Upgrading Windows 2000 Domains to Windows Server 2003 Domains

Transcription

1 C H A P T E R 9 Upgrading Windows 2000 Domains to Windows Server 2003 Domains Upgrading yor network operating system from Microsoft Windows 2000 to Windows Server 2003 reqires minimal network configration and typically has a low impact on ser operations. The pgrade process is straightforward, efficient, and allows yor organization to take advantage of the improved secrity that is offered by Windows Server In This Chapter Overview of Upgrading Yor Windows 2000 Domains to Windows Server 2003 Domains Planning to Upgrade Windows 2000 Domains to Windows Server 2003 Domains Completing Pre-Upgrade Tasks Upgrading Windows 2000 Domains to Windows Server 2003 Domains Completing Post-Upgrade Tasks Additional Resorces Related Information For more information abot designing the Active Directory directory service logical strctre and the DNS infrastrctre needed to spport Active Directory, see Designing the Active Directory Logical Strctre in this book. For more information abot Active Directory fnctional levels, see Enabling Advanced Windows Server 2003 Active Directory Featres in this book. For more information abot pgrading from Microsoft Windows NT version 4.0 to Windows Server 2003 Active Directory, see Upgrading Windows NT 4.0 Domains to Windows Server 2003 Active Directory in this book. For more information abot deploying a DNS infrastrctre for name resoltion on yor network, see Deploying DNS in Deploying Network Services of this kit.

2 356 Chapter 9 Upgrading Windows 2000 Domains to Windows Server 2003 Domains Overview of Upgrading Yor Windows 2000 Domains to Windows Server 2003 Domains By pgrading yor network operating system from Microsoft Windows 2000 Server to the Microsoft Windows Server 2003, Standard Edition; Windows Server 2003, Enterprise Edition; or Windows Server 2003, Datacenter Edition operating system, yo can maintain yor crrent network and domain configration while improving the secrity, scalability, and manageability of yor network infrastrctre. Prior to pgrading yor Windows 2000 domains, review yor bsiness objectives and decide how they relate to yor existing Active Directory infrastrctre. Althogh yor objectives might not reqire other significant changes to yor existing environment, the operating system pgrade is an opportne time to review yor existing Active Directory design, inclding yor Active Directory logical strctre, site topology, and domain controller capacity. Yo might find opportnities for increased efficiencies and cost savings that yo can incorporate into yor pgrade process. Additionally, ensre that yo test yor pgrade process in a lab and pilot program. For more information abot lab testing and piloting, see Planning an Active Directory Deployment Project in this book. When the domain pgrade process is complete, all domain controllers will be rnning Windows Server 2003, and the Active Directory domain and forest will be operating at the Windows Server 2003 fnctional level. At the Windows Server 2003 forest fnctional level, yo can take advantage of all advanced Active Directory featres. For more information abot advanced Active Directory featres related to Active Directory fnctional levels, see Enabling Advanced Windows Server 2003 Active Directory Featres in this book. Note For a list of the job aids that are available to assist yo in pgrading from Windows 2000 Server to Windows Server 2003, see Additional Resorces later in this chapter.

3 Overview of Upgrading Yor Windows 2000 Domains to Windows Server 2003 Domains 357 Process for Upgrading Windows 2000 Domains to Windows Server 2003 Domains Upgrading yor Windows 2000 Active Directory environment to a Windows Server 2003 Active Directory environment involves completing several tasks. Figre 9.1 shows the tasks in the pgrade process. Figre 9.1 Upgrading Windows 2000 Domains to Windows Server 2003 Domains Plan to pgrade Windows 2000 domains to Windows Server 2003 domains Complete pre-pgrade tasks Upgrade Windows 2000 domains to Windows Server 2003 domains Complete post-pgrade tasks

4 358 Chapter 9 Upgrading Windows 2000 Domains to Windows Server 2003 Domains Backgrond Information for Upgrading Windows 2000 Domains to Windows Server 2003 Domains Before yo begin the process of pgrading yor Windows 2000 Active Directory environment to Windows Server 2003 Active Directory, become familiar with some important isses that affect the pgrade process. Active Directory Preparation Tool To prepare yor Windows 2000 forest and domains for pgrade to Windows Server 2003 Active Directory, or for the introdction of a new Windows Server 2003 based domain controller, yo mst se the Active Directory Preparation tool (Adprep.exe). Adprep.exe is located on the Windows Server 2003 operating system CD. Adprep.exe prepares the forest and domains for an Active Directory pgrade by performing a collection of operations prior to the installation of the first Windows Server 2003 based domain controller, inclding: Extending yor crrent schema with new schema information that Adprep.exe provides, while preserving previos schema modifications in yor environment. Resetting permissions on containers and objects throghot the directory for improved secrity and interoperability with new Windows Server 2003 domains. Copying administrative tools to manage new Windows Server 2003 domains to the local compter. Note Changes made by Adprep.exe do not affect the fnctioning of Windows NT 4.0 based or Windows 2000 based domain controllers. For more information abot sing Adprep.exe to prepare yor environment, see Prepare Yor Infrastrctre for Upgrade later in this chapter. Application Directory Partitions for DNS Application directory partitions provide storage for application-specific data that can be replicated to a specific set of domain controllers in the same forest. If yo have at least one domain controller in yor forest rnning Windows Server 2003 and the domain naming master is also rnning Windows Server 2003, yo can take advantage of application directory partitions.

