A

Active Directory Upgrade Strategies
Last Updated: 31 Oct 2005
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

*** PLEASE NOTE: Link(s), If Provided, May Be Wrapped ***


There are several approaches you can take to upgrade
from an NT4 Domain environment to a Windows 2000/2003
Active Directory structure. The method you choose will
depend on a number of factors such as TIME, BUDGET and
SIZE of environment in question.

For the most part, migrating or upgrading from an NT4
domain to Active Directory domain running on 2003 is
identical to the process for 2000, except that there are
now much better tools and more documentation for a 2003
migration.

Upgrading from 2000 to 2003 is a mostly painless affair.
Some caveats exist if you have Exchange servers in your
current environment.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
NOTE: Windows 200x servers (and workstations, of course)
      can participate in NT4 domains, as long as they
      remain Member Servers.  As soon as DCPROMO is
      executed, you have either created or joined an
      Active Directory domain, regardless of whether or
      not any NT4 BDCs exist.

      At no time can an NT4 Server be configured as a
      PDC of a domain, with Windows 200x systems acting
      as "BDCs" of that domain.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The first major question is whether to start with the
servers first, or the workstations. My preference is
workstations first, because it is less disruptive to
the overall environment, and will allow you to gain
some familiarity with Windows 2000 in an isolated
situation (relative to your servers, anyway).

Your approach to installing Active Directory, however,
is pretty much limited to the following:

• Upgrade Current NT4 Domain
• Build New Win2K AD Domain and Migrate Users

If you have rather recent machines, and you are fairly
content with your current domain configuration, then the
first option is easy to do.  Actually, even if you have
an older system as your PDC, you can migrate to AD with
very little difficulty (see STRATEGY #1A).

If, on the other hand, your machines are older, and/or
you want to move away from some decisions that were
made during the life of the NT4 domain, then you should
consider starting a brand new Active Directory domain,
setting up a Trust between the Win2K and NT4 domains,
and migrating users and machines as necessary.


=====================================
STRATEGY #1 - UPGRADE EXISTING DOMAIN
=====================================

0. Backup your existing NT4 domain controllers
1. Build a new NT4 BDC for your existing NT4 domain
2. Promote this machine to PDC (NT4)
3. Take one current NT4 BDC offline (as a contingency)
4. Upgrade the new NT4 PDC to Win200x
5. Build additional Win200x Domain Controllers as necessary
6. Upgrade other NT4 Domain Controllers as necessary

PROS:	No change necessary for clients.

CONS:	You're playing with your only domain.
        Your servers will not be clean installations.

UNDO:	In case of difficulty, take the Win2K PDC
        offline, bring back the BDC you took offline,
	and promote it back to PDC.


=======================================================
STRATEGY #1A - UPGRADE EXISTING DOMAIN (CLEAN INSTALLS)
=======================================================

0. Backup your existing NT4 domain controllers
1. Build a new NT4 BDC for your existing NT4 domain
2. Promote this machine to PDC (NT4)
3. Take one current NT4 BDC offline (as a contingency)
4. Upgrade the new NT4 PDC to Win200x
5. Build a new Win200x domain controller
6. Transfer FSMO roles from the "PDC" to this new DC
7. Take the first DC offline (it can be rebuilt)
8. Build additional Win200x Domain Controllers as necessary
9. Rebuild other NT4 DCs into Win200x DCs as necessary

PROS:	No change necessary for clients.
        Clean installs of Win2K on all servers.
        You can use a wimpy box for steps 1-4

CONS:	You're playing with your only domain.
        More costly in terms of time and machines.

UNDO:	In case of difficulty, take the Win2K PDC
        offline, bring back the BDC you took offline,
	and promote it back to PDC.


===============================================
STRATEGY #2 - BUILD NEW ACTIVE DIRECTORY DOMAIN
===============================================

0. Backup your existing domain controllers
1. Build a new Windows 200x server and setup AD
2. Build some new DCs for this new domain
3. Establish a Trust between the NT4 and Win200x domains
4. Begin moving users and machines into the new domain
5. Finish migration, break trusts, and eliminate NT4

PROS: Old domain still available for fallback purposes.
      Less disruptive to admins. Slower pace of migration.

CONS: Requires lots more time and hardware.
      Will require migration of User Profiles.

UNDO: As long as you still have the NT4 domain, you can
      backout of the entire process.



