Upgrading an Active Directory Domain from Windows Server
2008 or Windows Server 2008 R2 to Windows Server 2012
!!!NEVER START BEFORE HAVING CREATED AND TESTED A BACKUP OF YOUR
DOMAIN/DATA/MACHINE!!!
A new OS Domain Controller installation should always start with use from the
support tools to check the Domain and Domain Controllers for errors that must be
resolved before. The following command line tools and programs will help you to
verify if some problems exist within your Domain and the Domain Controllers.
Dcdiag /v /c /d /e /s:
DCName >c:\dcdiag.log [please replace
DCName with your Domain Controller name]
Repadmin /showrepl
dc* /verbose /all /intersite >c:\repl.log
["
dc* is a place holder for the starting name of the DCs if they all
begin the same (if more than one DC exists)]
Dnslint /ad /s "DCipaddress" [use
http://support.microsoft.com/kb/321045
for download and instructions]
ADREPLSTATUS:
http://www.microsoft.com/en-us/download/details.aspx?id=30005
--------------------------------------------
On the old server open DNS management console and check that you are running
Active directory integrated zones, which is recommended also from Microsoft.
--------------------------------------------
The Schema must be updated for the new OS Domain Controller, so even if the
update is done automatically you may check it before. Therefore you can use the
following command:
"Dsquery * cn=schema,cn=configuration,dc=
domain,dc=
local -scope
base -attr objectVersion" without the quotes in a command prompt [please replace
“
dc=domain,dc=local” with your Domain Name]. The output number is the
Schema objectVersion:
13 = Windows 2000 Server
30 = Windows Server 2003
31 = Windows Server 2003 R2
44 = Windows Server 2008
47 = Windows Server 2008 R2
56 = Windows Server 2012
--------------------------------------------
If the first installed Domain Controller in the domain should be removed or
replaced with another one, doesn’t matter if new or same OS version, assure that
you export the recovery agents EFS certificate private key from the Domain
Controller
BEFORE you demote/retire it. Details on how to do
this are listed in (
http://support.microsoft.com/kb/241201)
and (
http://technet.microsoft.com/en-us/library/cc755157(WS.10).aspx).
If you don’t save it, you will not be able to encrypt data in case of
problems.
--------------------------------------------
I recommend installing the new machine as a member server in your existing
domain before promoting to Domain Controller. Configure a fixed ip address and
set the preferred DNS server to one existing DC/DNS server only. Do not change
anything with IPv6, as also recommended from Microsoft in
http://technet.microsoft.com/en-us/magazine/2009.07.cableguy.aspx
Do NOT use the new server as DNS server on the NIC until all DNS information
is replicated from one existing DC/DNS. If you do it with other DNS servers on
the NIC I often have seen that the SYSVOL and NETLOGON shares are not correct
created.
--------------------------------------------
As this article applies in most steps to Windows Server 2008 32bit/64bit and
Windows Server 2008 R2, I’ll start with the difference on Windows Server 2008
32bit preparation.
To install a new OS Domain Controller
adprep is required and located
in the Windows server 2012 installation disk
…\support\adprep folder.
Here you can also find the schema files. You will realize that there is
ONLY adprep.exe and not
adprep32.exe anymore. This belongs to the reason that adprep process on
earlier OS domains is done automatically during promotion to DC.
If you run
adprep.exe on the
32bit OS Domain Controller you
will see an error message:
So on Windows Server 2008 32bit you have to prepare the forest/domain with
the new way remote from Windows Server 2012.
With the 64bit version from adprep you can still work on Windows Server 2008
64bit and Windows Server 2008 R2 DCs for the Schema update.
So both options are possible, from the command line on Windows Server 2008 R2
or during promotion process from the Windows Server 2012.
--------------------------------------------
The minimum functional level must be at least Windows Server 2003, so
NO lower functional levels are allowed anymore.