5 Overview of Upgrading Yor Windows 2000 Domains to Windows Server 2003 Domains 359 For example, yo can se application directory partitions to store DNS data on Windows Server 2003 based domain controllers. DNS-specific application directory partitions are atomatically created in the forest and in each domain when the DNS service is installed on new or pgraded Windows Server 2003 based domain controllers. If application directory partition creation fails dring Active Directory installation, DNS attempts to create the partitions again every time that the service starts. The following DNS-specific application directory partitions are created dring Active Directory installation: Note The creation and deletion of application directory partitions, inclding the defalt DNS application directory partitions, reqires that the domain naming master role holder reside on a Windows Server 2003 based domain controller. ForestDnsZones A forest-wide application directory partition shared by all DNS servers in the same forest DomainDnsZones Domain-wide application directory partitions for each DNS server in the same domain SRV resorce records A Windows Server 2003 based domain controller s Net Logon service ses dynamic pdates to register SRV resorce records in the DNS database, as described in A DNS RR for specifying the location of services (DNS SRV). For more information abot this draft, see the Internet Engineering Task Force (IETF) web page. This SRV record is sed to map the name of a service, sch as the Lightweight Directory Access Protocol (LDAP) service, to the DNS compter name of a server that offers that service. In a Windows Server 2003 network, an LDAP resorce record locates a domain controller. A workstation that is logging on to a Windows Server 2003 domain qeries DNS for SRV records in the general form: _Service._Protocol.DnsDomainName where Service is the service reqested, Protocol is the protocol reqested, and DnsDomainName is the flly qalified DNS name of the Active Directory domain. Active Directory servers offer the LDAP service over the TCP protocol; therefore, clients find an LDAP server by qerying DNS for a record of the form: _ldap._tcp.dnsdomainname Note The service and protocol strings reqire an nderscore (_) prefix to prevent potential collisions with existing names in the namespace.

6 360 Chapter 9 Upgrading Windows 2000 Domains to Windows Server 2003 Domains This format is applicable for implementations of LDAP servers other than Windows Server 2003 based domain controllers and also possible implementations of LDAP directory services that employ Global Catalog servers other than servers rnning Windows Server _msdcs.domain_name sbdomain This Microsoft-specific sbdomain allows location of domain controllers that have Windows Server 2003 specific roles in the domain, as well as the location by globally niqe identifier (GUID) when a domain has been renamed. To facilitate location of Windows Server 2003 based domain controllers, the Net Logon service in addition to the standard _Service._Protocol.DnsDomainName format records, also registers SRV records that identify the well-known server-type psedonyms dc (domain controller), gc (Global Catalog), pdc (primary domain controller), and domains (GUID) as prefixes in the _msdcs.domain_name sbdomain. To accommodate locating domain controllers by server type or by GUID (abbreviated dctype ), Windows Server 2003 based domain controllers register SRV records in the following form in the _msdcs.domain_name sbdomain: _Service._Protocol.DcType._msdcs.DnsDomainName _msdcs.forest_root_domain sbdomain The _msdcs.forest_root_domain sbdomain stores forest-wide resorce records that are of interest to clients and domain controllers from all parts of the forest. For example, all domain controllers in the forest register CNAME and LDAP, Kerberos, and GC SRV resorce records in the msdcs.forest_root_domain sbdomain. The CNAME resorce records are sed by the replication system to locate replication partners and the GC SRV resorce records are sed by clients to lookp global catalog servers. For any two domain controllers to replicate with each other, inclding two domain controllers from the same domain, they mst be able to look p forest-wide locator records. For a newly created domain controller to participate in replication, it mst be able to register its forest-wide records in DNS, and other domain controllers mst be able to look p these records. Therefore, the DNS servers that are athoritative for the _msdcs.forest_root_domain sbdomain needs to be available for replication and global catalog lookps. For this reason, it is recommended that yo create a separate _msdcs.forest_root_domain zone and define its replication scope so that it is replicated to all DNS servers in the forest. For more information abot creating a separate _msdcs.forest_root_domain zone, see KB article To find this article, see the Microsoft Knowledge Base link on the Web Resorces page at Some organizations rnning Windows 2000 Active Directory already created an _msdcs.forest_root_domain to help clients locate domain controllers more efficiently. If an _msdcs.forest_root_domain already exists in yor Windows 2000 environment, then it is recommended that yo move the zone to the ForestDnsZones application directory partition after all domain controllers in the forest are rnning Windows Server In addition, for each domain in the forest, move the _msdcs.domain_name zone to the DomainDnsZones application directory partition for that domain.

7 Overview of Upgrading Yor Windows 2000 Domains to Windows Server 2003 Domains 361 Moving the Active Directory integrated DNS zones into the domain and forest-wide application directory partitions provides the following benefits: Becase the forest-wide application directory partition can replicate otside a specified domain, and becase moving the _msdcs.forest_root_domain into the forest-wide application directory partition replicates it to all domain controllers in the forest that are rnning the DNS service, yo do not have to se DNS zone transfer to replicate the zone file information to DNS servers otside the domain. Domain-wide replication can be targeted to minimize replication traffic becase administrators can specify which of the domain controllers rnning the DNS service receive the DNS zone data. Forest-wide replication can be targeted to minimize replication traffic becase DNS data is no longer replicated to the global catalog. DNS records located on global catalog servers in the forest are removed, minimizing the amont of information replicated with the global catalog. For more information abot sing application directory partitions to store DNS data, see Use DNS Application Directory Partitions later in this chapter. Intrasite Replication Freqency Windows 2000 domain controllers that are pgraded to Windows Server 2003 maintain their defalt intrasite replication freqency of 300/30. This means that any changes made to Active Directory replicate to all other domain controllers in the same site five mintes (300 seconds) after a change is made, with a 30-second offset before notifying the next domain controller, ntil the forest fnctional level is raised to Windows Server When the forest fnctional level is raised to Windows Server 2003, the replication freqency of Active Directory is changed to the Windows Server 2003 defalt setting of 15/3. This means that changes will replicate to all domain controllers in the same site 15 seconds after a change is made, with a 3-second offset before notifying the next domain controller. If yo modified the 300/30 defalt replication freqency setting in Windows 2000, the setting does not change to the 15/3 defalt setting in Windows Server 2003 after yo complete the pgrade. However, a new installation of Windows Server 2003 will always se the 15/3 intrasite replication freqency setting. Important Do not modify the defalt 300/30 intrasite replication freqency on Windows 2000 domain controllers. Instead, pgrade yor Windows 2000 domain to Windows Server 2003 and raise the forest fnctional level to Windows Server 2003 to take advantage of the 15/3 intrasite replication freqency.

