Moving Active Directory to new server

The migration will take place in about 3 weeks. Techpoints will be awarded after the project is finished successfully. Any other tips, pointers or pitfalls to look for would also be greatly appreciated!!!

Build the new machine and run DCPromo. The problem that I see you having is using the same computer name and IP address. Why not just build it as a Domain Controller and transfer the necessary FSMO's to the new box and then remove AD from the old server?

There is no need to remove AD from the old machine. In fact, if you are running AD and only have one machine you are very vulnerable. Put the other server into operation. Copy all the files and such to the new machine for the users. Remove theirrights to the directories on the old machines. Change the login scripts to point to the new machines and update the location of any roaming profiles or mandatory profiles etc. Have a test user login and work through any errors. It shouldn't take too long actually. Leave the other server up and running in the AD tree. This will provide AD redundancy and probably speed up the logins. The workstations may have a registry entry pointing to the old server, but the changes in login scripts and such will fix that.

Good ideas! Could information on how to transfer the necessary information be supplied?

If you're not going to use the old machine afterwards, why not back up the database then take the Hard drive and NIC and place them in the new machine?
Since it is windows 2000, it might accept it.

I have attempted moving the hard drive to a practice machine. It would not boot beyond the Windows 2000 server startup screen. Probably because the hardware is different. I also attempted to recover Active Directory to the practice machine from atape backup. It would recover initially, but then the machine would not boot. To recover Active Directory in that fashion, the hardware would have to be nearly identical. Please correct me if I am mistaken. Thanks for your answer.

One other option would be to use ADMT (the active directory migration tool, or the Clone Principal utility. This would necessitate a new naming structure of the forest itself, however. Probably the easiest solution would be to set up a new DC. Ifthere were login scripts, etc. make sure they are in the sysvol share which will get those replicated to the new DC. Once you are assured of the functionality of the new DC, transfer the FSMO roles, but remember is you only have one DC, your forestroot is in jeopardy.

setup the new server as a bdc, all active directory info will be transfered to the new machine. run dcpromo on the old machine and demote it to a standalone server. the new machine promote to a pdc. all infomation will be transfered. Once you havedone this transfer all old info that you need from the old server to the new server. the only problem with your plan is that you are not going to be able to name the server the same. the ipaddress can be changed after all info is remove. dns can set an alis name for the server to the original name if that is really important and login scripts can mapped the drives you require by using :
net use f:\\newserver\share this will map a drive to f: of the folder you require. If I can be anymore help let me know.

I would do a full back-up, remove the video drivers and use a generic, "Ghost" the partitions on the new server and see if it takes and modify the drivers for the new system on it's own network. ServerMagic or PartitionMagic work good for this. Quick, easy if it works or if you've got some time to try and fail. Do not have both systems online at the same time because of the SID's will match and confuse the workstations. If you can get it to boot, you can set it up offline and work out the details of making it work off the production floor and make it look easy.

If not, do a full back-up and restore only the AD and user data w/ permissions.

To minimize the problems you want the SID's and the names to be the same. After the migration, you really need a BDC. If for nothing else, to have a system you can promote to PDC in case of a disaster and reinstallation. Think "infant mortality" on you new server. Hardware failures are more common on new hardware in the first 6 monthsthan the rest of the warranty period.

The reason your test system would not boot past the start-up screen first is probabily because of video drivers. try using generic drivers until everything else works.

If you can get the AD restored per your last message @ 9:07 try reinstalling Windows and letting it find all the new hardware and apply it to the old system settings.
Be creative and keep it simple.

Thanks for your answer. How do I restore just Active Directory. I did use the Windows Backup utility, but it will only allow a restore of the complete system state. It doesn't allow you to just restore AD. Please let me know how to restore just AD. Thanks

Crux of problem is your desire? to reuse old name for new server. Windows 2000 does not use the name per se, but an AD object with a newly incremented ID. Just as you can't remove a user and create a new one with all the same info - they are viewed as two totally different entities. Trying to fool Active Directory will bite you big time someplace down the road.

You are describing a production box, not a test-bed. The wrong set of circumstances will trash your currently operating box. Betterto create the new server, DCPROMO to add AD, join to current domain, and allow standard replication to populate the new box. Then transfer Single Master functions (GC, Infrastructure etc.). The transfer of the Single Master roles will go smoothly if the new box can talk to the existing box. See the Microsoft KnowledgeBase under Responding to Operations Master Failures for an insight on just how difficult the "FSMO seizure" of single master roles can be.

