Pgrading To Windows XP 4.0 Domain Controllers and Services

Transcription

1 C H A P T E R 8 Upgrading Windows NT 4.0 Domains to Windows Server 2003 Active Directory Upgrading yor domains from Microsoft Windows NT 4.0 to Windows Server 2003 Active Directory directory service enables yor organization to improve the secrity and scalability of yor network infrastrctre while redcing administrative overhead. As an alternative to restrctring Windows NT 4.0 domains, the in-place pgrade is an efficient, time-saving process that minimizes the effect on the Windows NT 4.0 prodction environment. In This Chapter Overview of Upgrading Windows NT 4.0 Domains Collecting Design Information Completing Pre-Upgrade Tasks Upgrading Domains from Windows NT 4.0 to Windows Server 2003 Active Directory Completing Post-Upgrade Tasks Additional Resorces Related Information For more information abot restrctring domains when pgrading from Windows NT 4.0 to Windows Server 2003, see Restrctring Windows NT 4.0 Domains to an Active Directory Forest in this book. For more information abot the Active Directory logical strctre, see "Designing the Active Directory Logical Strctre" in this book. For more information abot Windows Server 2003 Active Directory Fnctional Levels, see Enabling Advanced Windows Server 2003 Active Directory Featres in this book. For more information abot Active Directory site topology, see "Designing the Site Topology" in this book.

2 288 Chapter 8 Upgrading Windows NT 4.0 Domains to Windows Server 2003 Active Directory Overview of Upgrading Windows NT 4.0 Domains Upgrading yor Windows NT 4.0 domains to the Microsoft Windows Server 2003, Standard Edition and Windows Server 2003, Enterprise Edition operating systems enables yo to simplify and redce network administration. Windows Server 2003 Active Directory integrates with other applications and services and allows yo to delegate administrative responsibility at the appropriate level when yo have mltiple organizations existing in a single domain strctre. When yo pgrade yor Windows NT 4.0 domains to Windows Server 2003 Active Directory, yo improve scalability becase Active Directory domains can scale to meet the needs of yor organization. Yo also gain new capabilities by sing Grop Policy, and yo gain more flexibility for bsiness nits. In addition, performing an in-place pgrade of Windows NT 4.0 domains to Windows Server 2003 Active Directory has no adverse effect on yor Windows NT 4.0 prodction environment. There are fewer administrative complexities than with restrctring yor environment, sch as maintaining access to shared directories, files, and printers. Grops and grop memberships are retained. Yo do not need to migrate local profiles, and yo retain the existing passwords and profiles for domain sers. Before planning and implementing Windows NT 4.0 in-place pgrades, ensre that yor organization has already: Designed the Active Directory logical strctre of the forest and Domain Name System (DNS) for yor Active Directory environment. Designed a site topology to efficiently locate domain controllers. Deployed a Windows Server 2003 forest root domain if that is the pgrade path that yor organization has decided on. For more information abot the paths for in-place pgrading a Windows NT 4.0 environment, see Upgrading Domains from Windows NT 4.0 to Windows Server 2003 Active Directory later in this chapter. After completing the in-place pgrade process, yo can perform an in-place pgrade for any remaining Windows NT domains or restrctre them into yor new Windows Server 2003 forest. For information abot restrctring Windows NT 4.0 domains to a Windows Server 2003 forest, see "Restrctring Windows NT 4.0 Domains to an Active Directory Forest" in this book. Note For a list of the job aids that are available to assist yo in pgrading yor Windows NT 4.0 domains to Windows Server 2003 Active Directory, see Additional Resorces later in this chapter.

3 Overview of Upgrading Windows NT 4.0 Domains 289 Process for Upgrading Windows NT 4.0 Domains to Windows Server 2003 Active Directory Upgrading yor Windows NT 4.0 domains to Windows Server 2003 Active Directory involves first completing the necessary preparation tasks and then following the steps to complete the pgrade. Figre 8.1 shows the process for pgrading Windows NT 4.0 domains to Windows Server 2003 Active Directory. Figre 8.1 Upgrading Windows NT 4.0 Domains to Windows Server 2003 Active Directory Collect design information Complete prepgrade tasks Upgrade domains from Windows NT 4.0 to Windows Server 2003 Active Directory Complete postpgrade tasks

4 290 Chapter 8 Upgrading Windows NT 4.0 Domains to Windows Server 2003 Active Directory Backgrond Information for Upgrading to Windows Server 2003 Active Directory Before yo begin the Windows NT 4.0 in-place domain pgrade, become familiar with some important isses that affect the pgrade process. PDC Offline Operations Dring the process of pgrading the operating system on the primary domain controller (PDC) from Windows NT 4.0 to Windows Server 2003 and installing Active Directory, client operations sch as logon and resorce access will contine to fnction becase these services are provided by backp domain controllers. However, becase the PDC will be offline dring most phases of the pgrade process, typically between one and three hors, operations that reqire data to be written to the domain will not scceed. For example, sers will not be able to change their passwords and administrators will not be able to create, delete, or nlock ser acconts. Administrative tools, sch as User Manager for Domains or Server Manager, can be sed only in read-only mode on backp domain controllers in the domain. In addition, yo will not be able to create new objects, sch as sers and grops, while the PDC is offline. Fll Synchronization of the Local Secrity Athority Database After pgrading a Windows NT 4.0 PDC, or after transferring the PDC role to another domain controller, the LSA will perform a single fll synchronization of all objects in the database. This synchronization cases events to be logged in Event Viewer; specifically, Event Viewer in Windows Server 2003 will log Event ID 5713 and Event Viewer in Windows NT 4.0 will log Event ID However, the LSA database contains relatively few objects and the fll synchronization does not affect network performance. Do not confse the fll synchronization of the LSA database with a backp domain controller (BDC) fll synchronization. A BDC fll synchronization typically happens when too many changes occr on a PDC before the PDC can replicate the changes to a BDC. The nmber of objects that are replicated dring a BDC fll synchronization and the amont of network traffic that is generated depends on the nmber of sers, grops, and workstations in the domain. Domain Users and Client Workstation Operating Systems When Microsoft Windows 2000, Microsoft Windows XP, and Windows Server 2003 clients attempt to athenticate with a domain controller, they first retrieve a list of domain controllers from either DNS or WINS, and will then athenticate with the first domain controller that responds to their athentication reqest. The first domain controller to respond is sally a domain controller located closest to the client. The client and the domain controller will then negotiate which athentication protocol to se.