8 362 Chapter 9 Upgrading Windows 2000 Domains to Windows Server 2003 Domains New Grops and New Grop Memberships Created After Upgrading the PDC After pgrading the Windows 2000 based domain controller holding the role of the PDC emlator in each domain in the forest to Windows Server 2003, several new well-known and bilt-in grops are created and some new grop memberships are established. If yo transfer the PDC emlator role to a Windows Server 2003 based domain controller instead of pgrading it, these grops will be created when the role is transferred. The new well-known and bilt-in grops are: Biltin\Remote Desktop Users Biltin\Network Configration Operators Performance Monitor Users Performance Log Users Biltin\Incoming Forest Trst Bilders Biltin\Performance Monitoring Users Biltin\Performance Logging Users Biltin\Windows Athorization Access Grop Biltin\Terminal Service License Server The newly established grop memberships are: If the Everyone grop is in the Pre-Windows 2000 Compatible Access grop, the Anonymos Logon grop and Athenticated Users grop are also added to the Pre- Windows 2000 Compatible Access grop. The Network Servers grop is added to the Performance Monitoring alias. The Enterprise Domain Controllers grop is added to the Windows Athorization Access grop. In addition, when pgrading the Windows 2000 domain controller that holds the role of the PDC emlator in the forest root domain, the following additional secrity principals are created: LocalService NetworkService NTLM Athentication Other Organziation Remote Interactive Logon SChannel Athentication This Organization For more information abot new well-known and bilt-in grops in Windows Server 2003, see Defalt grops in Help and Spport Center for Windows Server 2003.

9 Overview of Upgrading Yor Windows 2000 Domains to Windows Server 2003 Domains 363 Secrity Policy Considerations When Upgrading from Windows 2000 to Windows Server 2003 Server message block (SMB) packet signing and secre channel signing are secrity policies enabled by defalt on Windows Server 2003 based domain controllers. To allow clients rnning earlier versions of Windows to commnicate with domain controllers rnning Windows Server 2003, yo might need to temporarily disable these secrity policies dring the pgrade process. SMB packet signing SMB packet signing is a secrity mechanism that protects the data integrity of SMB traffic between client compters and servers, and prevents man-in-the-middle attacks by providing a form of mtal athentication. This is done by placing a digital secrity signatre into each SMB packet, which is then verified by the receiving party. Server-side SMB signing is reqired by defalt on Windows Server 2003 based domain controllers, which means that all clients are reqired to have SMB packet signing enabled. Clients rnning Windows NT 4.0 with Service Pack 2 (SP2) or earlier and clients rnning Microsoft Windows 95 withot the Directory Service Client Pack do not spport SMB packet signing. These clients will not be able to athenticate to a Windows Server 2003 based domain controller. To ensre sccessfl athentication, pgrade these clients to a later version of the operating system or service pack. However, if yo cannot pgrade yor clients, yo can allow them to be athenticated by configring SMB packet signing on all Windows Server 2003 based domain controllers so that SMB packet signing is allowed bt not reqired. For more information abot SMB packet signing, see Microsoft network server: Digitally sign commnications (always) in Help and Spport Center for Windows Server For more information abot configring SMB packet signing on Windows Server 2003 based domain controllers, see Modify Secrity Policies later in this chapter.

10 364 Chapter 9 Upgrading Windows 2000 Domains to Windows Server 2003 Domains Secre channel signing and encryption When a compter becomes a member of a domain, a compter accont is created. Each time the compter starts, it ses the compter accont password to create a secre channel with a domain controller for its domain. This secre channel is sed to ensre secre commnications between a domain member and a domain controller for its domain. Secre channel signing is reqired by defalt on Windows Server 2003 based domain controllers, which means that all clients mst enable secre channel signing and encryption. Clients rnning Windows NT 4.0 with Service Pack 3 (SP3) or earlier installed do not spport secre channel signing. These clients will not be able to establish commnications with a Windows Server 2003 based domain controller. To ensre sccessfl commnication, pgrade these clients to a later version of the operating system or service pack. However, if yo cannot pgrade yor clients, yo mst disable secre channel signing on all Windows Server 2003 based domain controllers so that the traffic passing throgh the secre channel is not reqired to be signed or encrypted. For more information abot configring secre channel signing on Windows Server 2003 based domain controllers, see Modify Secrity Policies later in this chapter. For more information abot secre channel signing, see Domain member: Digitally encrypt or sign secre channel data (always) in Help and Spport Center for Windows Server Planning to Upgrade Windows 2000 Domains to Windows Server 2003 Domains Planning to pgrade yor Windows 2000 environment to Windows Server 2003 Active Directory involves completing the tasks and procedres that are shown in Figre 9.2.

