domainname cannot be contacted.

ReplyJose Lopez says:November 18, 2011 at 12:30 AMCurrent my 2003 DC holds the Schema Master and Domain Naming Master, but my Exchange 2003

Server holds the PDC, RID, and Infrastructure.

Can I still move all FSMO (5) to my new Windows 2008 DC and no problems with my 2003 ExchangeServer?

ReplyRaihan Al-Beruni says:

November 18, 2011 at 1:27 PMyes you can move all FSMO role without any trouble at all. Exchange contact GC server to get allthe information it needs. Make win2k8 server GC and wait for replication. in short no problemmigrating fsmo

ReplyZay says:January 18, 2012 at 4:14 AM

Good tutorial, however, I had to use adprep32 in order to get the command to run. Just thought I mightadd that in case anyone had trouble simply getting adprep to run.

ReplyGirish says:February 12, 2012 at 7:19 PMWhile transferring roles we are getting error “This computer is a non-replication partner. Do you want to

continue wit the transfer.” and asking to forcebly transfer the roles.. Is it save to continue with or whatsteps needs to be taken?

Reply

Jose Lopez says:February 22, 2012 at 2:06 AM




















I already performed the first phase, and ready for the transfer of the FSMO roles, but I had to make thenew W2K8 the new DHCP by transferring the DHCP setting and activating the Role. DNS seems to be

okay, but what about Printing Services, I guess that I have to recreate the PrintServer? Can youelaborate on that transition. Great document.

ReplySantosh Yadav says:March 14, 2012 at 9:45 PMHi Raihan,

Really very nice and complete step-by-step guide.I have few queries and suggestions from you.

We have two offices in two cities Pune and Mumbai, Pune is main hub location and Mumbai is branchoffice.

Pune Office setup (Hub location) – 100 Users: Leased Line Internet connection ( 3Mbps)

1) Windows 2003 R2 Active Directory server

2) Mail (Sendmail – Linux)

3) FTP Server (Linux) ( Pune ADS integration )

5) File server(Linux) ( Pune ADS integration )

6) Open Fire Chat server ( Pune ADS integration )

Mumbai Office (Branch Office-30 Users) : 4 Mbps DSL Internet connection

1) Windows 2008 R2 Active Directory Server

—————–Presently there is no connection between both the above Active Directories. But offices are connectedusing site to site IPSec VPN using firewall’s.

Some users are traveling between both offices on a regular basis. All the above servers are at hublocation and having access to all users including branch office.

We want to achieve following goals :

1) Upgrade/Migrate existing windows 2003 active directory server to Windows 2008 R2 64 bit server onbetter and new server hardware.

2) Want to create a central user database for Pune and Mumbai offices, So one user can avail on both

location.

3) How can I change or convert branch office Win 2008 R2 Active Directory server to Read Only

Domain Controller and it will be part of New Active Directory Server of Pune office.

I need your help and suggestions to achieve the above goals.





Thank you for the nice post.

Regards,Santosh Yadav

ReplyRaihan Al-Beruni says:March 15, 2012 at 1:50 PM

Install Win2k8 R2 in PunePromote as PDC and Other FSMO RolesDemote old 2003 DC

Allow DNS and LDAP protocol over IPSEc VPN for Mumbai office

Install Win2k8 R2 in MumbaiPromote as a RODC in Mumbai (http://technet.microsoft.com/en-us/library/cc754629(v=ws.10).aspx)Migrate users from Mumbai to DC in Pune using

http://www.microsoft.com/download/en/details.aspx?id=17488

You are good to go now.

ReplyWesly says:March 30, 2012 at 10:26 PM

When I try to demote my old w2k3 at the last fase of the steps it gives an error that i need to remove myCertification Services, yet how do i this?

Thanks in advance


April 5, 2012 at 2:47 PMdo you have certificate services installed in Domain controller? backup CA and install a separate CA.than demot

ReplyRichard says:May 10, 2012 at 7:52 PMI have a single forest and single domain and 4 sites with 2 dc each the FSMO roles are available

in one site however GC is configured in every site. I have exchange 2010 and lots of applicationintergrated with AD.can you please guide me to the process of upgrade to win2008 active directory.does the upgrade impact the integrated application with AD. if yes can you please tell me how

can I take care of the application that integrated with AD.does the upgrade impact the exchange envirnoment.

Mou says:April 7, 2012 at 4:39 PMHi Raihan,




http://technet.microsoft.com/en-us/library/cc754629(v=ws.10)

http://www.microsoft.com/download/en/details.aspx?id=17488











Thanks for the step by step procedures….I have some quires in the migration process….for our infrastructure…or please propose the properupgrade procedure for migration/upgrade from 2k3 to 2k8 DC.

We have 30 DCs across few countries.These DCs are integrated with DNS role.Some have DHCP & fileprint server role.

So here we have to upgrade DCs with few existing roles and few will be fresh 2008 DCs.

here Schema is already extended for forest as root domain is running on win 2k8.

we have to upgrade our exchange envt from 2003 to 2010 also.

a.local||b.a.local , g.a.local ………………x.a.local

|target.b.a.local

this is the forest structure of our AD…

We have only rights on target.b.a.local

a.local is already in win2k8 DC rolewe have to upgrade target.b.a.local DCs from win2K3 to win2K8 DCs.