5 Overview of Upgrading Windows NT 4.0 Domains 291 When Windows 2000, Windows XP, and Windows Server 2003 clients are members of a Windows NT 4.0 domain, they will only se the NTLM protocol to athenticate becase that is the only athentication protocol spported by Windows NT 4.0. Windows 2000 and Windows Server 2003 domain controllers are capable of sing either the NTLM or the more secre Kerberos athentication protocol. When performing an in-place pgrade of a Windows NT 4.0 domain to Windows Server 2003, the first domain controller pgraded is the Windows NT 4.0 PDC. If clients in the domain rnning Windows 2000, Windows XP, and Windows Server 2003 select the new Active Directory domain controller for athentication, the negotiation of the athentication protocol will reveal that there are now domain controllers in the domain that spport the Kerberos protocol. These clients will then pgrade their secre channel to exclsively se the Kerberos protocol for athentication reqests and will no longer attempt to athenticate sing the NTLM protocol, potentially casing the new Active Directory domain controller to become overloaded with athentication reqests. To prevent Windows Server 2003 based domain controllers from being overloaded with athentication reqests, configre each Windows Server 2003 based domain controller to emlate a Windows NT 4.0 based domain controller dring the pgrade process. Configring a newly pgraded Windows Server 2003 based domain controller to emlate a Windows NT 4.0 based domain controller by sing the NT4Emlator registry entry shields the new domain controller from getting too many athentication reqests from Active Directory clients. Shielding the Active Directory domain controller takes place before the operating system is pgraded to Windows Server 2003 to prevent clients rnning Windows 2000, Windows XP, and Windows Server 2003 from ever establishing exclsive commnications with a Windows Server 2003 based domain controller. When pgrading additional Windows NT 4.0 based domain controllers after the PDC has been configred to emlate a Windows NT 4.0 based domain controller, yo mst remember to configre the compter yo are pgrading with the NetralizeNT4Emlator registry entry. This is so that the additional domain controller will recognize the pgraded PDC that is emlating a Windows NT 4.0 based domain controller as an Active Directory domain controller. If the compter is not configred to netralize emlation, yo will not be able to install Active Directory becase the additional domain controller will not be able to athenticate to an Active Directory domain controller. For each site in which clients are rnning Windows 2000, Windows XP, and Windows Server 2003, ensre that yo have enogh Windows Server 2003 based domain controllers deployed in that site before removing Windows NT 4.0 emlation. For more information abot emlating Windows NT 4.0 based domain controllers, see Configre Protection Against Domain Controller Overload later in this chapter. For more information abot domain controller placement, see Designing the Site Topology in this book. For more information abot domain controller capacity planning and determining the nmber of domain controllers needed in each site to service Active Directory clients, see Planning Domain Controller Capacity in this book.

6 292 Chapter 8 Upgrading Windows NT 4.0 Domains to Windows Server 2003 Active Directory Service Compatibility In Windows NT 4.0 and earlier server operating systems, services rnning in the context of the Local System accont commnicate with other services over the network by sing nll sessions (a session in which a ser name or password is not provided). In Windows 2000 and later operating systems, services rnning in the context of the Local System accont on the local compter se the local compter accont to athenticate to other servers. By defalt, Active Directory does not accept nll session qeries. Of all the services that rn in the context of the Local System accont, Remote Access Services (RAS) is the most prominent. Yo cannot se nll sessions to access network resorces by sing NTLM athentication nless the remote compter allows access with nll credentials. In an Active Directory environment containing both Windows NT 4.0 based and Windows Server 2003 based domain controllers, a member server that is rnning Windows NT 4.0 and is configred as a RAS server cannot retrieve information from a Windows Server 2003 based domain controller. For example, if a caller tries to dial into yor network and accesses a Windows NT 4.0 member server that is configred as a RAS server, the RAS server mst qery a domain controller first to verify whether the caller has permission to dial into the network. Therefore, RAS operates correctly only if the domain controller responding to the RAS athentication reqest is a Windows NT 4.0 based BDC or the Active Directory domain has been configred to allow resorces to be accessed by sing nll credentials. By pgrading the operating system on Windows NT 4.0 member servers that are configred as RAS servers to Windows Server 2003, yo ensre that RAS callers are sccessflly athenticated by a Windows Server 2003 Active Directory based domain controller. The recommended soltion is to pgrade the RAS servers to Windows Server However, if this cannot be done, the alternatives are: While installing Active Directory on the pgraded Windows NT 4.0 PDC, on the Permissions page of the Active Directory Installation wizard, select Permissions compatible with pre-windows 2000 Server operating systems. or Add the Everyone grop and the Anonymos Logon grop to the Pre-Windows 2000 Compatible Access bilt-in grop by sing Active Directory Users and Compters or the command line. To add the Everyone grop to the Pre-Windows 2000 Compatible Access Grop by sing the command line At the command line, type: net localgrop "Pre-Windows 2000 Compatible Access" Everyone /add