11 Planning to Upgrade Windows 2000 Domains to Windows Server 2003 Domains 365 Figre 9.2 Planning to Upgrade Windows 2000 Domains to Windows Server 2003 Domains Plan to pgrade Windows 2000 domains to Windows Server 2003 domains Complete pre-pgrade tasks Upgrade Windows 2000 domains to Windows Server 2003 domains Create a pre-pgrade task checklist Assign appropriate credentials Introdce a Windows Server 2003-based member server Determine spported software pgrades Complete post-pgrade tasks Assess hardware reqirements Determine domain controller pgrade order Develop a test plan Develop a recovery plan

12 366 Chapter 9 Upgrading Windows 2000 Domains to Windows Server 2003 Domains Create a Pre-Upgrade Task Checklist Yo can create a pre-pgrade task checklist to help organize the tasks necessary to prepare for a sccessfl domain pgrade. In yor checklist, inclde the tasks listed in the sample checklist in Figre 9.3, in addition to any additional tasks specific to yor organization. For a worksheet to assist yo in creating yor own pre-pgrade task checklist, see Pre-Upgrade Task Checklist (DSSUPWN_1.doc) on the Microsoft Windows Server 2003 Deployment Kit companion CD (or see Pre-Upgrade Task Checklist on the Web at Figre 9.3 Example of a Pre-Upgrade Task Checklist Assign Appropriate Credentials Assign appropriate credentials to the sers who are responsible for preparing the forest and domain for an Active Directory pgrade. The adprep /forestprep command reqires a ser accont that is a member of the Schema Admins, Enterprise Admins, and Domain Admins grops. The adprep /domainprep command reqires a ser accont that is a member of the Domain Admins grop in the targeted domain. Additionally, the secrity context can affect the ability of an administrator to complete the pgrade from Windows 2000 to Windows Server Members of the Biltin\Administrators grop can pgrade the operating system and install software on a compter. The following grops are members of the Biltin\Administrators grop by defalt: The Enterprise Admins grop is a member of Biltin\Administrators in the forest root domain and in each regional domain in the forest. The Domain Admins grop is a member of Biltin\Administrators in their domain. The Domain Admins grop is a member of Biltin\Administrators on member servers in their domain.

13 Planning to Upgrade Windows 2000 Domains to Windows Server 2003 Domains 367 Table 9.1 shows the credentials that are reqired to pgrade servers, depending on the domain membership of the servers. Table 9.1 Credentials Reqired to Upgrade Servers to Windows Server 2003 Credential Domain Controller in Forest Root Domain Member Server in Forest Root Domain Domain Controller in Regional Domain Member Server in Regional Domain Enterprise Admins in forest root domain Domain Admins in forest root domain Biltin\Administrators in forest root domain Domain Admins in regional domain Biltin\Administrators in regional domain Yo also need to ensre that the administrator who is pgrading the domain controllers has the following rights: Backp files and directories (SE_BACKUP_NAME) Modify firmware environment vales (SE_SYSTEM_ENVIRONMENT_NAME) Restore files and directories (SE_RESTORE_NAME) Sht down the system (SE_SHUTDOWN_NAME) The setp program cannot rn properly if these rights are not defined, or if they are disabled by a domain Grop Policy setting on the compter. To verify if ser rights assignments are disabled by a domain Grop Policy setting 1. In the Rn dialog box, type mmc, and then click OK. 2. Click File, and then click Add/Remove snap-in. 3. In the Add/Remove snap-in dialog box, click Add. 4. In the Available Standalone snap-ins dialog box, select Grop Policy, and then click Add. 5. At the Welcome to the Grop Policy Wizard screen, verify that Local Compter appears in the Grop Policy Object: box, and then click Finish.

14 368 Chapter 9 Upgrading Windows 2000 Domains to Windows Server 2003 Domains 6. Close the Add/Remove snap-in dialog box and the Add Standalone snap-in dialog box. 7. In the Console Root, navigate to the Local Compter Policy\Compter Configration\Windows Settings\Secrity Settings\Local Policies\User Rights Assignment folder. 8. In the details pane, verify that the ser who will perform the pgrade is a member in one of the grops that has the necessary rights assigned. The policies are named identically to the ser rights listed above. Assign the appropriate credentials in advance to allow both testing and deployment to proceed withot nexpected secrity delays. Introdce a Windows Server 2003 Based Member Server Before yo begin the domain pgrade process, introdce a Windows Server 2003 based member server into yor environment. Installing Active Directory on a Windows Server 2003 based member server facilitates the domain pgrade process by allowing all existing services to rn ninterrpted while yo are pgrading to Windows Server 2003 Active Directory. Yo can introdce the member server to any domain in the forest; however, if yor forest root domain is a dedicated root, it is recommended that yo introdce the member server into the forest root domain. Placing the member server into a dedicated root domain has the lowest impact on yor environment becase sers generally do not log on to a dedicated forest root domain; therefore, ser athentications are minimal. After yo prepare the Windows 2000 forest and domain by sing the Active Directory Preparation tool, install Active Directory on the member server, creating an additional domain controller in the existing domain. The Windows Server 2003 based member server will become the first Windows Server 2003 based domain controller in the forest. Determine Spported Software Upgrades Identify the versions of Windows 2000 that are rnning in yor environment, and then determine whether yo can pgrade the operating system on yor compters to Windows Server 2003, or whether yo mst perform a clean operating system installation. Table 9.2 lists the Windows 2000 operating system platforms and indicates which platforms can be pgraded directly to each version of Windows Server 2003.

