Upgrading your Active Directory to Windows Server 2008
Here is in-place upgrading Windows Server 2003 and Windows Server 2003 R2 Domain Controllers to Windows Server 2008 Domain Controllers. It will also help to installing Active Directory 2008 R2.
Installing active directory 2008 might seem like simply feeding the DVD and pressing Next> until your server reboots into Windows Server 2008, there’s actually a more subtle and profound way to perform these in-place upgrades. Perhaps after reading this post you feel you don’t want to in-place upgrade your Windows Server 2003 and Windows Server 2003 R2 Domain Controllers anymore but instead transition the whole lot.
Contents
- Ways to migrate
- Reasons to upgrade in-place
- Reasons not to upgrade in-place
- Steps to upgrade in-place
- Before you begin
- Prepare your Active Directory environment
- Choosing which Domain Controller to upgrade first
- Upgrade the first Domain Controller
- Upgrade additional Domain Controllers
- Raise the domain functional level
- Raise the forest functional level
- Concluding
Ways to migrate
As shown last time upgrading your Windows Server 2003 Active Directory environment to Windows Server 2008 can be done in three distinct ways:
- In-place upgrading
Windows Server 2003 and Windows Server 2003 R2 can both be upgraded in-placeto Windows Server 2008 - Transitioning
Migrating this way means adding Windows Server 2008 Domain Controllers to your existing Active Directory environment. - Restructuring
A third way to go from Windows Server 2003 Domain Controllers to Windows Server 2008 Domain Controllers is restructuring your Active Directory environment. This involves moving all your resources from one (Windows Server 2003) domain to a new and fresh (Windows Server 2008) domain. Tools like the Active Directory Migration Tool (ADMT) are priceless in these kind of migrations.
Reasons to upgrade in-place
In-place upgrading is the path of the least investment. You can simply reuse your existing Windows Server 2003 and Windows Server 2003 R2 Domain Controllers as Windows Server 2008 Domain Controllers.
Just like transitioning In-place upgrading means you get to keep your current Active Directory lay-out, contents, group policies and schema.
In-place upgrading is good when:
- You worked hard to get your Active Directory in the shape it’s in.
- Your servers are in tip-top shape.
- There’s really no budget to buy new servers.
Be sure your current Windows Server 2003 Domain Controllers will last another three to five years when you intend to upgrade them in-place. Transitioning isn’t really any harder compared to in-place upgrading. So if you’re going to do either, please make sure you’re not heading for double work. It would be sad to see you upgrade Domain Controllers now and see you transition in a year from now, while you could’ve easily transitioned in the first place.
Remember: You’re the one with the advantage in negotiations when your boss wants you to go to Windows Server 2008 and really doesn’t want to buy new servers.
Reasons not to upgrade in-place
While I can find two main reasons to perform in-place upgrades, I can find a lot of reasons not to perform them: (and choose another migration path)
- Your servers do not meet the required patch level for in-place upgrading
(The Windows Server 2003 patch level should be at least Service Pack 1) - You want to upgrade across architectures (between x86, x64 and/or Itanium)
- You’re running Windows Small Business Server 2003 or Windows Small Business Server 2003 R2 (upgrade scenarios for Small Business Server are uncertain at this moment)
- You want to switch Windows Server edition (to obtain clustering for instance)
- Standard Edition can be upgraded to both Standard and Enterprise Edition
- Enterprise Edition can be upgraded to Enterprise Edition only
- Datacenter Edition can be upgraded to Datacenter Edition only
- You want your Windows Server 2008 Domain Controllers to be Server Core installations of Windows Server 2008. Upgrading to Server Core is not possible
- Your Windows Server 2003 Domain Controllers are equipped with a boot drive which has less than 14062 MB of free space (solution here) or your your Windows Server 2003 Domain Controllers do not meet the Windows Server 2008 (recommended) System requirements.
- Applications on your existing Domain Controllers are not tested with or certified for usage on Windows Server 2008.
- Applications or installed components on your Windows Server 2003 have known problems when upgrading in-place to Windows Server 2008. PowerShell and thus Exchange Server 2007 are such programs!
If these considerations leave you with an undesirable outcome (for instance you wanted to migrate from 32bit Domain Controllers to 64bit Domain Controllers) choose to transition your Windows Server Active Directory environment to Windows Server 2008.
Steps to upgrade in-place
Upgrading your Windows Server 2003 and Windows Server 2003 R2 Domain Controllers in-place to Windows Server 2008 Domain Controllers consists of the following steps:
Before you begin
Avoid common mistakes
There is a very good Microsoft Knowledge Base article on Common Mistakes When Upgrading a Windows 2000 Domain To a Windows 2003 Domain, written by community experts. I suggest you read it. (twice) Most of the contents also apply to transitioning from Windows Server 2003 (R2) to Windows Server 2008
Plan your server lifecycle
It’s not uncommon for a Domain Controller to sit on your network for a period of five years. I believe you should take this in mind when selecting and buying a server. You should plan your partitions (or volumes) carefully and place the Active Directory files on separate volumes when your needs justify it. The Windows Server catalog helps you pick systems that will run Windows Server 2008 with ease.