Please control that the Domain functional level is set to Windows Server
2003, in AD Domains and Trusts right click the "Domain Name".
Also control that the Forest functional level is set to Windows Server 2003,
in AD Domains and Trusts right click “Active Directory Domains and Trusts”.
--------------------------------------------
If you run as known before
DCPROMO on a new Windows Server 2012 you
will get an error message as this is not longer the way to promote a DC. Now the
promotion to Domain Controller is done via Server Manager.
--------------------------------------------
In this article I will focus on the new remote way with using the Windows
Server 2012, as this is much more error free and comfortable to use.
Assure to use an account that is member of the Enterprise Admins and install
the new Windows Server 2012 as Domain Member Server if not done already. Now
start the Server Manager and choose “Add roles and features”, in “Before you
begin” click next, in the “Installation Type” use “Role-based or feature-based
installation” and click Next.
Choose the required Server and click Next
Now check the Active Directory Domain Services and in the upcoming window
click the “Add features” button.
Choose Next and add additional features if required.
Click Next.
Click Next and then choose Install.
It may take some time, depending on the hardware.
If the installation is done be aware of the “Promote this server to a domain
controller” option in the result pane
Again a new window opens to configure the DC with all requirements
Here choose Select and provide the domain credentials or use the already
shown account. If you have the need using a smart card, then the server
MUST be joined to the domain
BEFORE.
Select the domain from the list and click OK.
Click Next.
The Domain controller Options appear and here choose DNS and GC and fill in
the DSRM Restore mode password. Then choose Next.
In this step the DNS delegation warning can be ignored, as the Domain
Controller is for the already existing domain.
Choose Next and either use the default or select a preferred DC to replicate
from. Even IFM (Install from media) is possible at this step.
Do
NOT store
the Active Directory database, log files, or SYSVOL on a data volume formatted
with
Resilient File System (ReFS), this is new with Windows
Server 2012. Database, Log file and SYSVOL folder paths must be stored on NTFS
data volumes in this window and then choose Next.
Information about forest, schema and domain update is shown where you also
choose Next.
Review your settings, even possible to export as Windows PowerShell script
for future use and click Next.
Prerequisite checks will be done.
Review the Check and click Install.
Results are listed/shown
The server automatically reboots after installation/promotion.
--------------------------------------------
After adding a Windows Server 2012 Domain Controller to an existing domain
you should also transfer the FSMO roles to the newest Domain Controller
In this case 6 new security groups are created in the BUILTIN container in AD
UC:
- Access Control Assistance Operators
- Hyper-V Administrators
- RDS Endpoint Servers
- RDS Management Servers
- RDS Remote Access Servers
- Remote Management Users
And 1 new security group in the Users container in AD UC:
- Cloneable Domain Controllers
--------------------------------------------
You can see in the event viewer (Directory service log) that the FSMO roles
are transferred, EVENT ID 1458 with the source ActiveDirectory_DomainService for
each FSMO role.
--------------------------------------------
After the transfer from the PDCEmulator FSMO it is required to reconfigure
the time service on the old and new PDCEmulator, so a recommended external time
source is used:
"w32tm /config /manualpeerlist:PEERS /syncfromflags:manual /reliable:yes
/update”
where PEERS will be filled with the ip address or server (time.windows.com)
and on the OLD PDCEmulator run:
"w32tm /config /syncfromflags:domhier /reliable:no /update”
and stop/start the time service on the old one. All commands run in an
elevated command prompt
without the quotes.
--------------------------------------------
If not done on earlier OS version upgrades run
ONLY the
adprep
/domainprep /gpprep, to enable the RSOP planning mode, manual as this
is NOT involved in the automated process.
--------------------------------------------
Reconfigure the DNS configuration on your NIC of the Windows Server 2012
machine, preferred DNS itself, secondary another Domain DNS server and as
recommended from DNS BPA the loopback ip address (127.0.0.1) as 3
rd
entry.
--------------------------------------------