15 Planning to Upgrade Windows 2000 Domains to Windows Server 2003 Domains 369 Table 9.2 Spported Upgrade Paths to Windows Server 2003 Platform Upgrade to Windows Server 2003, Standard Edition Upgrade to Windows Server 2003, Enterprise Edition Upgrade to Windows Server 2003, Datacenter Edition Microsoft Windows 2000 Professional Windows 2000 Server Microsoft Windows 2000 Advanced Server Microsoft Windows 2000 Datacenter Server Assess Hardware Reqirements Review and docment the existing hardware configration of each domain controller that yo plan to pgrade to Windows Server Use this information to identify the domain controllers in yor environment that yo can pgrade to Windows Server 2003 and the domain controllers that do not meet the hardware reqirements necessary to rn Windows Server Yo can retain domain controllers that do not meet the necessary hardware reqirements to serve as rollback servers in the event that yo mst roll back yor deployment. In most cases, a Windows 2000 based domain controller meets the reqirements to be pgraded to Windows Server 2003, as long as it has adeqate disk space. At minimm, a domain controller reqires available free disk space for the Active Directory database, Active Directory log files, SYSVOL, and the operating system. Use the following gidelines to determine how mch disk space to allot for yor Active Directory installation: On the drive that will contain the Active Directory database, NTDS.dit, provide 0.4 gigabytes (GB) of storage for each 1,000 sers. For example, for a forest with two domains (domain A, domain B), with 10,000 and 5,000 sers respectively, provide a minimm of 4 GB of disk space for each domain controller that hosts domain A and a minimm of 2 GB of disk space for each domain controller that hosts domain B. Available space mst eqal at least 10 percent of yor existing database size, or at least 250 megabytes (MB), whichever is greater. On the drive containing the Active Directory log files, provide at least 500 MB of available space. On the drive containing the SYSVOL shared folder, provide at least 500 MB of available space. On the drive containing the Windows Server 2003 operating system files, to rn setp, provide at least 1.25 GB to 2 GB of available space. For more information abot assessing the hardware reqirements of domain controllers in a Windows Server 2003 domain, see Planning Domain Controller Capacity in this book.

16 370 Chapter 9 Upgrading Windows 2000 Domains to Windows Server 2003 Domains Determine Domain Controller Upgrade Order Determine the order in which yo will pgrade yor domain controllers before beginning the domain pgrade process. Record the name, IP address, the domain in which the domain controller will be located, and the operations master roles held by each domain controller before and after the pgrade. Finally, record the order in which yo will pgrade the operating system on each domain controller. The recommended order for pgrading domain controllers from Windows 2000 to Windows Server 2003 is: Install Active Directory on a Windows Server 2003 based member server in the forest root domain by sing the Active Directory Installation Wizard. This creates the first Windows Server 2003 based domain controller. Upgrade the operating system on the Windows 2000 based domain controller holding the role of domain naming master. If yo choose not to pgrade the domain controller, transfer the domain naming master role to a domain controller rnning Windows Server Upgrade the domain controller that holds the PDC emlator role in each domain, or transfer the roles to Windows Server 2003 based domain controllers. Contine pgrading all Windows 2000 based domain controllers to Windows Server 2003 ntil the domain pgrade is complete. Note This order for pgrading or installing Windows Server 2003 domain controllers is a recommendation only. It is safe to pgrade the domain controllers holding the domain naming master and PDC emlator roles at any time in the pgrade process. Use a domain controller docmentation table to docment information abot each domain controller in the forest. For a worksheet to assist yo in docmenting yor domain controller information, see Windows 2000 Domain Controller Docmentation (DSSUPWN_2.doc) on the Windows Server 2003 Deployment Kit companion CD (or see Windows 2000 Domain Controller Docmentation on the Web at Figre 9.4 shows an example of a completed domain controller docmentation table for Contoso.

17 Planning to Upgrade Windows 2000 Domains to Windows Server 2003 Domains 371 Figre 9.4 Example of a Windows 2000 Domain Controller Docmentation Table Develop a Test Plan It is important to develop a plan for testing yor domain pgrade procedres throghot the pgrade process. Before yo begin, test yor existing domain controllers to ensre that they are fnctioning properly, and contine to test yor domain controllers throghot the process to verify that Active Directory replication is consistent and sccessfl. Many of the tools reqired to verify yor domain pgrade procedres are located in the Spport\Tools folder on the Windows Server 2003 operating system CD. Install the Windows Server 2003 spport tools on a client compter rnning Microsoft Windows XP Professional or on a Windows Server 2003 based member server. Table 9.3 lists the tools and log files to se in yor test plan.