Assess your readiness
Microsoft has kindly provided a tool to scan systems to assess whether systems are capable of running Windows Server 2008, whether drivers are available (either from Microsoft update or on the installation media) and what problems you might encounter when upgrading to Windows server 2008. I recommend checking your systems with this tool, which is called the Microsoft Assessment and Planning Solution Accelerator (MAP for short).
Backups
Make backups of all your Domain Controllers and verify you can restore these backups when needed.
Documentation
It is a good thing to know exactly what you’re migrating. When things go wrong you might need to be able to revert back to the old situation. This might require the Directory Services Restore Mode (DSRM) password and credentials for service accounts, which might not be written down anywhere. In multiple Domain Controller, multiple domain, multiple forest and multiple sites scenarios it’s very wise to make a table containing the relevant information per Domain Controller in terms of Flexible Single Master Operations (FSMO) roles, Global Catalog placement, domain membership, site membership, replication topology, routing tables, IP addressing, etc.
Communication
When done right your colleagues might not even suspect a thing, but it’s important to shed some light on what you’re doing. (Make someone) communicate to the end users that you’re going to mess with the core of their infrastructure. This might result in colleagues understanding you’re (really) busy and might also result in problems being reported fast. Both are good things if you’d ask me…
Prepare your Active Directory environment
Before you can begin to upgrade the first Windows Server 2003 Domain Controller to a Windows Server 2008 Domain Controller, you first have to prepare the Active Directory.
Microsoft provides a tool called adprep.exe to facilitate this preparation. You need to run the following commands on the following servers in your Active Directory environment:
You need to run the following commands on the following servers in your Active Directory environment:
| Command | Domain Controller |
| adprep.exe /forestprep | Schema Master |
| adprep.exe /domainprep | Infrastructure Master |
| adprep.exe /domainprep /gpprep | Infrastructure Master |
| adprep.exe /rodcprep * | Domain Naming Master |
* Optional when you want to deploy Read Only Domain Controllers.
After preparing your Active Directory for Windows Server 2008 be sure to check the process. Breadcrumbs to failures may be found in the event viewer, but real men will check the adprep.log files.
Allow sufficient time for proper replication to all your Windows Server 2003 Domain Controllers. (In large environments with specific replication needs this might take hours.) When you feel all changes have been replicated use the replmon and repadmin tools to check and optionally troubleshoot Active Directory replication.
Choosing which Domain Controller to upgrade first
When your Active Directory forest consists of many Active Directory domains, begin your upgrades in the forest root domain.
Flexible Single Master Operations (FSMO) roles are key in your Active Directory environment. When your environment allows it, it is recommended to:
- Transfer all the Flexible Single Master Operations (FSMO) roles from the root domain (3) and the entire forest (2) to a single Active Directory Domain Controller
- Make all Domain Controllers Global Catalogs
Perform an in-place upgrade of the Domain Controller holding all the Flexible Single Master Operations (FSMO) roles first. This will ensure the first Windows Server 2008 Domain Controller is a Global Catalog and all the Flexible Single Master Operations (FSMO) roles are on Windows Server 2008.
After you have upgraded the Domain Controller holding all the FSMO roles in the forest root domain, you can upgrade the Domain Controllers for additional domains in your forest. Place the domain-wide FSMO roles (3) on a single server and upgrade it in-place.
When you’re done upgrading other servers you can redistribute Flexible Single Master Operations (FSMO) roles across other servers, although it is a best practice to keep your Flexible Single Master Operations (FSMO) roles on as little servers as possible.
Upgrade the first Domain Controller
After preparing your Active Directory environment you can start the in-place upgrade on your first Windows Server 2003 Domain Controller. Simply enter the Windows Server 2008 DVD, corresponding to the architecture (x86, x64 or Itanium) and the Edition (Standard, Enterprise, DataCenter) you’re migrating from and to.
In the initial Install Windows screen press the Install Now button to begin installation of Windows Server 2008.
The screen Get important updates for installation gives you the option to either go online and get the latest updates for installation or to skip going online. I recommend choosing Go online to get the latest updates for installation (recommended), since Microsoft might enhance the Windows Server 2008 installation wizard by adding additional support for drivers and scenarios.
Note:
These updates are not related to the updates your accustomed to receive through Windows or Microsoft Update. These updates relate to the Windows Server 2008 Installation process only. Microsoft may choose to enhance the installation experience between Service Pack releases.