7 Overview of Upgrading Windows NT 4.0 Domains 293 To add the Anonymos Logon grop to the Pre-Windows 2000 Compatible Access Grop by sing the command line At the command line, type: net localgrop "Pre-Windows 2000 Compatible Access" Anonymos Logon /add Note After this pdate to the Pre-Windows 2000 Compatible Access grop replicates, yo mst restart the Server service on all domain controllers. Both of these methods combined allow nll sessions to read information ot of the directory. After yo pgrade all RAS servers, and when yo no longer need backward compatibility with operating systems earlier than Windows 2000, remove the Everyone grop and the Anonymos Logon grop from the Pre-Windows 2000 Compatible Access bilt-in grop. For more information abot removing the Everyone grop and the Anonymos Logon grop from the Pre- Windows 2000 Compatible Access grop, see Eliminate Anonymos Connections to Domain Controllers later in this chapter. LAN Manager Replication Service and the File Replication Service In Windows NT 4.0, the LAN Manager Replication (LMRepl) service provides single master replication of logon scripts and other database information located in the NETLOGON share on a Windows NT 4.0 based domain controller that is designated as an export server to all other Windows NT 4.0 based domain controllers in the domain. LMRepl can be configred only on Windows NT 4.0 based domain controllers. In Windows 2000 and Windows Server 2003, logon scripts and profile information are stored in the NETLOGON shared folder (which contains policies and scripts for non-active Directory clients) and the SYSVOL shared folder (which contains Grop Policy files and scripts for Active Directory clients). The File Replication service (FRS), a mltimaster replication engine that rns atomatically on all Windows Server 2003 based domain controllers, replaces the LMRepl service and replicates the NETLOGON and SYSVOL shared folders between domain controllers in a Windows Server 2003 domain. Dring the in-place domain pgrade process, yor environment incldes Windows NT 4.0 based BDCs operating with Windows Server 2003 based domain controllers. FRS and LMRepl are not backward compatible. Therefore, to provide spport for the LMRepl service in the Active Directory environment, yo need to create a bridge between LMRepl and FRS to replicated new files created in the NETLOGON folder on Windows Server 2003 domain controllers to the Windows NT 4.0 export server. The bridge is created by sing the Lbridge.cmd script and the Robocopy.exe tool so that both services can operate atonomosly. Do this by selecting one Windows Server 2003 based domain controller to copy the SYSVOL shared folder to the Windows NT 4.0 export directory of the Windows NT 4.0 export server. Yo can se a reglarly schedled script to copy the shared folder. For more information abot creating this script, see Synchronize File Replication Services later in this chapter.

8 294 Chapter 8 Upgrading Windows NT 4.0 Domains to Windows Server 2003 Active Directory Secrity Policy Considerations when Upgrading from Windows NT 4.0 to Windows Server 2003 Server message block (SMB) packet signing and secre channel signing are secrity policies that are enabled by defalt on Windows Server 2003 based domain controllers. To allow clients rnning earlier versions of Windows to commnicate with domain controllers rnning Windows Server 2003, yo might need to temporarily disable these secrity policies dring the pgrade process. SMB packet signing SMB packet signing is a secrity mechanism that protects the data integrity of SMB traffic between client compters and servers, and prevents man-in-the-middle attacks by providing a form of mtal athentication. This is done by placing a digital secrity signatre into each SMB packet, which is then verified by the receiving party. Server-side SMB signing is reqired by defalt on Windows Server 2003 based domain controllers, which means that all clients are reqired to have SMB packet signing enabled. Clients rnning Windows NT 4.0 with Service Pack 2 or earlier, and clients rnning Microsoft Windows 95 withot the Directory Service Client Pack, do not spport SMB packet signing. These clients will not be able to athenticate to a Windows Server 2003 based domain controller. To ensre sccessfl athentication, pgrade these clients to a later version of the operating system or Service Pack. However, if yo cannot pgrade yor clients, yo can allow them to be athenticated by configring SMB packet signing on all Windows Server 2003 based domain controllers so that SMB packet signing is preferred bt not reqired. For more information abot SMB packet signing, see Microsoft network server: Digitally sign commnications (always) in Help and Spport Center for Windows Server For more information abot configring SMB packet signing on Windows Server 2003 based domain controllers, see Modify Secrity Policies later in this chapter. For more information abot the Directory Services Client Pack, see article , Availability of the Directory Services Client Update for Windows 95 and Windows 98 in the Microsoft Knowledge Base. To find this article, see the Microsoft Knowledge Base link on the Web Resorces page at Secre channel signing and encryption When a compter becomes a member of a domain, a compter accont is created. Each time the compter starts, it ses the compter accont password to create a secre channel with a domain controller for its domain. This secre channel is sed to ensre secre commnications between a domain member and a domain controller for its domain. Secre channel signing is reqired by defalt on Windows Server 2003 based domain controllers, which means that all clients mst enable secre channel signing and encryption.