So let's go back to your original rationale for wanting to keep the old "name". I am guessing that this is an attempt to avoid the work of redoing scripts and other pointers. Perhaps this is an opportunity to reorganize and possibly utilize organizational units to streamline your scenario?

In total, you need more than one AD Box, and the old one could be just the ticket. Plus the security of protecting your user's productivity should make you reconsider your risky approach.

Please feel free to contact me,

Bruce

I will keep the old machine as a secondary DC. That seems to be the general consensus so far. That is what I will do. When my new DC is online, all of the AD information will be automatically replicated, correct? So, if I would shut off the old machine for any reason, the new DC would take over domain control and still handle logins as usual? The second machine would be only for redundancy then? Correct?

Backup first! The Active Directory Migration Tool (ADMT) from Microsoft appears to be the best option for this task. In the event of a problem, you can use its rollback feature to automatically restore previous conditions.

Build the new server first. Install the ADMT tool on the mmc console in the new server.

From the new server, when migrating from the old server to the new server, ADMT will automatically install agent software on the old server.

ADMT lets you use a series of wizards,including the "Computer Migration wizard." - Wizards: User Migration, Group Migration, Service Account Migration, Trust Migration, and Reporting.

During user and group migration, ADMT lets users retain their access to resources such as files, shares, and applications on the old server or by updating those resources to refer to the new server. I'd prefer to down the network if it's an option.

By selecting the Test the migration settings and migrate later option, you can run a wizard without actually making any changes in your network. Review the log files and reports generated by the wizards to identify and troubleshoot any potential problems before performing the actual migration.

Go to:

http://www.microsoft.com/windows2000/downloads/tools/admt/default.asp

end

This is NOT a recommended procedure in a Windows 2000 domain. Before making the decision to move everything on this server some serious thought and heavy reading should be done. One thing to read about is FSMO roles. You setup your first DC with Win2k and it holds the schema, domain naming, RID, infrastructure and PDC roles. Moving these roles is a task from H**L. If for some reason in moving the schema role you end up with two schema masters, Microsoft will say, "go ahead and start over from scratch." Your best bet...keep the first DC in place. Change DHCP so that all of your DNS and WINS queries go to the new server. You may want to move the PDC emulator role to the new server if you have down level clients. There are some greatwhite papers...the biggest thing to look at for sure is operations master roles (FSMO). Just by using the new server for DNS and WINS you will take a big load off the old server and have some level of fault tolerance. Use the new server as your primary WINS & DNS and use the old server as your secondary.

We have three MCSE's on staff..no paper either. If you would like some assistance please email me

Chris Arsenault
Network Administrator, MCSE
carsenault@firstedcu.org

I see all the answers gives quite different opinions, here is even another one :-)
With as many as 1400 users, I would say that one server is a little on edge? I see you describe is a PDC, does that mean you have other NT4 servers or workstations on the network? In Win2K native mode there is no such things as PDC/BDC anymore, multimasters, all DC's can be masters, but some information is by default only stored on one machine (First DC set up), like the schema.
As you commented on 06/06/01 09:10 PM EDT, setting up the new one as an additional DC is probably the best approach, this will not make you able to use same IP and name, if most 1400 clients are using DNS names (and not ip adress) for any services located on the server, that shouldn't be too much of a problem? Moving a network connection / routing, from one to the other should be fairly easy as well, just change the default gateway and routing tables. As soon as the new server is up and has joined the domain, let everything replicate and make sure you scan the event logs on both machines often, it tends to show up a good bunch of red and yellow events, most of them easily solveable by searching microsofts knowledge base or the internet by event ID. I also recomend buying this book: O'reilly "Windows 2000 Active Directory" by Alistair G Lowe-Norris, ISBN 1-56592-638-2 (550pages), it explains a lot about how AD works. After 24 to 48 hours of the two DC working together, I would look at getting things like getting the Schema moved, and changing the parameters for which server the clients should use primarely for some services if you have problems with clients hiting the wrong one, the Oreilly book is really good at explaining some of these things.
The resourcekit is nice as well, but I think it is difficult to find what I need in it, most of MS-press books are written by and for MS-Only ppl or something.
Good luck :)

To throw my two cents in- If you can spare the hardware, leave the original machine as a DC. This way you have on online backup of your user database. If one DC goes down you still have a copy of your entire users security model.
And as for discussions about the FSMO roles. You can seize these roles if you ever lose a FSMO server
With the two servers you can balance your network load also. Have one performing network services like DHCP, DNS, and WINS. Let the other one do your file and print sharing.