18 372 Chapter 9 Upgrading Windows 2000 Domains to Windows Server 2003 Domains Table 9.3 Tools and Logs Used to Test Domain Upgrade Procedres Tool / Log File Description Location Repadmin.exe Dcdiag.exe Netdiag.exe Nltest.exe Dnscmd.exe Adprep Log Dcpromoi.log and Dcpromo.log Adsiedit.exe Checks replication consistency and monitors both inbond and otbond replication partners. Displays replication stats of inbond replication partners and directory partitions. Diagnoses the state of domain controllers in a forest or enterprise, tests for sccessfl Active Directory connectivity and fnctionality, and retrns the reslts as passed or failed. Diagnoses networking and connectivity problems by performing a series of tests to determine the state of yor network client and whether it is fnctional. Qeries and checks the stats of trsts and can forcibly sht down domain controllers. Provides the properties of DNS servers, zones, and resorce records. Provides a detailed progress report of the forest and domain preparation process. Provides a detailed progress report of the Active Directory installation. Incldes information regarding replication and services in addition to applicable error messages. A Microsoft Management Console (MMC) snapin that acts as a low-level editor for Active Directory and allows yo to view, add, delete, and move objects and attribtes within the directory. Windows Server 2003 operating system CD in the Spport\Tools folder. Windows Server 2003 operating system CD in the Spport\Tools folder. Windows Server 2003 operating system CD in the Spport\Tools folder. Windows Server 2003 operating system CD in the Spport\Tools folder. Windows Server 2003 operating system CD in the Spport\Tools folder. %systemroot%\system32\de bg\adprep folder. %systemroot%\debg folder. Windows Server 2003 operating system CD in the Spport\Tools folder. For more information abot Windows Spport Tools, in Help and Spport Center for Windows Server 2003, click Tools, and then click Windows Spport Tools.

19 Planning to Upgrade Windows 2000 Domains to Windows Server 2003 Domains 373 Create a test matrix that meets yor needs, based on the services that yo reqire to spport yor environment. For a worksheet to assist yo in docmenting yor test matrix, see Windows 2000 Upgrade Test Matrix (DSSUPWN_3.doc) on the Windows Server 2003 Deployment Kit companion CD (or see Windows 2000 Upgrade Test Matrix on the Web at Figre 9.5 shows an example of a completed pgrade test matrix. Figre 9.5 Example of a Windows 2000 Upgrade Test Matrix

20 374 Chapter 9 Upgrading Windows 2000 Domains to Windows Server 2003 Domains Develop a Recovery Plan Develop a recovery plan for se in the event that some portion of yor domain pgrade process fails. A sccessfl recovery plan incldes: Step-by-step instrctions, so that the pgrade team can restore normal operations to the organization. A sign-off process, ensring that all team members review, agree pon, and sign off on the recovery plan. For more information abot developing a recovery plan, see the Active Directory Disaster Recovery link on the Web Resorces page at Completing Pre-Upgrade Tasks Prior to pgrading yor Windows 2000 environment to Windows Server 2003 Active Directory, yo mst complete several pre-pgrade tasks. Figre 9.6 shows the process for completing pre-pgrade tasks. Figre 9.6 Completing Pre-Upgrade Tasks Plan to pgrade Windows 2000 domains to Windows Server 2003 domains Complete pre-pgrade tasks Upgrade Windows 2000 domains to Windows Server 2003 domains Complete post-pgrade tasks Determine service pack levels Backp domain data Resolve pgrade and application compatibility problems Prepare yor infrastrctre for pgrade

21 Completing Pre-Upgrade Tasks 375 Determine Service Pack Levels Before preparing yor infrastrctre for pgrade and installing the Windows Server 2003 operating system, all Windows 2000 based domain controllers in the forest mst be rnning Windows 2000 Service Pack 1 (SP1) with QFE , or Windows 2000 SP2 (or later). QFE (inclded in Windows 2000 SP2 and later) is reqired to prevent potential domain controller corrption. Use the repadmin /showattr command to inventory the operating system and service pack revision level on all domain controllers in a particlar domain. Note When administering Windows 2000 based domain controllers from a compter rnning Windows XP Professional or Windows Server 2003, yo might experience interoperability problems with the Windows Server 2003 administrative tools nless yor Windows 2000 based domain controllers are rnning Windows 2000 SP3 or later. Some Windows Server 2003 Active Directory administrative tools sign and encrypt all LDAP traffic. Compters rnning Windows 2000 SP3 or later can interpret the signed and encrypted LDAP traffic. To determine domain controller operating system and service pack levels For each domain in the forest, type the following command at the command line of a compter that has the Windows Server 2003 spport tools installed: repadmin /showattr domain controller in target domain ncobj:domain: /filter: (&(objectcategory=compter)(primarygropid=516)) /sbtree /atts:operatingsystem,operatingsystemversion,operatingsystemservicepack The following text is sample otpt from this command: DN: CN=NA-DC-01,OU=Domain Controllers,DC=company,DC=com 1> operatingsystem: Windows Server > operatingsystemversion: 5.2 (3663) DN: CN=NA-DC-02,OU=Domain Controllers,DC=company,DC=com 1> operatingsystem: Windows 2000 Server 1> operatingsystemversion: 5.0 (2195) 1> operatingsystemservicepack: Service Pack 3 Note The repadmin /showattr command does not show any hotfixes that might be installed on a domain controller.

22 376 Chapter 9 Upgrading Windows 2000 Domains to Windows Server 2003 Domains Upgrade domain controllers to the appropriate service pack as needed. For more information abot recommended hotfixes to se with Service Pack 2, see article , List of Fixes to Use on Windows 2000 Domain Controllers Before Yo Rn the Adprep/Forestprep Command in the Microsoft Knowledge Base. To find this article, see the Microsoft Knowledge Base link on the Web Resorces page at Backp Domain Data Back p yor Windows 2000 domain data before yo begin the pgrade. This task varies according to the operations and procedres that already exist in yor environment. At minimm, complete the following steps: To allow for falt tolerance, ensre sccessfl replication between two domain controllers in each domain. Back p two domain controllers in each domain in the forest, inclding System State data. Test all backp media to ensre that the data can be restored sccessflly. Important Store backp media in a secre off-site location designated by, and accessible to, the pgrade team before yo begin the pgrade process. Resolve Upgrade and Application Compatibility Problems Before pgrading a server to Windows Server 2003, se the Winnt32.exe command-line tool with the /checkpgradeonly parameter to identify potential pgrade problems, sch as inadeqate hardware resorces or compatibility problems. Two application compatibility problems yo might need to resolve inclde: Distribted File System (DFS) root shares are not spported if they are hosted on a file allocation table (FAT) partition. In Windows Server 2003, DFS root shares mst be located on NTFS partitions with no files or directories nder the DFS link. For more information abot deploying DFS, see Designing and Deploying File Servers in Planning Server Deployments in this kit.