9 Collecting Design Information 295 Clients rnning Windows NT 4.0 with Service Pack 3 or earlier installed do not spport secre channel signing. These clients will not be able to establish commnications with a Windows Server 2003 based domain controller. To ensre sccessfl commnication, pgrade these clients to a later version of the operating system or Service Pack. However, if yo cannot pgrade yor clients, yo mst disable secre channel signing on all Windows Server 2003 based domain controllers so that the traffic passing throgh the secre channel is not reqired to be signed or encrypted. For more information abot secre channel signing, see Domain member: Digitally encrypt or sign secre channel data (always) in Help and Spport Center for Windows Server For more information abot configring secre channel signing on Windows Server 2003 based domain controllers, see Modify Secrity Policies later in this chapter. Collecting Design Information In preparation for deployment, the forest owner in yor organization is responsible for working with the deployment team to acqire the following information: Docmentation of yor crrent Windows NT 4.0 environment. Note Unlike SMB packet signing, secre channel signing does not affect Windows 95 clients. Names of the Windows NT 4.0 domains that will be pgraded and the order in which to pgrade them. Spported operating system pgrade paths for yor Windows NT 4.0 based domain controllers. Information sch as domain diagrams, network services, and trst relationships might have been docmented as part of the design process, and collecting it will be a matter of qerying the design team. However, information sch as the existing network and hardware configration of each domain controller might have to be collected or docmented by the forest owner dring the deployment phase of the project. In addition, the forest owner is responsible for developing a test plan and for developing a recovery plan in the event that the deployment does not complete sccessflly.

10 296 Chapter 8 Upgrading Windows NT 4.0 Domains to Windows Server 2003 Active Directory Figre 8.2 shows the steps involved in collecting the design information that will be sed to pgrade Windows NT 4.0 domains to Windows Server 2003 Active Directory. Figre 8.2 Collecting Design Information Collect design information Docment the existing environment Complete prepgrade tasks Determine the domain pgrade order Upgrade domains from Windows NT 4.0 to Windows Server 2003 Active Directory Complete postpgrade tasks Determine spported operating system pgrades Develop a test plan Develop a recovery plan Docment the Existing Environment Before pgrading a Windows NT 4.0 domain to Windows Server 2003 Active Directory, docment the existing Windows NT 4.0 domain strctre. Create a diagram that incldes the following information: The names of all accont and resorce domains. The inbond and otbond trst relationships that each domain shares. If docmentation already exists for yor domain, review the existing docmentation for accracy and clarity. Figre 8.3 shows an example of the existing Windows NT 4.0 domain strctre for a fictitios company, Trey Research.

11 Collecting Design Information 297 Figre 8.3 Example of a Windows NT 4.0 Domain Diagram Boston East Mail-Apps Prod-Apps Office-Apps In addition to docmenting the existing domain strctre, docment the following: The domain controllers and the services that each provides in the domain. The existing hardware configration on all domain controllers in the domain. The existing network configration, inclding IP address and network adapter information for each domain controller. The crrent domain controller assignments and the role that yo plan to assign to each domain controller after the in-place domain pgrade. Docment Domain Controllers and Services Identify and docment the domain controllers in the existing Windows NT 4.0 domain. Inclde in yor docmentation the role that each domain controller assmes in the domain and the services that each domain controller provides. Identify domain controllers that provide Remote Access Service and the LAN Manager Replication (LMRepl) service, becase pgrading to Windows Server 2003 Active Directory affects these services. For a worksheet to assist yo in docmenting domain controllers and services see Windows NT 4.0 Domain Controllers and Services (DSSUPNT_1.doc) or Windows NT 4.0 Domain Controller Docmentation (DSSUPNT_5.xls) on the Microsoft Windows Server 2003 Deployment Kit companion CD (or see Windows NT 4.0 Domain Controllers and Services or Windows NT 4.0 Domain Controller Docmentation on the Web at Windows NT 4.0 Domain Controller Docmentation is a master worksheet combining the information from all for individal worksheets in this section.

12 298 Chapter 8 Upgrading Windows NT 4.0 Domains to Windows Server 2003 Active Directory Example: Docmenting Windows NT 4.0 Domain Controllers and Services Trey Research has a Windows NT 4.0 accont domain that incldes nine domain controllers rnning Windows NT 4.0. Becase the resorce domains hold all of the application servers, the accont domain does not inclde member servers. The PDC, SEA-EAST-DC01, is also a Windows Internet Name Service (WINS) server, as are two BDCs, BOS-EAST-DC01 and BOS- EAST-DC02. Trey Research docmented the domain controllers and services in their Windows NT 4.0 domain, as shown in Figre 8.4. Figre 8.4 Example of Windows NT 4.0 Domain Controllers and Services Worksheet For more information abot the effect of pgrading to Windows Server 2003 Active Directory on the RAS service and the LMRepl service, see Backgrond Information for Upgrading to Windows Server 2003 Active Directory earlier in this chapter.

