How to change Secondary DC to Primary DC?
Robin
secondary DC. Now I'll need to move one of the Server to another place (not
linked anymore. Just need one server at one place). Anyone can guide me or
give me some reference to make the Server B as primary DC with DNS, AD, etc..
Thanks in advance..
Meinolf Weber [MVP-DS]
Since windows 2000 there is no secondary or primary DC. All DCs are the same,
the differences are the 5 FSMo roles placed on them according to some rules.
Make sure both DCs are also DNS servers, use AD integrated zones, and in
a single forest domain like domain.com make all DCs Global catalog server.
Do not forget to reconfigure the DHCP scopes for the additional DNS if not
done or change machines with fixed ip addresses.
http://support.microsoft.com/kb/223346/en-us
Best regards
Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
Marcin
just to clarify, are you planning on moving an existing domain controller to
a different location that does not have a connection to the current one?
If so, this is NOT a good idea. Your domain controller - as long as they are
part of the same forest - need to be able to communicate. The correct
approach would be to demote that domain controller, move the server to the
new location, and promote it to a domain controller in a new
domain/forest...
hth
Marcin
"Robin" <Ro...@discussions.microsoft.com> wrote in message
news:3D137376-4142-4D20...@microsoft.com...
Ace Fekay [MCT]
news:3D137376-4142-4D20...@microsoft.com...
Robin,
You've heard about the gotchas and ramifications, as well as reasons why
this is not a good idea.
I'm curious as to what are the overall goals and reasons behind your plan.
Was there an acquisition or a company split-up?
--
Ace
This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.
Please reply back to the newsgroup or forum for collaboration benefit among
responding engineers, and to help others benefit from your resolution.
Ace Fekay, MCT, MCTS 2008, MCTS Exchange, MCSE, MCSA 2003 & 2000, MCSA
Messaging
Microsoft Certified Trainer
For urgent issues, please contact Microsoft PSS directly. Please check
http://support.microsoft.com for regional support phone numbers.
Robin
and there is a new company taking over the place. We have 2 Servers 2003 and
my old company will be bringing over one Server with them along. In this
case, the primary DC/DNS/DHCP. So I'll left with my second DC Server here in
my new company. Is it possible to promote my this second Server to DNS and
DHCP with all the AD accounts intacts? (Most people are staying with the new
company)
2nd option:
If I were to purchase a new server to replace the primary DC. What are the
things I need to do?
- Can I use Server 2008 to run together with the old Secondary DC (Server
2003)?
- Should I promote my new server to Domain Controller first then demote the
old primary DC? (What are the steps to demote?)
- Or can I just simplify disconnect the old primary DC from the network
after I successfully promote my new server?
Thanks in advance..
Robin
Phillip Windell
Maybe someone said this, maybe not, I don't have the whole thread...
But the concept of a Primary and a Secondary died 9 years ago with NT4.0.
There is a PDC "role",...but it is just a "role" and the jobs it does is not
entirely identical to the PDC of NT4.0. This role can be moved from DC to
DC at will,...there is no "promotion" or "demotion" involved in that.
The DCs can be "split up" by just physically separating them,...then each
company will have to take their DC that they kept and do a Meta Data Cleanup
to remove the missing DC that was not gracefully removed. Then each company
will take the DC that they kept and have it "seize all FSMO roles" and make
is a Global Catalog Server (one already is a CG). You do not want these two
DCs to ever be on the same network together after this.
There might be problem concering the missing DHCP,...how do you
unauthorize/deactivate it when it is there no longer, I don't know. But
that is only a problem in the side that took the DC that didn't have the
DHCP on it. They will also have to add the DHCP Service and set it up on
their DC which never had it before.
Then both sides just deletes the User accounts they no longer need. However
you still end up with two companies in two locations running identical
Domains with the same name and same SID,...and same Administrator Accounts
with the same passwords (assuming the password was not changed).
But if it were me,...I would go through these steps first, but only
temporary. I would then create and entirely new domain on a new DC with a
new name,...then I would use ADMT and migrate everything I needed from the
old domain into the new one. When completed I would wipe out the old DC and
reload the machine from scratch, them promote it a new second (not
"secondary") DC in the new domain so that my new domain had two DCs.
--
Phillip Windell
The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------
Meinolf Weber [MVP-DS]
Here are the detailed steps 2003 to 2008 upgrade:
!!!NEVER START BEFORE HAVING CREATED AND TESTED A BACKUP OF YOUR DATA/MACHINE!!!
- Do you use any kind of Exchange in the 2003 domain? If yes, which one?
- On the old server open DNS management console and check that you are running
Active directory integrated zone (easier for replication, if you have more
then one DNS server)
- run replmon from the run line or repadmin /showrepl(only if more then one
DC exist), dcdiag and netdiag from the command prompt on the old machine
to check for errors, if you have some post the complete output from the command
here or solve them first. For this tools you have to install the support\tools\suptools.msi
from the 2003 installation disk.