23 Completing Pre-Upgrade Tasks 377 Windows 2000 based compters rnning Remote Installation Services (RIS) might case errors in a Windows Server 2003 Active Directory domain. When sing Windows 2000 RIS server in yor Windows Server 2003 Active Directory Domain, yo might receive the following error when sing the Client Installation Wizard (CIW): "Unable to create or Modify Compter accont" Error: 00004E4F This error occrs becase Windows Server 2003 creates machine accont objects differently from Windows To prevent this error from occrring when creating machine acconts, configre the Windows 2000 based RIS servers in yor environment to point to a domain controller rnning Windows This is done by adding the DefaltServer registry parameter to the Windows 2000 RIS servers. For more information abot configring optional registry parameters for the Boot Information Negotiation Layer (BINL) service, see article , Optional Registry Parameters for the BINL Service in the Microsoft Knowledge Base. To find this article, see the Microsoft Knowledge Base link on the Web Resorces page at Yo mst remove the Windows 2000 Administration Tools Pack before pgrading to Windows Server For more information abot Windows 2000 administration tools and pgrade isses, see article , Administering Windows 2000 Based Compters Using Windows XP Professional Based Clients, in the Microsoft Knowledge Base. To find this article, see the Microsoft Knowledge Base link on the Web Resorces page at To identify potential pgrade and compatibility problems At the command line, connect to the I386 directory located at yor installation sorce and type the following command: winnt32 /checkpgradeonly Resolve any reported problems prior to performing the pgrade. Prepare Yor Infrastrctre for Upgrade Preparing yor infrastrctre for pgrade involves resolving any Adprep.exe compatibility problems with Microsoft Exchange 2000 and Services for UNIX 2.0 and then rnning Adprep.exe to prepare the forest and domains for the pgrade. Before yo pgrade the first Windows 2000 based domain controller to Windows Server 2003 Active Directory, yo mst se Adprep.exe to: Rn adprep /forestprep once on the schema master to prepare the forest. Rn adprep /domainprep once on the infrastrctre master in each domain in which yo plan to place a Windows Server 2003 based domain controller.

24 378 Chapter 9 Upgrading Windows 2000 Domains to Windows Server 2003 Domains When yo are pgrading the operating system on a Windows 2000 based domain controller to Windows Server 2003, Setp (Winnt32.exe) verifies that the forest and domain have been prepared. If yo have not prepared the forest and the domain in which the domain controller will be a member, or if the changes have not flly replicated, Winnt32.exe fails, the pgrade terminates, and yo are notified that yo mst rn Adprep.exe /forestprep in the forest and Adprep.exe /domainprep in the target domain. Note Yo can rn Adprep.exe mltiple times, bt it performs actions only once. For example, Adprep.exe does not adjst access control lists (ACLs) each time yo rn the command. Yo mst prepare yor infrastrctre before sing the Active Directory Installation Wizard to install Active Directory on a Windows Server 2003 based member server. The Active Directory installation fails if the wizard detects that the forest and domain have not been prepared. Cation Adprep.exe is the only spported method of pgrading the Windows 2000 Active Directory schema to Windows Server Attempting to se any other script or tool for this prpose can case problems with the schema and is not spported by Microsoft. To prepare yor Windows 2000 Active Directory forest and domain for the pgrade to Windows Server 2003 Active Directory, Adprep.exe performs the following tasks: Updates the Active Directory schema. Note Changes that are made to the global catalog by Adprep.exe do not case a fll synchronization of the global catalog becase the partial attribte set is not changed. Improves defalt secrity descriptors. Upgrades display specifiers. Adjsts access control lists on Active Directory objects and on files in the SYSVOL shared folder to allow domain controller access. In versions of Windows earlier than Windows Server 2003, inclding the Everyone secrity identifier (SID) on an ACL or grop membership allows athenticated sers, gest sers, and anyone with an anonymos logon to gain access to many resorces. Windows 2000 based domain controllers also se anonymos access to gain control of some Active Directory objects and files. In Windows Server 2003, the Everyone grop no longer contains the anonymos sers grop, ths restricting domain controller access to particlar objects. Adprep.exe adjsts the ACLs on these objects so that domain controllers can still access them.