13 Collecting Design Information 299 Docment the Existing Hardware Configration Review and docment the existing hardware configration of each domain controller that yo plan to pgrade to Windows Server Use this information to identify the domain controllers in yor environment that yo can pgrade to Windows Server 2003 and the domain controllers that do not meet the hardware reqirements for Windows Server Retain at least one domain controller that does not meet Windows Server 2003 hardware reqirements to serve as a rollback server in the event that yo mst roll back yor deployment. If the PDC does not meet the hardware reqirements, yo can transfer the PDC role to a backp domain controller (BDC) that does meet the hardware reqirements and pgrade it. If none of yor Windows NT 4.0 domain controllers meet Windows Server 2003 hardware reqirements, install a Windows NT 4.0 BDC on a compter that does meet the hardware reqirements for a domain controller that is rnning Windows Server 2003 and transfer the PDC role to it. Yo can also add a Windows Server 2003 based member server to a Windows NT 4.0 domain at any time before yo pgrade to Windows Server 2003 Active Directory becase Windows Server 2003 based member servers can operate within a Windows NT 4.0 environment. Yo can install Active Directory on the member server after yo pgrade the PDC. For more information abot the hardware reqirements of domain controllers in a Windows Server 2003 domain, see Planning Domain Controller Capacity in this book. To determine whether yor hardware configration is compatible with Windows Server 2003, see the Windows Server Catalog link on the Web Resorces page at For a worksheet to assist yo in docmenting yor existing domain controller hardware configration, see Windows NT 4.0 Hardware Configration (DSSUPNT_2.doc) or Windows NT 4.0 Domain Controller Docmentation (DSSUPNT_5.xls) on the Windows Server 2003 Deployment Kit companion CD (or see Windows NT 4.0 Hardware Configration or Windows NT 4.0 Domain Controller Docmentation on the Web at

14 300 Chapter 8 Upgrading Windows NT 4.0 Domains to Windows Server 2003 Active Directory Example: Docmenting the Windows NT 4.0 Hardware Configration Figre 8.5 shows an example of a Hardware Configration worksheet for the Windows NT 4.0 based domain controllers in the EAST domain for Trey Research. Figre 8.5 Example of a Windows NT 4.0 Hardware Configration Worksheet Domain controllers BOS-EAST-DC02 and WDC-EAST-DC02 do not meet the minimm memory reqirements for a Windows Server 2003 based domain controller. Therefore, Trey Research has determined that BOS-EAST-DC02 will be sed as the Windows NT 4.0 rollback server if a problem occrs dring the in-place pgrade process and WDC-EAST-DC02 will be assigned as a member server in the Windows Server 2003 forest. All other Windows NT 4.0 based domain controllers are capable of spporting Windows Server 2003 Active Directory.

15 Collecting Design Information 301 Docment the Existing Network Configration Docment the existing network configration for yor Windows NT 4.0 domain. Some network adapter drivers that are inclded with earlier versions of the operating system are not distribted with Windows Server If yo attempt to pgrade a Windows NT 4.0 based domain controller to Windows Server 2003 and a network adapter is installed for which a driver is not provided, yor network information might be lost or detected incorrectly dring the pgrade. Note Yo can install device drivers that are not inclded on the Windows Server 2003 operating system CD from the vendor s Web site. Create a network configration table listing the type of network adapter that each domain controller ses. Also inclde the TCP/IP configration information for each domain controller, inclding IP address, sbnet mask, and defalt gateway. Yo can rn the ipconfig command at the command line to determine IP address, sbnet mask, and defalt gateway. For more information abot the ipconfig command, type ipconfig /? at the command line. To determine whether the network card is spported by Windows Server 2003, see the Windows Server Catalog link on the Web Resorces page at For a worksheet to assist yo in docmenting yor existing Windows NT 4.0 network configration, see Windows NT 4.0 Network Configration (DSSUPNT_3.doc) or Windows NT 4.0 Domain Controller Docmentation (DSSUPNT_5.xls) on the Windows Server 2003 Deployment Kit companion CD (or see Windows NT 4.0 Network Configration or Windows NT 4.0 Domain Controller Docmentation on the Web at Figre 8.6 shows an example of a network configration worksheet for the EAST domain for Trey Research.

16 302 Chapter 8 Upgrading Windows NT 4.0 Domains to Windows Server 2003 Active Directory Figre 8.6 Example of a Windows NT 4.0 Network Configration Worksheet

17 Collecting Design Information 303 Docment Domain Controller Role Assignments As part of yor in-place domain pgrade plan, assign the existing Windows NT 4.0 based domain controllers roles that they will assme in the Windows Server 2003 domain after the pgrade is complete. Assign one of the following three roles to Windows NT 4.0 based domain controllers in a Windows Server 2003 domain: Windows Server 2003 based domain controller. Assign the role of Windows Server 2003 based domain controller to any Windows NT 4.0 PDCs and other Windows NT 4.0 based domain controllers that meet the appropriate hardware and software reqirements. Rollback server. Assign the role of rollback server in the Windows Server 2003 domain to a Windows NT 4.0 BDC that does not meet the Windows Server 2003 domain controller hardware reqirements. Windows Server 2003 based member server. Assign the role of member server in the Windows Server 2003 domain to a Windows NT 4.0 based BDC that does not meet the Windows Server 2003 domain controller hardware reqirements. For more information abot the software and hardware reqirements for Windows Server 2003 based domain controllers, see Determine Spported Operating System Upgrades later in this chapter and Docment the Existing Hardware Configration earlier in this chapter. Create a domain controller assignment table that otlines the roles that yo plan to assign to yor Windows NT 4.0 based domain controllers in the Windows Server 2003 domain. In this table, list the Windows NT 4.0 based domain controllers in yor domain, indicate whether they meet the hardware reqirements for Windows Server 2003, and list the role for each domain controller before and after yo pgrade the domain, as shown in Figre 8.7. For a worksheet to assist yo in docmenting Windows NT 4.0 based domain controller roles, see Windows NT 4.0 Domain Controller Role Assignment (DSSUPNT_4.doc) or Windows NT 4.0 Domain Controller Docmentation (DSSUPNT_5.xls) on the Windows Server 2003 Deployment Kit companion CD (or see Windows NT 4.0 Domain Controller Role Assignment or Windows NT 4.0 Domain Controller Docmentation on the Web at

