[Samba] Replacing Win2000 DC with Samba4 - Success!

[Lukas Gradl]

Hi!

Just wanted to share a little success story:

We where asked to replace a Win2000 DC deployed by another company
which is'nt existing any more. As our focus is software development on
linux we wanted to deploy a Samba-server instead of Windows.

So after some trial and error and a lot of reading and asking (many
thanks to all that tried to help!) in mailing-lists and forums we
managed to do the migration in several steps:

Samba4 is not able to migrate from Win2000 directly - we think this
problem is not sufficiently addressed in the docs and in the wiki. So
our first attempts to do so did not succeed.

Next step was to set up a Win2012R2 Server (the trial version is
enough, no need to activate) and move over from Win2k to Win2012. How
to do that is documented in the MS-Docs. Upgrade the Win2k
ldap-schemes, add win2012 to domain, demote win2k, done.

Then we installed Samba4 and promoted it as an additional DC to the
domain. This worked quite well, only little problems syncing the
dns-Server. But I'm not shure if that was a problem with Samba4 but
with our a little special bind9-setup instead - so no reason to worry
about this in this mailing list.

After that we discovered that Win2012 can not be easyly removed from
the domain - there seem to be some (known) Problems regarding demotion
of Win2012 from a samba-domain. So we had to manually remove the
win2012-Server from the domain. That was (including some tests) app.
an hour of work - so no problem.

As an addtional benefit over a direct migration from win2k to samba4
we could use the same name as the win2k-DC for the samba-server. so no
need to change scripts using shares with the servername in it or
desktop-shortcuts on the client machines!

The whole task (without copying the data stored on the fileserver) for
replacing a single Win2k DC with Samba4 serving 25 Clients needed app.
10 Hours including a lot of research in the mailing lists and taking
several snapshots of the (virtualized) Servers involved to prevent
dataloss.

Thanks to all involved for the perfect work!

Regards
Lukas

--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[Phil Quesinberry]

>Samba4 is not able to migrate from Win2000 directly - we think this
>problem is not sufficiently addressed in the docs and in the wiki. So
>our first attempts to do so did not succeed.

I have to agree, this explains the problem we were having. Apparently your
research Kung Fu is better than mine, I was never able to turn up anything
to show that this was the case so I was expecting it to work and had posted
a question about it on the forum which no one was able to answer, presumably
due to the lack of info mentioned above.

Many thanks for sharing your success story. This info needs to go on the
Wiki.

Cheers,

- Phil



--
View this message in context: http://samba.2283325.n4.nabble.com/Replacing-Win2000-DC-with-Samba4-Success-tp4647535p4647538.html
Sent from the Samba - General mailing list archive at Nabble.com.

[Andrew Bartlett]

On Wed, 2013-05-01 at 08:21 -0700, Phil Quesinberry wrote:
> >Samba4 is not able to migrate from Win2000 directly - we think this
> >problem is not sufficiently addressed in the docs and in the wiki. So
> >our first attempts to do so did not succeed.
>
> I have to agree, this explains the problem we were having. Apparently your
> research Kung Fu is better than mine, I was never able to turn up anything
> to show that this was the case so I was expecting it to work and had posted
> a question about it on the forum which no one was able to answer, presumably
> due to the lack of info mentioned above.

As I just said to Lukus, I would like to make this work. Can you let me
know the details of what fails, it shouldn't be too hard to fix (unlike
NTP, which we can't fix).

Andrew Bartlett

--
Andrew Bartlett http://samba.org/~abartlet/
Authentication Developer, Samba Team http://samba.org

[Andrew Bartlett]

On Wed, 2013-05-01 at 14:42 +0000, Lukas Gradl wrote:
> Hi!
>
> Just wanted to share a little success story:
>
> We where asked to replace a Win2000 DC deployed by another company
> which is'nt existing any more. As our focus is software development on
> linux we wanted to deploy a Samba-server instead of Windows.
>
> So after some trial and error and a lot of reading and asking (many
> thanks to all that tried to help!) in mailing-lists and forums we
> managed to do the migration in several steps:
>
> Samba4 is not able to migrate from Win2000 directly - we think this
> problem is not sufficiently addressed in the docs and in the wiki. So
> our first attempts to do so did not succeed.

Did you record the details of why this didn't work?

While I've expressed some hesitation at Windows 2000 support here
previously, the one exception to that is for this kind of migration.

This has worked in the past - indeed, the script has a special case in
it to do a password change the way Windows 2000 will accept.

Andrew Bartlett

--
Andrew Bartlett http://samba.org/~abartlet/
Authentication Developer, Samba Team http://samba.org

[Phil Quesinberry]

Hi Andrew,

I posted an updated message on this with a fair amount of detail just before
I saw Lukus' posting here:
http://samba.2283325.n4.nabble.com/4-05-stable-domain-join-attempt-failing-with-quot-NO-DNS-zone-information-found-in-source-domain-not0-tt4647537.html
<http://samba.2283325.n4.nabble.com/4-05-stable-domain-join-attempt-failing-with-quot-NO-DNS-zone-information-found-in-source-domain-not0-tt4647537.html>

Let me know if I can provide any additional info which might be helpful.

Thanks,

- Phil



--
View this message in context: http://samba.2283325.n4.nabble.com/Replacing-Win2000-DC-with-Samba4-Success-tp4647535p4647585.html

Sent from the Samba - General mailing list archive at Nabble.com.

[Lukas Gradl]

Zitat von Andrew Bartlett <abar...@samba.org>:

> On Wed, 2013-05-01 at 14:42 +0000, Lukas Gradl wrote:
>> Hi!
>>

> Did you record the details of why this didn't work?
>
> While I've expressed some hesitation at Windows 2000 support here
> previously, the one exception to that is for this kind of migration.
>
> This has worked in the past - indeed, the script has a special case in
> it to do a password change the way Windows 2000 will accept.

Sorry - i didn't record all the steps. I posted some questions to this
list - they should be in the archives.

We had some problems with replication and i think with LDAP - but I
don't remember all the problems we had and where I found the
W2k-does-not-work-information...

regards
Lukas