Depending on your media type you will see the Type your product key for activation window. If you do, simply type your Windows product key and tick the Automatically activate Windows when I’m online option.
In the Which type of installation do you want window select Upgrade.
The Compatibility report window will be displayed telling you what hardware might not function once upgrade is completed , also to check with software vendors to check if their software are compatible with Windows Server 2008. click Next.
The Installation wizard will now perform an in-place upgrade of your Windows Server 2003 Domain Controller. After multiple restarts, the Upgrade process will be completed and you will be able to start using your Windows Server 2008. Your upgrade might take hours to complete.
Upgrade additional Domain Controllers
Upgrading additional Domain Controllers in place is as easy as repeating the steps for in-place upgrading the first Domain Controller.
If you want to deploy Read Only Domain Controllers (RODCs) in the same domain as your upgraded Domain Controller, make sure:
- You have deployed at least one Windows Server 2008 in each domain you want to deploy Read Only Domain Controllers, before you deploy the first Read Only Domain Controller.
- Both the Forest functional level and Domain functional level are Windows Server 2003 at minimum, before you deploy the first Read Only Domain Controller.
- You have run adprep.exe /rodcprep on the Domain Controller holding the Domain Naming Master Flexible Single Master Operations (FSMO) role for the forest you want to deploy Read Only Domain Controllers in, before you deploy the first Read Only Domain Controller.
Raise the domain functional level
After you’ve successfully upgraded the last Windows Server 2003 Domain Controller for a specific domain (or you don’t feel the need to ever add pre-Windows Server 2008 Domain Controllers to your Active Directory environment) you’re ready to raise the Domain functional level of that domain.
Upgrading the domain functional level to Windows Server 2008 adds the following features to your environment:
- Distributed File System Replication (DFS-R) support for SYSVOL, which provides more robust and detailed replication of SYSVOL contents with minimal replication traffic compared to FRS.
- Advanced Encryption Services (AES 128 and 256) support for the Kerberos protocol.
- Last Interactive Logon Information, which displays the time of the last successful interactive logon for a user, from what workstation, and the number of failed logon attempts since the last logon.
- Fine-grained password policies, which make it possible for password and account lockout policies to be specified for users and global security groups in a domain, instead of per domain only.
Note:
Raising the functional level is a one way procedure. Once you’ve raised your domain functional level there’s no way to return to the previous domain functional level.
Raising the domain functional level in Windows Server 2008 looks remarkably similar toraising the domain functional level on Windows Server 2003:
- Log on to the Domain Controller holding the PDC emulator FSMO role with a user account that is a member of the Domain Administrators group..
- Open Active Directory Domains and Trusts.
- In the console tree, right-click the domain for which you want to raise functionality, and then click Raise Domain Functional Level.
- In Select an available domain functional level, click Windows Server 2008, and then click Raise.
Raise the forest functional level
After you’ve successfully raised the domain functional level of all the domains in your Active Directory forest you’re ready to upgrade the Forest functional level. This will not add any features, but will result in all domains that are subsequently added to the forest will operate at the Windows Server 2008 domain functional level by default.
Note:
Raising the functional level is a one way procedure. Once you’ve raised your forest functional level there’s no way to return to the previous forest or domain functional levels.
To upgrade the forest functional level to Windows Server 2008 perform the following actions:
- Log on to the Domain Controller of the forest root domain holding the PDC Emulator FSMO role with a user account that is a member of the Enterprise Administrators group.
- Open Active Directory Domains and Trusts.
- In the console tree, right-click Active Directory Domains and Trusts, and then clickRaise Forest Functional Level.
- Under Select an available forest functional level, click Windows Server 2008, and then click Raise.
Concluding
In my mind in-place upgrading is more tricky than transitioning your Active Directory environment. If at all: it’s the same amount of work. With transitioning you need to perform the right steps at the right time. With In-place upgrading you need to check more prerequisites before you can actually slap in the disk.
With transitioning being inevitable (since hardware ages) and 64bit computing looming on the horizon I feel In-place upgrading is the right migration scenario only on rare occasions.
Please note however Microsoft supports in-place upgrading many Active Directory technology specialists do not recommend upgrading Domain Controllers.
Whether you’re looking for troubleshooting tips, deep dives into systems architecture, or the latest in cloud computing, I’m here to help you navigate the evolving tech landscape. Let’s connect, learn, and grow together!
📧 ravi.chopra1709@gmail.com
- Top Azure Interview Questions with Expert Answers (Scenario Based) - 22 December 2024
- Entra ID (Azure Active Directory): Migration and Integration Guide - 20 December 2024
- Active Directory Federation Services (ADFS): Implementation Guide - 16 December 2024
