Forum Search:
Forum.Brain-Cluster.com: Brain Cluster Technical Forum
Ultimate forum for Technical Discussions

Home » Microsoft » Windows Server » Active Directory » how to add secondary DC to network ?
how to add secondary DC to network ? [message #371502] Tue, 19 January 2010 02:46 Go to next message
Scott  is currently offline Scott  United Kingdom
Messages: 265
Registered: September 2009
Senior Member
Morning,

Looking for some advice regarding how toadd a secondary domain controller
and which server to promote.

My network consists of :

(1) 2003 AD domain controller / file server
(2) 2008 server / exchange 2007
(3) 2003 sever / sql 2005
(4) 2003 server / terminal services
(5) 2003 server / terminal services

I understand using an exchange server (and in particular installing the
global catalog) as an AD box is frowned upon, therefore rulling out (2).
Installing on a terminal services box is not possible i believe therefore
rulling out (4) and (5). So thinking about it my only option is (3) !

1) I guess all i need is a plan to promote it. Can someone please advise how
to promote this box ? (i.e install which services ?, how to use dcpromo ?)
and how/which roles i should be hosting on the second box to cover my
network if server (1) was lost altogether ?

2) On a secondary point, I would eventually like to upgrade (1) and (3) to
2008.

In theory could I:
- if (3) was a backup DC
- seize the roles
- remove (1) from the network somehow (i.e demote DC and then remote from
domain ?)
- format and install 2008 on (1)
- promote (1) to DC
- sezie role on (1)
- down (3)
- install 2008 on (3)
- install AD on (3)

Thanks for any advice
Scott
Re: how to add secondary DC to network ? [message #371513 is a reply to message #371502] Tue, 19 January 2010 03:09 Go to previous messageGo to next message
meiweb  is currently offline meiweb  Germany
Messages: 2225
Registered: September 2009
Senior Member
Hello Scott,

NONE of them, Exchange or SQL shouldn't run on DC, performance and security
reasons. Even if it might be possible to promote one of them to DC, you will
run into trouble to get Exchange/SQL running after promotion.

Use a NEW server as second DC/DNS/GC to install Windows server 2008. Also,
even if inplace upgrades are supported, i am against it because Windows server
2008 has complete different OS architecture then Windows server 2003.

You should start with a fresh installed Windows server 2008, upgrade the
schema and promote this one to DC, make it DNS server and Global catalog,
move all 5 FSMO roles to it, then reconfigure all domain machines to use
it as preferred DNS.

So, start with a second new Windows server 2008 machine as DC/DNS/GC/FSMO
and copy all files to it. Then demote the existing DC and remove it from
the domain, format and reinstall with with Windows server 2008 and promote
it to DC/DNS/GC, now 2 DCs exist one as file server.

For the SQL server 2005 check in the SQL newsgroup if OS upgrade to Windows
server 2008 is supported and how to do it.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Morning,
>
> Looking for some advice regarding how toadd a secondary domain
> controller and which server to promote.
>
> My network consists of :
>
> (1) 2003 AD domain controller / file server
> (2) 2008 server / exchange 2007
> (3) 2003 sever / sql 2005
> (4) 2003 server / terminal services
> (5) 2003 server / terminal services
> I understand using an exchange server (and in particular installing
> the global catalog) as an AD box is frowned upon, therefore rulling
> out (2). Installing on a terminal services box is not possible i
> believe therefore rulling out (4) and (5). So thinking about it my
> only option is (3) !
>
> 1) I guess all i need is a plan to promote it. Can someone please
> advise how to promote this box ? (i.e install which services ?, how
> to use dcpromo ?) and how/which roles i should be hosting on the
> second box to cover my network if server (1) was lost altogether ?
>
> 2) On a secondary point, I would eventually like to upgrade (1) and
> (3) to 2008.
>
> In theory could I:
> - if (3) was a backup DC
> - seize the roles
> - remove (1) from the network somehow (i.e demote DC and then remote
> from
> domain ?)
> - format and install 2008 on (1)
> - promote (1) to DC
> - sezie role on (1)
> - down (3)
> - install 2008 on (3)
> - install AD on (3)
> Thanks for any advice
> Scott
Re: how to add secondary DC to network ? [message #371533 is a reply to message #371513] Tue, 19 January 2010 04:07 Go to previous messageGo to next message
Scott  is currently offline Scott  United Kingdom
Messages: 265
Registered: September 2009
Senior Member
Thank you for the reply Meinolf. Great info there , thats exactly what i was
looking for.

