IT Employment

Ask something
Discussion Locked

Logon Delay when Upgrading Domain to W2k

0 helpful
3 replies

by jfrench

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Alright, I finally decided it was time to upgrade the Windows NT4 domain here to W2k and Active Directory (all other servers but the domain servers were upgraded already to W2k). I started by taking a new server, installing NT4 and making it the PDC on the network. I then unplugged the switch it is on from the main network and promoted the old PDC back. I then upgraded the new server to W2k and made it a domain controller.
I configured the settings I needed, Then plugged it back into the network and demoted the old PDC to a BDC (so one windows 2000 DC in mixed mode, and 2 BDCs ont he network now). Then the problem hit... there were about 10 computers on the network that logged into the W2k domain server... and at the "loading personal settings" screen of W2kPro, the computer waits about 10 minutes, then finally completes loading. I disconnected the W2k PDC, then had to re-add those 10 comptuers to the NT domain (as W2k changed their logon encryption).

Any ideas on what would cause this long of a delay in logon is appreciated!

3 replies

by malcolm r

Logon problems in a Windows 2000 domain are almost always due to DNS issues. Make sure your name resolution is working correctly.

Malcolm

by timwalsh

I suspect the method you used to upgrade is the root of the problem.

The "proper" way to have done this would have been:
1. Install NT4 on the new server as a BDC.
2. Promote the newserver/BDC to PDC (which will demote the former PDC to BDC).
3. Take one of the other BDCs offline (disconnect from the network) to act as a fallback.
4. Install Win2K on the new PDC which will create the Active Directory (AD) Domain Controller (DC). This also makes the necessary changes for the NT4 BDCs to recognize the new AD DC.
5. All work stations would also have the necessary info to recognize the new DC.
6. When you are sure you have all the bugs worked out, reconnect the remaining BDC to the network.

I fear the method you used created several problems:

You broke cardinal rules 1 and 2 when dealing with AD:
1. Win2K DCs CANNOT exist in an NT4 domain.
2. NT4 PDCs CANNOT exist in an AD domain.

When you plugged the Win2K DC into the still active NT4 domain, nothing on the NT4 domain recognized the AD DC. When you removed the NT4 PDC, you only compounded the issue.

You were left with the Win2K Pro computers trying to find an NT4 PDC (because as far as they were concerned, they were part of an NT4 domain) which no longer existed. This left the Win2K Pro boxes having to authenticate to one of the BDCs. The BDCs were left in limbo because they didn't know that they were now (supposedly) members of an AD domain. All the information the BDCs had were that they were still part af an NT4 domain and one of them needed to be promoted to PDC.

At this point (assuming your NT4 domain is still working properly, you need to start over and follow the proper procedures. You CANNOT conduct a "proper" migration if the AD DC is created in isolation.

by chris..

This is right on the money. While I do not agree with the inplace upgrade of NT4 to 2k Tim does have this nailed.

Tim if you ever make it up Denver way (I saw that you're in the Springs) let me know and I'll buy ya a Beer.

Chris Floyd
chris.floyd@fpanet.org

This discussion is closed to new replies.