18 304 Chapter 8 Upgrading Windows NT 4.0 Domains to Windows Server 2003 Active Directory Figre 8.7 Example of a Windows NT 4.0 Domain Controller Role Assignment Worksheet Determine the Domain Upgrade Order Before yo begin the in-place domain pgrade process, determine the order in which yo plan to pgrade yor Windows NT 4.0 domains. Becase accont domains generally contain more objects than resorce domains, pgrade yor accont domains before pgrading yor resorce domains. This allows yor organization to take advantage of Windows Server 2003 secrity and administration featres early in the pgrade process. The order in which yo pgrade accont domains in yor organization can affect the efficiency of yor in-place domain pgrade process. Use the following gidelines to determine the order in which to pgrade mltiple accont domains: Upgrade domains that will become targets for restrctring first. After pgrading these domains, yo can restrctre remaining domain objects into the restrctring target. Target domains mst be set at the Windows 2000 native domain fnctional level before restrctring objects into them. Upgrade domains over which yo have direct control and to which yo have easy access. This allows convenient access to these domains in the event that yo mst roll back yor deployment if the pgrade does not go as planned.

19 Collecting Design Information 305 For more information abot restrctring Windows NT domains, see Restrctring Windows NT 4.0 Domains to an Active Directory Forest in this book. Determine Spported Operating System Upgrades Identify the Windows NT 4.0 platforms that are rnning in yor environment and determine whether an operating system pgrade to Windows Server 2003 is spported, or whether yo mst perform a clean operating system installation. Table 8.1 lists the Windows NT 4.0 platforms and indicates which platforms yo can pgrade directly to each edition of Windows Server Yo do not need to reinstall applications on platforms that yo can pgrade directly to Windows Server Table 8.1 Spported Upgrade Paths to Windows Server 2003 Platform Upgrade to Windows Server 2003, Standard Edition Upgrade to Windows Server 2003, Enterprise Edition Upgrade to Windows Server 2003, Datacenter Edition Windows NT 4.0 Server, Standard Edition Windows NT 4.0 Terminal Server Windows NT 4.0 Server, Enterprise Edition Important All versions of Windows NT 4.0 mst have Service Pack 5 or later installed before pgrading to Windows Server If yo have compters in yor environment that are rnning operating systems that yo cannot pgrade directly to a version of Windows Server 2003, sch as Windows NT 3.51, yo mst do one of the following: If yo need to retain applications that are located on those compters, pgrade the compters to rn an operating system that yo can pgrade to Windows Server 2003 after verifying that those applications will fnction on and are spported by Windows Server If yo do not need to retain applications that are located on those compters, perform a clean installation of Windows Server 2003 on those compters.

20 306 Chapter 8 Upgrading Windows NT 4.0 Domains to Windows Server 2003 Active Directory Develop a Test Plan Develop a plan for testing yor in-place domain pgrade procedres throghot the in-place domain pgrade process to ensre that they have completed sccessflly and to determine whether the process of pgrading Windows NT 4.0 domains to Windows Server 2003 Active Directory was sccessfl. Table 8.2 lists the Active Directory configrations that yo mst test and the tools that yo can se to test each configration. For more information abot the options that are available for these tools, see Active Directory spport tools in Help and Spport Center for Windows Server For more information abot specific configration and fnctionality tests that yo can perform before and after the Active Directory installation, see the Active Directory link on the Web Resorces page at Search nder Administration and Configration Gides and download the Active Directory Operations Gide. Table 8.2 Active Directory Configration Test Components Configration Tool Prpose Active Directory service Active Directory replication BDC replication stats Dcdiag.exe Netdiag.exe Repadmin.exe /replsm Nltest.exe /bdc_qery:domainname Tests for sccessfl Active Directory connectivity and fnctionality. Confirms that the domain controller has passed the diagnostic tests (sch as connectivity and replicated objects). Each test mst retrn a "passed" reslt. Diagnoses networking and connectivity problems by performing a series of tests to determine the state of yor network client and whether it is fnctional. Retrns all replication events taking place between the forest root domain and other Active Directory domain controllers. This mst retrn a sccessfl replication event with all inbond and otbond replication partners. Shows connection stats for all the BDCs. This mst show "stats = sccess" for each domain controller within the domain. After yo confirm that the Active Directory configration is correct, yo need to verify that Active Directory is fnctioning correctly. Table 8.3 lists the Active Directory fnctions that yo need to test and the methods that yo can se to perform the tests.