Please suggest the best approach of upgrade process.

Reply

shaik says:April 23, 2012 at 10:14 PMgood articles,keep it up

ReplyAsfandyar says:May 10, 2012 at 12:14 AM

I must say here that Raihan Al-Beruni has done a marvelous job. Thumbs up to you buddy.

ReplyRichard Reda says:

May 15, 2012 at 11:45 AMThanks Raihan for the very useful step by step guide, however can you guide me with the following. theaim to migrate to windows 2008Existing setup.

7 sites with 2 DC each win2k3.Exchange 2010 available and lots of other application connectedhow can I migrate to windows 2008 and should I follow the same steps above since I have exchange 2010and lots of other application.

finally what is the impact on the application that integrated with AD 2k3









Thank you very much in advance

ReplySonny says:May 30, 2012 at 9:33 PMThis is very usefull for me, thanks. I have a problem using DCPROMO, it nags about dns not able to

reach. I figured out that dns should be point to the new server and not the old one. In DHCP setup of thenew server, dns is all fine and all computers in the network can be reached properly.

Replysanju says:June 9, 2012 at 10:44 PMHi,

We have two domian(abc.test.com and xyz.test.com) and 8 DC,each site have both domian dc.

currently OS of all Dc’s is win 2003 R2 and FFL=win 2000,DFL=win 2000 native.

I want to upgrade the dc into win 2008 R2 so please can you tell me what i have to do step by step.

Replysanju says:June 9, 2012 at 10:46 PM

sorry i forgot to share no of site.3 sites

Replyeric says:August 8, 2012 at 11:50 AMDear Sir

I step by step to do it. when I dcpromo remove Old AD, it have error.Old AD can not rejoin Domain, if I use Dcpromo / foXXXXXX. it can remove. But New AD can notrunning. I make sure FSMO is migrated. and DNS is working,

and then I find out Sysvol have not file.Do you have any suggest to fix the problem?

Old Server: 03 SVR STD + Exchange 2003New Server: 08 R2 64bit

ThanksEric

ReplyAidin says:March 31, 2013 at 6:05 PMVery good job dude. Thanks for this useful guide.

There two missing parts which can be included in this document which are my questions too. They are:1. Post Migration steps: What should be done (i.e. changing IP’s, DHCP, DNS, etc.)? When and how













should be done? Do we need to do these before demoting the source server?

2. Testing the Migration: How can I make sure that the migration has been successful before demotingthe source/old server?

thank you


April 2, 2013 at 11:14 AM1. Since DC changed. What: Change your DHCP configuration. Change DNS record in all servers.When immediately changing to new. do it before demoting old DC.

2. run netdom query fsmo and http://microsoftguru.com.au/2009/09/01/active-directory-health-check/ , http://microsoftguru.com.au/2011/05/28/microsoft-active-directory-best-practice/ and

http://microsoftguru.com.au/2012/07/29/microsoft-active-directory-best-practice-part-ii/

Reply

Aidin says:April 3, 2013 at 2:01 PM

Thanks for the prompt reply.

What do you mean by “Change DNS record in all servers.”? Do you mean the IP configurationsin member servers?

Raihan Al-Beruni says:April 4, 2013 at 4:20 PM

You need to change primary DNS record in all member servers. your new Doamin controller

should point itself as primary DNS server.

rln says:

May 9, 2013 at 12:40 PMI am in process of migrating existing 32 bit code to 64 bit. Currently this application is working with

windows 2k3 server ADDS. When I upgrade/migrate to 64 bit win 2k8server ADDS, what implicationswill it have on my 64 bit code? Will there be any changes required etc to connect and make it work?


May 12, 2013 at 5:12 PM

nope. just follow the link.

Reply

Bintabubakar says:September 15, 2013 at 2:56 PM

Hi i need help urgently followed the steps above to replace our old dc. Demoted the old one and took itoffline as its not needed anymore but I cannot edit group policies I get an error message that Says i

might not have sufficient privileges and that the path cannot be found. I can however create new polices

but when I try to do gpupdate I get an error message again that polices can’t be updated. Tried to forceupdate but that didn’t help either. Thank u in advance





http://microsoftguru.com.au/2009/09/01/active-directory-health-check/

http://microsoftguru.com.au/2011/05/28/microsoft-active-directory-best-practice/

http://microsoftguru.com.au/2012/07/29/microsoft-active-directory-best-practice-part-ii/















September 19, 2013 at 9:49 AMwhat privileges you have in new domain controller? Are you are domain admin? Please check

FSMO roles in new server? does new server has five roles? type netdom query fsmo to see fsmo roles.

Reply

The Contempt Theme.

Blog at WordPress.com.

Follow

Follow “Information Technology Blog”

Powered by WordPress.com

Ads by safesaver. More Info | Hide These Ads



http://theme.wordpress.com/themes/contempt/

http://wordpress.com/?ref=footer

http://wordpress.com/signup/?ref=lof