ACTIVE DIRECTORY IN WINDOWS SERVER 2003

Where AD under Windows 2000 had only Mixed and Native
modes, Windows Server 2003 brings a total of FOUR modes
(now called Domain Functional Levels) to the table.

 1. Windows 2000 mixed (default)
 2. Windows 2000 native
 3. Windows Server 2003 interim
 4. Windows Server 2003

Among other things, the various levels allow for domain
controller interoperability with older versions of Windows.
Mode #4 is the one with the most features, but all of your
domain controllers must be running Windows 2003 Server.

There are also THREE Forest Functional Levels:

 1. Windows 2000 (default)
 2. Windows Server 2003 interim
 3. Windows Server 2003

• http://www.microsoft.com/technet/prodtechnol/windowsserver2003/proddocs/standard/sag_levels.asp


KEY THINGS TO REMEMBER ABOUT NT DOMAINS & ACTIVE DIRECTORY

• Windows 2003 servers make fine members of 2000 domains.

• Windows 200x servers make fine members of NT4 domains.

• Any NT4 domain that introduces a Windows 200x machine
  in the role of Domain Controller, is transformed into
  an Active Directory (200x) domain -- in mixed mode by
  default.

• A 2000 AD domain that introduces a Windows 2003 machine
  in the role of Domain Controller, is transformed into
  a 2003 AD domain -- either in "Windows 2000 Mixed Mode"
  or "Windows 2000 Native Mode" (or functional level).

• The PDC emulator in 2003 is much better than the one in
  2000, so once the domain has been upgraded to 2003, the
  PDC emulator role should be moved to the 2003 server.


TRANSFERING FSMO ROLES

Although Active Directory domain controllers are peers,
there are 5 roles which can only exist on one DC at any
given time.  They are called Flexible Single Master
Operations (FSMO) roles, and here is how you can transfer
them from one controller to another:

• http://support.microsoft.com/?KBID=255690http://support.microsoft.com/?KBID=324801http://support.microsoft.com/?KBID=255504


UPGRADING FROM NT4 TO 2003

• http://www.enterpriseitplanet.com/networking/features/article.php/2237741http://download.microsoft.com/download/d/a/7/da767448-6875-489c-96e6-2003e036de6d/03_Chapter_2_NT4MigAD.dochttp://www.microsoft.com/windowsserver2003/upgrading/nt4/tooldocs/http://techrepublic.com.com/5100-6268-1058251.htmlhttp://www.computerperformance.co.uk/w2k3/W2K3_ADMT.htmhttp://networking.earthweb.com/netsysm/article.php/10954_3075471_2http://support.microsoft.com/?KBID=325851http://www.microsoft.com/downloads/details.aspx?FamilyID=e92cf6a0-76f0-4e25-8de0-19544062a6e6&displaylang=en


UPGRADING FROM 2000 TO 2003

• http://support.microsoft.com/?KBID=555040http://support.microsoft.com/?KBID=325379


MIGRATIONS & TRANSFERING USERS (via LDIFDE)

• http://support.microsoft.com/?KBID=283791http://www.microsoft.com/windows2000/techinfo/administration/redir-ldifde.asphttp://www.microsoft.com/windows2000/downloads/tools/admt/http://builder.com.com/article.jhtml?id=r00220020605low01.htmhttp://www.jsiinc.com/SUBJ/tip4700/rh4795.htm


AD MIGRATION TOOL

• ADMT v2 ................ http://support.microsoft.com/?KBID=326480
• ADMT v3 ................ http://www.microsoft.com/downloads/details.aspx?FamilyID=6f86937b-533a-466d-a8e8-aff85ad3d212&DisplayLang=en


AD CLIENT EXTENSIONS

• http://www.microsoft.com/windows2000/downloads/tools/adclient/http://support.microsoft.com/?KBID=811497


DOMAIN NAME

• http://support.microsoft.com/?KBID=237675http://support.microsoft.com/?KBID=260362http://support.microsoft.com/?KBID=254680http://support.microsoft.com/?KBID=296250http://www.faqs.org/rfcs/rfc1591.html


SETTING UP DNS IN 2000/2003

• http://www.microsoft.com/downloads/details.aspx?familyid=15d276a5-4bf6-4add-9f67-56b38ccb576b&displaylang=enhttp://www.microsoft.com/windows2000/technologies/communications/dns/http://www.microsoft.com/windows2000/techinfo/reskit/en-us/cnet/cncf_imp_zzui.asphttp://www.microsoft.com/resources/documentation/windowsserv/2003/all/deployguide/en-us/dnsbd_dns_pxsr.asphttp://support.microsoft.com/?KBID=825036