21 Collecting Design Information 307 Table 8.3 Active Directory Fnctionality Test Components Fnction Test Method Trst relationships New ser creation New ser object replication Sccessfl logon reqest Sccessfl resorce access Verify the transitive trsts with the parent domain and the oneway trsts with Windows NT 4.0 domains. Create a new ser on the Windows Server 2003 based domain controller. After replication to BDCs takes place, determine whether new ser is replicated to BDCs. Verify that sers can log on sccessflly. Verify that the ser can access important resorces. Use the verify featre in Active Directory Domains and Trsts on the pgraded PDC to validate the trst relationships that are in place. Log on with administrator credentials and se Active Directory Users and Compters to verify that the new ser was created sccessflly. 1. Type Net User at a command prompt on a Windows NT 4.0 based domain controller, and then verify that the new ser accont exists. 2. Modify a property of an existing ser and verify that the modified property replicates with the ser. 1. Disconnect the Windows Server 2003 based domain controller to confirm that the Windows NT 4.0 based domain controller is validating the ser logon reqest. 2. Verify that yo can log on sccessflly by sing the new ser accont credentials from each client machine. 3. Verify that all client operating systems in the pgraded domain and the domains that it trsts can log on sccessflly. 4. Repeat step nmber two over trst relationships where the trsting domain controller has a secre channel with the Windows NT 4.0 based and Windows Server 2003 based domain controllers in the trsted domain. 1. Access resorces. 2. Access roaming profiles. 3. Access printers. 4. Resorce permissions belonging to the ser and a grop.

22 308 Chapter 8 Upgrading Windows NT 4.0 Domains to Windows Server 2003 Active Directory Develop a Recovery Plan Create a recovery plan for se if the in-place domain pgrade process does not go as planned. Select a Windows NT 4.0 BDC to be sed as a rollback server. Synchronize the BDC with the PDC and take the rollback server offline in the event that it mst be promoted to a PDC to restore the domain to its original state. Althogh yo are nlikely to need the offline domain controller, it is recommended that yo take one offline as a precationary step if the Secrity Acconts Manager (SAM) accont database on all domain controllers becomes corrpt. Inclde the following in yor recovery plan: The steps needed for recovery. Be sre to provide clear instrctions so that the deployment team can restore normal operations to the organization if necessary. The estimated time that can elapse before recovery mst take place. When elements of the pgrade process test nsccessflly, yo might spend nanticipated amonts of time identifying and correcting errors. Establish clear gidelines for the time period after which the deployment team mst restore operations for end sers. Team review and sign-off. All members of the deployment team mst sign off on the recovery plan. This signifies consenss abot the recovery plan and redces the chances that misnderstandings occr when the pgrade process does not go as planned. Restoring the Domain to its Original State If yor in-place pgrade process fails, yo can roll back a Windows Server 2003 Active Directory domain to its original state as a Windows NT 4.0 domain. There are two ways to roll back the deployment to its original state: Note The first recovery method is preferred for restoring a domain to its original state. The second recovery method shold only be sed if the SAM database on all domain controllers becomes corrpt. 1. Remove (either by disconnecting the network cable or trning off) any Windows Server 2003 based domain controllers from the domain. 2. Promote a Windows NT 4.0 BDC to become the PDC. 3. Synchronize all Windows NT 4.0 based domain controllers.

23 Collecting Design Information Test Windows NT 4.0 server operations and domain validation. 5. Docment the reasons for the nsccessfl domain pgrade and commnicate them to yor design team. 6. Restart the design phase for the in-place domain pgrade. Be sre to inclde steps to mitigate the factors that cased the first in-place domain pgrade to fail. Or If a failre occrs after performing the steps above, remove all Windows Server 2003 based domain controllers from the network and promote the Windows NT 4.0 BDC that has been designated as the rollback server to become the PDC. 7. Perform a fll synchronization of all Windows NT 4.0 BDCs. 8. Test Windows NT 4.0 server operations and domain validation. 9. Docment the reasons for the nsccessfl domain pgrade and commnicate them to yor design team. 10. Restart the design phase for the in-place domain pgrade. Be sre to inclde steps to mitigate the factors that cased the first in-place domain pgrade to fail. Important Yo mst take all Windows Server 2003 based domain controllers offline before yo promote the rollback server to become the new PDC. If any Windows Server 2003 based domain controllers remain online in the domain, the promotion of the BDC to a PDC will not work.

24 310 Chapter 8 Upgrading Windows NT 4.0 Domains to Windows Server 2003 Active Directory Completing Pre-Upgrade Tasks After yo create yor plan for pgrading yor Windows NT 4.0 domains to Windows Server 2003 Active Directory, yo mst complete the pre-pgrade tasks shown in Figre 8.8 before beginning the in-place pgrade process for yor domain. Figre 8.8 Completing Pre-Upgrade Tasks Collect design information Complete prepgrade tasks Upgrade domains from Windows NT 4.0 to Windows Server 2003 Active Directory Relocate the LMRepl file replication service Ensre remote access service compatibility Enable the Windows NT 4.0 environment change freeze Complete postpgrade tasks Relocate the LMRepl File Replication Service To maintain the replication of files in the NETLOGON shared folder from the Windows NT 4.0 export server to all other Windows NT 4.0 BDCs rnning the LMRepl replication engine dring the in-place domain pgrade process, pgrade all servers that are hosting import directories before yo pgrade the server that is hosting the export directory.