- run adprep /forestprep and adprep /domainprep and adprep /rodcprep from
the 2008 installation disk against the 2003 schema master(forestprep) / infrastructure
master(domainprep/rodcprep), with an account that is member of the Schema/Enterprise/Domain
admins, to upgrade the schema to the new version (44) or 2008 R2 (47)
- you can check the schema version with "schupgr" or "dsquery * cn=schema,cn=configuration,dc=domainname,dc=local
-scope base -attr objectVersion" without the quotes in a command prompt
- Install the new machine as a member server in your existing domain
- configure a fixed ip and set the preferred DNS server to the old DNS server
only, think about disabling IPv6 if you are not using it, some known problems
exist with it. Follow (http://blogs.dirteam.com/blogs/paulbergson/archive/2009/03/19/disabling-ipv6-on-windows-2008.aspx)
to disable it
- run dcpromo and follow the wizard to add the 2008 server to an existing
domain, make it also Global catalog and DNS server.
- for DNS give the server time for replication, at least 15 minutes. Because
you use Active directory integrated zones it will automatically replicate
the zones to the new server. Open DNS management console to check that they
appear
- if the new machine is domain controller and DNS server run again replmon,
dcdiag and netdiag (copy the netdiag from the 2003 to 2008, will work) on
both domain controllers
- Transfer, NOT seize the 5 FSMO roles to the new Domain controller (http://support.microsoft.com/kb/324801
applies also for 2008), FSMO should always be on the newest OS DC
- you can see in the event viewer (Directory service) that the roles are
transferred, also give it some time
- reconfigure the DNS configuration on your NIC of the 2008 server, preferred
DNS itself, secondary the old one
- if you use DHCP do not forget to reconfigure the scope settings to point
to the new installed DNS server
- if needed export and import of DHCP database for 2008 choose "netshell
dhcp backup" and "netshell dhcp restore" command (http://technet.microsoft.com/en-us/library/cc772372.aspx)
Demoting the old DC
- reconfigure your clients/servers that they not longer point to the old
DC/DNS server on the NIC
- to be sure that everything runs fine, disconnect the old DC from the network
and check with clients and servers the connectivity, logon and also with
one client a restart to see that everything is ok
- then run dcpromo to demote the old DC, if it works fine the machine will
move from the DC's OU to the computers container, where you can delete it
by hand. Can be that you got an error during demoting at the beginning, then
uncheck the Global catalog on that DC and try again
- check the DNS management console, that all entries from the machine are
disappeared or delete them by hand if the machine is off the network for ever
- also you have to start AD sites and services and delete the old servername
under the site, this will not be done during demotion
Best regards
Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
Meinolf Weber [MVP-DS]
See inline.
Best regards
Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
> My situation here is that my old company is moving out to another
> location and there is a new company taking over the place. We have 2
> Servers 2003 and my old company will be bringing over one Server with
> them along. In this case, the primary DC/DNS/DHCP. So I'll left with
> my second DC Server here in my new company. Is it possible to promote
> my this second Server to DNS and DHCP with all the AD accounts
> intacts? (Most people are staying with the new company)
As said before forget primary and secondary DCs. All DCs are the same differences
are the 5 FSMO roles that MUST exist in the forest/domain.
If you disconnect the DCs complete from another, you have to seize the FSMO
roles on the one without the roles, and you have to run metadata cleanup
on both now separated domains to remove the other DC from the AD database.
That way you have 2 doamins with the SAME SID and at that moment with all
existing domain accounts/computers, GPOs etc.
You should install the DNS server role BEFORE disconnecting them and also
use AD integrated zones(full writable). DHCP server role you can install
later and configuer it for your needs. Also make all DCs Global catalog server
BEFORE disconnecting.
----------------------------------------------------
IF YOU DO IT THIS WAY N E V E R RECONNECT the domains or use a workstation
on the other domain, even it will be listed in the Active directory users
and computers.
----------------------------------------------------
Personal recommend to NOT do it this way. You can do it and it will work,
BUT again NEVER reconnect them.
> 2nd option:
> If I were to purchase a new server to replace the primary DC. What are
> the
> things I need to do?
> - Can I use Server 2008 to run together with the old Secondary DC
> (Server
> 2003)?
Yes.
> - Should I promote my new server to Domain Controller first then
> demote the
> old primary DC? (What are the steps to demote?)
You MUST promote a new one before removing the last DC in a domain if you
like to keep the domain with all of its settings. See my next posting for
the detailed steps upgrading 2003 to 2008 domain.
> - Or can I just simplify disconnect the old primary DC from the
> network
> after I successfully promote my new server?
Nop, it must be removed correct with demoting from the AD database or youhave
to run metadata cleanup.
Dave Warren
<philw...@hotmail.com> was claimed to have wrote:
>There might be problem concering the missing DHCP,...how do you
>unauthorize/deactivate it when it is there no longer, I don't know.
If you're worried, unauthorize DHCP before you start.
That being said, it shouldn't be an issue, nothing stops you from having
two DHCP servers authorized at once so even if the old authorization
sticks around in some fashion, it shouldn't break anything.
behnazka...@gmail.com
i have problem with my domain
one of hard my primary domain is missing and i want change primary to secondary
how can i change it
please help mee