25 Completing Pre-Upgrade Tasks 379 Creates new objects that are sed by applications sch as COM+ and Windows Management Instrmentation (WMI). Creates new containers in Active Directory that are sed to verify that the preparation was sccessfl. Yo can rn Adprep.exe only at the command line. Resolve Adprep.exe Compatibility Problems with Exchange 2000 When yo prepare the forest by sing the Active Directory Preparation tool in a Windows 2000 forest containing the Exchange 2000 schema, the LDAP display names of the three Windows Server 2003 InetOrgPerson attribtes Secretary, labeleduri, and hoseidentifier conflict with the non-rfc-compliant versions added by Exchange On the domain controller that receives the Windows Server 2003 schema pdates, the ldapdisplayname attribtes for the Exchange 2000 definitions of these attribtes are modified to prevent a conflict. When the changes are replicated in Active Directory, however, the additional domain controllers inadvertently detect the changes as a schema collision becase dplicate names are present. When Active Directory detects a dplicate name, it modifies the name of one of the objects by adding Dp and some niqe characters to the beginning of the name. For example, the Secretary, labeleduri, and hoseidentifier name collisions appear similar to the following: ldapdisplayname: DUP-labeledURI-9591bbd3-d2a afda-48af7c35507d ldapdisplayname: DUP-secretary-c5a1240d-70c0-455c-9906-a f85f ldapdisplayname: DUP-hoseIdentifier-e7c5d1bd-a422-4b9e-b4db-ecad2b6839cf If yo are already rnning Exchange 2000, yo need to rn the fixp script fond in article 31469, ADPREP Command Cases Mangled Attribtes in Windows 2000 Forests That Contain Exchange 2000 Servers. To find this article, see the Microsoft Knowledge Base link on the Web Resorces page at If yo have not yet deployed Exchange 2000 in yor environment, yo can avoid name collisions by preparing the Active Directory forest by sing adprep /forestprep to create the initial definition of the Secretary, labeleduri, and hoseidentifier attribtes before installing Exchange Specifically, yo can avoid LDAP display name collision problems by doing one of the following: Rn the Active Directory Preparation tool in a Windows 2000 forest before yo install Exchange Add Exchange 2000 to an existing Windows Server 2003 forest. For more information abot schema collisions between Exchange 2000 and Windows Server 2003, see article , ADPREP Command Cases Mangled Attribtes in Windows 2000 Forests That Contain Exchange 2000 Servers, and article How to Upgrade Windows 2000 Domain Controllers to Windows Server 2003 in the Microsoft Knowledge Base. To find these articles, see the Microsoft Knowledge Base link on the Web Resorces page at

26 380 Chapter 9 Upgrading Windows 2000 Domains to Windows Server 2003 Domains Resolve Adprep.exe Compatibility Problems with Services for UNIX 2.0 Adprep.exe prepares the forest or domain with the schema attribte CN=id, which is compliant with RFC 2307 for se by the Server for Network Information System (NIS) component of Services for UNIX. However, in Services for UNIX 2.0, the Server for NIS component ses a different attribte schema: CN-id,CN=msSFUName. This discrepancy can case the pgrade to Windows Server 2003 to fail. To solve this problem, either pgrade to Windows Services for UNIX 3.0 or install the Q293783_sf_2_x86_en.exe hotfix. To resolve Server for NIS compatibility isses with Windows Server Rn Q293783_sf_2_x86_en.exe on the domain controller that holds schema master role. 2. Review the Hotfix.txt file that is inclded with the hotfix for installation specifics. 3. Verify end-to-end Active Directory replication of the schema throghot the forest. For more information abot Services for UNIX 2.0 application compatibility isses and the hotfix installation file, see article , Cannot Upgrade Windows 2000 Server to Windows Server 2003 with Windows Services for UNIX 2.0 Installed in the Microsoft Knowledge Base. To find this article, see the Microsoft Knowledge Base link on the Web Resorces page at Prepare the Forest for the Upgrade Before preparing the forest for the pgrade, se yor preferred monitoring tool to verify that replication is fnctioning properly. If domain controllers are not replicating properly, the pgrade process will fail. The changes made by Adprep.exe mst replicate for the pgrade to scceed. After verifying sccessfl replication, se the adprep /forestprep command to prepare the forest for the pgrade. To prepare the Active Directory forest for the pgrade 1. In the forest root domain, log on to the domain controller that holds the schema master role with Schema Admins, Enterprise Admins, and Domain Admins credentials. 2. Insert the Windows Server 2003 operating system CD, or connect to the network installation shared folder, and then locate and open the I386 folder. At the command line, type: adprep /forestprep

27 Completing Pre-Upgrade Tasks 381 The following warning appears: ADPREP WARNING: Before rnning adprep, all Windows 2000 domain controllers in the forest shold be pgraded to Windows 2000 Service Pack 1 (SP1) with QFE , or to Windows 2000 SP2 (or later). QFE (inclded in Windows 2000 SP2 and later) is reqired to prevent potential domain controller corrption. For more information abot preparing yor forest and domain see KB article Q at [User Action] If ALL yor existing Windows 2000 domain controllers meet this reqirement, type C and then press ENTER to contine. Otherwise, type any key and press ENTER to qit. Yo can either contine with the preparation process or qit and install SP2. It is recommended that yo install SP2 or later on all Windows 2000 based domain controllers before contining. After adprep /forestprep has finished, verify that all operations have completed sccessflly. To verify that the Active Directory Preparation tool has completed all operations sccessflly 1. At the command line, type: adsiedit.msc Important Adsiedit.exe is one of the Windows 2000 spport tools, which is still installed on the compter at this point in the domain pgrade process. If yo have removed the Windows 2000 spport tools, yo can reinstall them from the Spport\Tools folder on the Windows 2000 operating system CD. For more information abot Adsiedit.exe, in Help and Spport Center for Windows Server 2003, click Tools, and then click Windows Spport Tools. 2. Expand the Configration container and verify that CN=ForestUpdates has been created. 3. Expand CN=ForestUpdates and verify that CN=Windows2003Upgrade is present. 4. Examine the Event Log for any event messages that indicate that the domain controller is not fnctioning properly.