25 Completing Pre-Upgrade Tasks 311 If the server hosting the export directory is the PDC, yo can do one of the following: Promote a BDC that meets the Windows Server 2003 domain controller hardware reqirements to become the new PDC and demote the existing PDC to serve as a BDC hosting the export server. Or Reconfigre the LMRepl export server on a BDC and remove it from the PDC. To test the new configration to ensre that LMRepl contines to work correctly, place an empty file on the export server and verify that the file is replicated to the import directories dring replication. Next, delete the replicated file from the import directory, and then verify that the file is deleted dring the next replication. Ensre Remote Access Service Compatibility To ensre remote access compatibility in a mixed Windows NT 4.0 and Windows Server 2003 environment, pgrade the operating system on all remote access servers in the domain to Windows Server 2003 before yo begin the in-place domain pgrade process. If RAS is rnning on a domain controller, pgrade that domain controller early in the in-place domain pgrade process to minimize secrity risks. Enable the Windows NT 4.0 Environment Change Freeze Before yo pgrade the PDC in yor Windows NT 4.0 domain to Windows Server 2003 Active Directory, yo mst freeze the Windows NT 4.0 environment to ensre that no other domain changes occr ntil after the PDC is pgraded. Freeze the Windows NT 4.0 environment when: Yo have completed all of the pdates to the Windows NT 4.0 domain and have replicated them to all domain controllers. Yo have synchronized a BDC and have taken it offline for recovery prposes. When yo freeze the Windows NT 4.0 environment, no additional domain changes can take place ntil yo pgrade the Windows NT 4.0 PDC to Windows Server Commnicate to all appropriate individals that changes to the environment, sch as password pdates, will not be accepted after a specific date.

26 312 Chapter 8 Upgrading Windows NT 4.0 Domains to Windows Server 2003 Active Directory Upgrading Domains from Windows NT 4.0 to Windows Server 2003 Active Directory Before yo begin the Windows NT 4.0 in-place pgrade process, determine the pgrade path that yor Active Directory design specifies. The Active Directory design will specify one of two possible in-place pgrade paths: Upgrade to a regional domain in an existing forest. Before pgrading a Windows NT 4.0 domain and joining an existing forest as a regional domain, yo mst first deploy a Windows Server 2003 forest root domain. Complete the planning and design phases of yor Active Directory deployment and then complete the process for deploying the forest root domain. After the forest root domain is deployed, complete the in-place domain pgrade process by following the steps otlined in Upgrade to a Regional Domain in an Existing Forest later in this chapter. For more information abot deploying the Windows Server 2003 forest root domain, see Deploying the Windows Server 2003 Forest Root Domain in this book. Note If yor organization already has a Windows 2000 or Windows Server 2003 Active Directory infrastrctre in place, complete the in-place pgrade process by pgrading to a regional domain in an existing forest. To help illstrate the process for pgrading to a regional domain in an existing forest, sample data for Trey Research, is provided within the context of the tasks that mst be performed. Upgrade to a single domain forest. To create a new single domain forest, complete the in-place domain pgrade process by following the steps otlined in Upgrading to a Single Domain Forest later in this chapter. To help illstrate the process for pgrading to a single domain forest, sample data for a fictitios company, Fabrikam, Inc, is provided within the context of the tasks that mst be performed. For more information abot designing an Active Directory logical strctre and determining what forest design model best sits yor organization, see Designing the Active Directory Logical Strctre in this book.

27 Upgrading Domains from Windows NT 4.0 to Windows Server 2003 Active Directory 313 Figre 8.9 shows the two paths available for pgrading domains from Windows NT 4.0 to Windows Server 2003 Active Directory and additional tasks that all organizations mst perform regardless of which option is specified by the Active Directory design. The additional tasks, inclding modifying secrity policies, synchronizing file replication services, recreating trsts, sing DNS registration to decrease the workload on the PDC emlator, and pgrading additional domain controllers, are performed after the PDC is pgraded. Figre 8.9 Upgrading Domains from Windows NT 4.0 to Windows Server 2003 Active Directory Collect design information Are yo joining an existing forest? Complete prepgrade tasks Upgrade domains from Windows NT 4.0 to Windows Server 2003 Active Directory Yes Upgrade to a regional domain in an existing forest Modify secrity policies No Upgrade to a single domain forest Complete postpgrade tasks Synchronize file replication services Recreate trsts Use DNS registration to decrease the workload on the PDC emlator Upgrade additional domain controllers After the in-place domain pgrade is complete, yo can pgrade additional Windows NT 4.0 domains in-place or restrctre the remaining Windows NT 4.0 domains into yor Windows Server 2003 Active Directory environment. For more information abot restrctring Windows NT 4 domains, see Restrctring Windows NT 4.0 Domains to an Active Directory Forest in this book.

28 314 Chapter 8 Upgrading Windows NT 4.0 Domains to Windows Server 2003 Active Directory Upgrade to a Regional Domain in an Existing Forest To complete the process for pgrading to a regional domain in an existing forest, perform the following tasks: 1. Back p all domain data. 2. Enable the Windows Server 2003 interim forest fnctional level in the existing forest. 3. Delegate the DNS zone in the forest root domain. 4. Configre protection against domain controller overload. 5. Upgrade the operating system of the Windows NT 4.0 PDC. 6. Install Active Directory. 7. Perform post-pgrade tests. Back Up the Domain Data Back p yor Windows NT 4.0 domain data before yo begin the pgrade. This task varies according to the operations and procedres that already exist in yor environment. At minimm, complete the following steps: Back p the PDC. Back p the BDC that yo designated as the rollback server. Test all backp media to ensre that the data can be restored sccessflly. Important Store backp media in a secre offsite location designated by and accessible to the deployment team before yo begin the pgrade process.