Best regards
Scott
Re: how to add secondary DC to network ? [message #371539 is a reply to message #371533] Tue, 19 January 2010 04:23 Go to previous messageGo to next message
meiweb  is currently offline meiweb  Germany
Messages: 2225
Registered: September 2009
Senior Member
Hello Scott,

Just for the new DC see this small how to:
!!!NEVER START BEFORE HAVING CREATED AND TESTED A BACKUP OF YOUR DATA/MACHINE!!!

- On the old server open DNS management console and check that you are running
Active directory integrated zone (easier for replication, if you have more
then one DNS server)

- run replmon from the run line or repadmin /showrepl(only if more then one
DC exist), dcdiag and netdiag from the command prompt on the old machine
to check for errors, if you have some post the complete output from the command
here or solve them first. For this tools you have to install the support\tools\suptools.msi
from the 2003 installation disk.

- run adprep /forestprep and adprep /domainprep and adprep /rodcprep from
the 2008 installation disk against the 2003 schema master(forestprep) / infrastructure
master(domainprep/rodcprep), with an account that is member of the Schema/Enterprise/Domain
admins, to upgrade the schema to the new version (44) or 2008 R2 (47)

- you can check the schema version with "schupgr" or "dsquery * cn=schema,cn=configuration,dc=domainname,dc=local
-scope base -attr objectVersion" without the quotes in a command prompt

- Install the new machine as a member server in your existing domain

- configure a fixed ip and set the preferred DNS server to the old DNS server
only, think about disabling IPv6 if you are not using it, some known problems
exist with it. Follow ( http://blogs.dirteam.com/blogs/paulbergson/archive/2009/03/1 9/disabling-ipv6-on-windows-2008.aspx)
to disable it

- run dcpromo and follow the wizard to add the 2008 server to an existing
domain, make it also Global catalog and DNS server.

- for DNS give the server time for replication, at least 15 minutes. Because
you use Active directory integrated zones it will automatically replicate
the zones to the new server. Open DNS management console to check that they
appear

- if the new machine is domain controller and DNS server run again replmon,
dcdiag and netdiag (copy the netdiag from the 2003 to 2008, will work) on
both domain controllers

- Transfer, NOT seize the 5 FSMO roles to the new Domain controller (http://support.microsoft.com/kb/324801
applies also for 2008), FSMO should always be on the newest OS DC

- after transfer of the PDCEmulator role, configure the NEW PDCEmulator to
an external timesource and reconfigure the old PDCEmulator to use the domainhierarchie
now. Therefore run on the NEW "w32tm /config /manualpeerlist:PEERS /syncfromflags:manual
/reliable:yes /update" where PEERS will be filled with the ip address or
server(time.windows.com) and on the OLD one run "w32tm /config /syncfromflags:domhier
/reliable:no /update" and stop/start the time service on the old one. All
commands run in an elevated command prompt without the quotes.

- you can see in the event viewer (Directory service) that the roles are
transferred, also give it some time

- reconfigure the DNS configuration on your NIC of the 2008 server, preferred
DNS itself, secondary the old one

- if you use DHCP do not forget to reconfigure the scope settings to point
to the new installed DNS server

- if needed export and import of DHCP database for 2008 choose "netshell
dhcp backup" and "netshell dhcp restore" command (http://technet.microsoft.com/en-us/library/cc772372.aspx)



Demoting the old DC

- reconfigure your clients/servers that they not longer point to the old
DC/DNS server on the NIC

- to be sure that everything runs fine, disconnect the old DC from the network
and check with clients and servers the connectivity, logon and also with
one client a restart to see that everything is ok