DNS TROUBLESHOOTING IN 2000/2003

• http://support.microsoft.com/?KBID=291382http://support.microsoft.com/?KBID=275278http://support.microsoft.com/default.aspx?scid=/support/win2000/dns.asp&FR=1


DISASTER RECOVERY FOR AD

• http://www.microsoft.com/technet/prodtechnol/windows2000serv/technologies/activedirectory/support/adrecov.mspxhttp://www.microsoft.com/technet/community/events/windows2003srv/tnt1-94.mspxhttp://www.microsoft.com/technet/community/events/windows2000srv/tnt1-76.mspxhttp://support.microsoft.com/servicedesks/webcasts/wc031902/wcblurb031902.asphttp://www.jsifaq.com/SUBE/tip2300/rh2384.htmhttp://www.4mcts.com/downloads/addisaster.pdf


SIZING AND MAINTENANCE

• http://support.microsoft.com/?KBID=222019http://support.microsoft.com/?KBID=229602http://www.microsoft.com/windows2000/downloads/tools/sizer/http://www.microsoft.com/windows2000/techinfo/reskit/tools/new/adsizer-o.asphttp://labmice.techtarget.com/ActiveDirectory/AD_replication.htm


WINDOWS SMALL BUSINESS SERVER (SBS) -- UPGRADE FAQs

• http://www.microsoft.com/windowsserver2003/sbs/techinfo/overview/generalfaq.mspxhttp://www.microsoft.com/WindowsServer2003/sbs/upgrade/


WHITEPAPERS & TECH DOCUMENTS

• http://www.microsoft.com/technet/prodtechnol/windows2000serv/technologies/activedirectory/maintain/opsguide/http://www.computerperformance.co.uk/dns_dhcp_wins.htmhttp://www.netpro.com/ebook/http://www.nalanda.nitc.ac.in/resources/cse/ebooks/Win2k_srvr/Chapter02.pdfhttp://labmice.techtarget.com/ActiveDirectory/http://www.ibilce.unesp.br/courseware/win2000/pt5_1.htmhttp://www.serverwatch.com/tutorials/article.php/1474461http://www.swynk.com/friends/dinicolo/adquick.asphttp://msdn.microsoft.com/library/en-us/dnduwon/html/d5activedir.asphttp://support.microsoft.com/?KBID=237675http://support.microsoft.com/?KBID=260362http://www.microsoft.com/windows2000/technologies/directory/ad/http://www.microsoft.com/windows2000/techinfo/planning/activedirectory/manadsteps.asphttp://www.microsoft.com/technet/prodtechnol/windowsserver2003/proddocs/standard/sag_levels.asphttp://support.microsoft.com/default.aspx?view/tn.asp?kb=300921http://support.microsoft.com/?KBID=197132http://support.microsoft.com/?KBID=223787http://support.microsoft.com/?KBID=255504http://support.microsoft.com/?KBID=260362http://support.microsoft.com/?KBID=292541http://www.microsoft.com/technet/itsolutions/howto/admhow.asphttp://www.microsoft.com/technet/win2000/win2ksrv/add.asphttp://www.microsoft.com/windows2000/en/server/help/sag_ADtopnode.htmhttp://www.microsoft.com/windows2000/guide/server/features/activedirectory.asphttp://www.microsoft.com/windows2000/library/planning/walkthroughs/http://www.microsoft.com/windows2000/library/resources/reskit/dpg/http://www.microsoft.com/windows2000/techinfo/planning/incremental/domainup.asphttp://www.microsoft.com/windows2000/techinfo/planning/pds-cduadtoc.asphttp://www.windows-expert.net/faq/Active-Directory/upgrade-nt-domain-to-active-directory.asphttp://www.unisys.com/Windows2000/AssocDocs/migration%20white%20paper.PDFhttp://labmice.net/networking/networkbasics.htmhttp://www.win2000mag.com/Articles/Index.cfm?ArticleID=4692http://www.win2000mag.com/Articles/Index.cfm?ArticleID=15922http://www.win2000mag.com/Articles/Index.cfm?ArticleID=21422http://www.win2000mag.com/Articles/Index.cfm?ArticleID=8958


PERSONAL NOTES

• Sep 2005: ADMT v3 has just been released.   Many of the
  requested improvements have been provided.  For very
  large migrations, there are still better 3rd party tools
  available, but for small or straight-forward migrations,
  ADMT is very effective.