I think you could move the harddisk of the old machine to the new one and make HD copy and then turn up the new machine ,,,so you will have the same data and the same machine configuration .

I haven't had the chance to read all of the answers, but your last comment merits some warnings. If you shut off the original domain controller, and if you don't intend on running it as a domain controller anymore, than you will need to sieze the Schema Master role. BUT....if you seize the schema master role, you CANNOT run the original computer on the network again, or a true nightmare will begin.

Seizing the Schema Master Role isn't complicated by any means. The Help program of Windows 2000 has a good resource on how to accomplish this goal.

I hope my warning helps. If you don't plan on shutting off the original computer, than you don't need to worry, but, the first domain controller in the domain is going to be your Schema Master, unless another machine seizes it.

Hope this helps.

Mike

first thing to do is to install another disk
on the sever and mirror the boot partition.
after disconnect the mirror and live one h.d as a beckup.
remove any gpo that effecting the server.
go to services and desable the routing and remote service .
restart the mechine and go safe mode , remove all hardware.
turn the mechine off.
transfer the h.d to the new mechine and satart it.let the system detect all hardware
and install all drivers.
reconfigure the nic's and start routing and remote services.
note that you may need to desable and reenable the service (from rras mmc)
*the mechine shuold be disconnected from the lan until it is operational

first thing to do is to install another disk
on the sever and mirror the boot partition.
after disconnect the mirror and leave one h.d as a beckup.
remove any gpo that effecting the server.
go to services and desable the routing and remote service .
restart the mechine and go safe mode , remove all hardware.
turn the mechine off.
transfer the h.d to the new mechine and satart it.let the system detect all hardware
and install all drivers.
reconfigure the nic's and start routing and remote services.
note that you may need to desable and reenable the service (from rras mmc)
*the mechine shuold be disconnected from the lan until it is operational

to answer you last question. If the second DC does not properly replicate all you would have to do is demote it, then promote it again, and the AD would rebuild/refresh itself. Good luck.

Well, I would mirror everything if I was doing the switch, as 1400 folks exposed to a denial of service, well ,you get the picture...
Contact Partitian Magic, see what tech help is available for the product in this particular setup situation, as I would go with the best software available, and as I am familiar with the Partitian Magic setup, I know it can handle the task, but it requires the Win platform, that has to be installed , now mirror the drives or simply migrate them to the new machine, but I would install a huge drive on the machine to take all the overlap for futures. I see why you would want to retire the old machine, but think on it, as it can be slaved to the new one, and all the power of the new one can operate the setup, pluss it allows a much bigger storage capacity, because you won't run into limits imposed by Mobo setups, the smothest possible transition would be either Mirroring the drives (Perfect for a backup) or migrating the old drives into the new one, quite frankly, a backup tape or any such setup in that configuration can place a error on the drive that won't show up intill later, requiring a polititian to hold off the mob. AS far as the Tech points , ok or not , it's cool.
Hope you get done withoutbeing lynched.

When you run DCPROMO the last thing it does is synchronize the directory with the current DC. With Win2K there is no Primary controller, all DC's are kinda created equal. The one situation that you will want to take heed of before removing the old DC is the Operations Masters and the Global Catalog. Make sure that after you run the DCPROMO, you assign the new server to the role of operations master for all five "operations" and you check the box for the global catalog. Microsoft Help is pretty good with respect to operations masters and setting it up. I ran into a situation similar to yours except I did not assign the global catalog and I logged errors until the event logs were full, it slowed the system down and it was a bit of a pain. Asfar as AD goes take as much redundancy as you can get.

I want to thank everyone who answered my question. I used a combination of all the answers to arrive at a successful conclusion. Specifically, I ghosted the hard drive from the PDC. Then installed it in the new server. I started the new server in safe mode and removed all the appropriate device drivers. Restarted the new server and after the initial install of new devices, the server ran flawlessly. I then demoted the old DC and promoted it. Again, perfect! The machines are replicating and my logins are faster! And, on top of everything, I learned a ton more about the OS. Can hardly believe a Microsoft product works as well as it does. My hat is off to you all!!

Sincerely,

James Michael Stitt

This question was closed by the author