- then run dcpromo to demote the old DC, if it works fine the machine will
move from the DC's OU to the computers container, where you can delete it
by hand. Can be that you got an error during demoting at the beginning, then
uncheck the Global catalog on that DC and try again

- check the DNS management console, that all entries from the machine are
disappeared or delete them by hand if the machine is off the network for ever

- also you have to start AD sites and services and delete the old servername
under the site, this will not be done during demotion

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Thank you for the reply Meinolf. Great info there , thats exactly what
> i was looking for.
>
> Best regards
> Scott
Re: how to add secondary DC to network ? [message #371684 is a reply to message #371533] Tue, 19 January 2010 07:48 Go to previous messageGo to next message
Phillip Windell  is currently offline Phillip Windell  United States
Messages: 526
Registered: July 2009
Senior Member
The 2008 box has Hyper-V. Run the second DC in a Virtual Machine. However
do not make it the GC. Exchange needs the GC and since it is impossible to
have this DC running before Exchange is runnning you don't want Exchange
depending on that DC for anything.

But the best choice is dedicated hardware for both DCs and run nothing on
them but DNS, DHCP, and WINS.

You also need to get the File Shares off the DC. The SQL Box is much more
suited as a File Server (never a DC,...no File Sharing from DCs).

Terminal Services look fine,...each a dedicated box,...that's good.


--
Phillip Windell

The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------


"Scott" <nospam123@yahoo.co.uk> wrote in message
news:%23SMiadPmKHA.5020@TK2MSFTNGP02.phx.gbl...
> Thank you for the reply Meinolf. Great info there , thats exactly what i
> was looking for.
>
> Best regards
> Scott
>
>
Re: how to add secondary DC to network ? [message #371812 is a reply to message #371502] Tue, 19 January 2010 10:25 Go to previous message
Jorge Silva  is currently offline Jorge Silva
Messages: 398
Registered: July 2009
Senior Member
Hi
Have a look at
http://eniackb.blogspot.com/2009/02/how-to-create-second-dom ain-controller.html
http://eniackb.blogspot.com/2009/02/how-to-add-second-domain -controller-in.html


--

I hope that the information above helps you.
Have a Nice day.

Jorge Silva
MVP Directory Services

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.




"Scott" <nospam123@yahoo.co.uk> wrote in message
news:#rebLwOmKHA.2188@TK2MSFTNGP04.phx.gbl...
> Morning,
>
> Looking for some advice regarding how toadd a secondary domain controller
> and which server to promote.
>
> My network consists of :
>
> (1) 2003 AD domain controller / file server
> (2) 2008 server / exchange 2007
> (3) 2003 sever / sql 2005
> (4) 2003 server / terminal services
> (5) 2003 server / terminal services
>
> I understand using an exchange server (and in particular installing the
> global catalog) as an AD box is frowned upon, therefore rulling out (2).
> Installing on a terminal services box is not possible i believe therefore
> rulling out (4) and (5). So thinking about it my only option is (3) !
>
> 1) I guess all i need is a plan to promote it. Can someone please advise
> how to promote this box ? (i.e install which services ?, how to use
> dcpromo ?) and how/which roles i should be hosting on the second box to
> cover my network if server (1) was lost altogether ?
>
> 2) On a secondary point, I would eventually like to upgrade (1) and (3) to
> 2008.
>
> In theory could I:
> - if (3) was a backup DC
> - seize the roles
> - remove (1) from the network somehow (i.e demote DC and then remote from
> domain ?)
> - format and install 2008 on (1)
> - promote (1) to DC
> - sezie role on (1)
> - down (3)
> - install 2008 on (3)
> - install AD on (3)
>
> Thanks for any advice
> Scott
>
>
Previous Topic:Security of a virtualized domain controller ?
Next Topic:DC Login
Goto Forum:
  


Current Time: Thu Jan 18 20:44:10 MST 2018

Total time taken to generate the page: 0.03818 seconds
.:: Contact :: Home ::Sitemap::.

Powered by: FUDforum 3.0.0RC2.
Copyright ©2001-2009 FUDforum Bulletin Board Software