• It's a toss-up between #1 and #1A, unless your servers
  have a whole lot of junk installed, and could do with
  a clean start.

• Always have good backups, and a good plan from the very
  beginning.  An Active Directory install/migration is not
  time time to play "fly by the seat of your pants".

• Backup the Schema as soon as possible, if not before.

• A domain which has a Windows 2000 machine running in it
  as a domain controller, is an Active Directory domain.
  You cannot have a Win2K DC act as a BDC for any NT4
  domain.

• Any domain which is running Windows 2003 as a domain
  controller is a Windows 2003 Active Directory domain,
  and has the option of running in one of the following
  FOUR Domain Functionality Levels:
	Windows 2000 mixed (default)
	Windows 2000 native
	Windows Server 2003 interim
  	Windows Server 2003

• The info on Domain & Forest functional levels can also
  be found in the Windows 2003 HELP system

• Although NT4 and Win9x machines are supported in 2000
  domains via the AD Client, by default, 2003 does not
  allow Win9x machines or NT4 pre-SP4 systems to connect
  to a 2003 Active Directory domain.  See Q811497

• Mastering Windows Server 2003 by Mark Minasi is a great
  book for anyone who is new to Active Directory and
  Windows 2000/2003


RELATED TOPICS (ALSO IN THIS ARCHIVE)

• http://KB.UltraTech-llc.com/?File=ToWin2K.TXThttp://KB.UltraTech-llc.com/?File=ADNetwork.TXThttp://KB.UltraTech-llc.com/?File=CopyPerms.TXThttp://KB.UltraTech-llc.com/?File=CopyProfile.TXThttp://KB.UltraTech-llc.com/?File=NewServer.TXThttp://KB.UltraTech-llc.com/?File=Win2000.TXThttp://KB.UltraTech-llc.com/?File=Windows.TXThttp://KB.UltraTech-llc.com/?File=TestInstall.TXThttp://KB.UltraTech-llc.com/?File=Upgrades.TXThttp://KB.UltraTech-llc.com/?File=ServerSpecs.TXT
July 21, 2017

Active Directory Upgrade Strategies

Active Directory Upgrade Strategies Last Updated: 31 Oct 2005 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ *** PLEASE NOTE: Link(s), If Provided, May Be Wrapped *** There are several approaches you can […]
July 21, 2017

Alternative Office Suite Software for Windows

Alternative Office Suite Software for Windows Last Updated: 30 May 2005 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ *** PLEASE NOTE: Link(s), If Provided, May Be Wrapped *** Microsoft Office is by […]
July 21, 2017

Alternative x86 Operating Systems

Alternative x86 Operating Systems Last Updated: 16 Jul 2003 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ *** PLEASE NOTE: Link(s), If Provided, May Be Wrapped *** Here's a list of additional x86 […]
July 21, 2017

The Answer To Life

The Answer To Life Last Updated: 26 Aug 2001 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ *** PLEASE NOTE: Link(s), If Provided, May Be Wrapped *** The answer to the ultimate question […]
July 21, 2017

AntiSPAM Solutions for Windows (Desktops & Gateways)

AntiSPAM Solutions for Windows (Desktops & Gateways) Last Updated: 18 Sep 2005 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ *** PLEASE NOTE: Link(s), If Provided, May Be Wrapped *** The following products […]
July 21, 2017

Running Older Apps in Windows 2000/XP/2003

Running Older Apps in Windows 2000/XP/2003 Last Updated: 04 Nov 2003 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ *** PLEASE NOTE: Link(s), If Provided, May Be Wrapped *** There are some applications […]
July 21, 2017

Managing File Associations

accManaging File Associations Last Updated: 02 Jun 2001 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ *** PLEASE NOTE: Link(s), If Provided, May Be Wrapped *** Besides the Windows Explorer GUI, there are […]
July 21, 2017

Auditing File Access In Windows NT/2000/XP/2003

Auditing File Access In Windows NT/2000/XP/2003 Last Updated: 23 Sep 2005 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ *** PLEASE NOTE: Link(s), If Provided, May Be Wrapped *** File Auditing is a […]
July 21, 2017

Configuring Windows For Automatic Logon

Configuring Windows For Automatic Logon Last Updated: 04 Jul 2004 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ *** PLEASE NOTE: Link(s), If Provided, May Be Wrapped *** Although it is generally considered […]