Tag Archives: domainprep

Adding a Windows Server 2019/2016 Domain Controller

Posted on by
96

KB ID 0001262

Problem

Once upon a time, adding a domain controller that was running a newer version of the Windows Server family involved opening command line and schema prepping, and GP prepping etc. Now all this happens in the background when adding a 2019 domain controller and the wizard is doing the heavy lifting for you.

Solution

2008 to 2019 Domain Controller

2008 to 2016 Domain Controller

Obviously the server needs to be a domain member first!

  • For Server 2019 Forest and Domain Functional levels need to be at ‘Windows Server 2008‘. (The documentation says 2008 R2, but Server 2008 also works flawlessly).
  • For Server 2016 Forest and Domain Functional levels need to be at ‘Windows Server 2003‘.

Before You Start!

Remember if your ‘retiring’ domain controller is also a DNS/DHCP server you will also need to address that, and make sure you don’t have a service or device that queries the old domain controller directly (Radius Devices, Firewalls, RSA Appliances, Proxy Filters, Security door software, etc).

Procedure: Deploy a 2019 Domain Controller

With a vanilla install Server Manager will open every time you boot, (unless you’ve disabled it!) To open it manually, run ‘servermanager.exe’  > Manage > Add Roles and Features.

I usually tick the ‘Skip this page by default’ option > Next.

Role Based… > Next.

Ensure the local server is selected, (if you are managing another server, you can of course do the role install from here as well, but let’s keep things simple) > Next.

Select Active Directory Domain Services > Next.

Next.

Next.

Ensure ‘Restart’ is selected > Next.

Next.

Promote Windows Server To Domain Controller

Back in Server Manager > In the ‘Notifications’ section, click the warning triangle > ‘Promote This Server To Domain Controller’.

Assuming you already have a domain, and this is not a greenfield Install > Add a domain controller to an existing domain > Next.

Type and confirm a Directory Services Restore Mode Password (DSRM,) make it something you will remember in a crisis, or store it securely somewhere > Next.

This is fine, You see this error because it’s trying to create a delegation for this DNS zone, and there isn’t a Windows server above you in the DNS hierarchy. For example if your domain name is petelnetlive.co.uk > Then I do not have access to create a delegation in the .co domain space. (So you can safely ignore) > Next

If you have a backup of AD you can ‘Install From Media’. This used to be handy on remote sites that had awful bandwidth, as it saved you having to replicate a large Active Directly over a ‘pants’ connection > I’ve not had to do that in a long time > Next.

Unless you want to change the default AD install locations > Next.

Next.

Read any warnings  > Install

Go have a coffee, we ticked ‘reboot’ earlier so it will complete, then reboot the server, which will come back up as a domain controller.

You will notice, (if you’re interested,) that your schema version is now 88 (Server 2019), or 87 (Server 2016).

 

Find out your Domain Schema Version

Related Articles, References, Credits, or External Links

NA

Add a 2012 Domain Controller to a 2008 Domain

Posted on by

KB ID 0000680 

Problem

This is considerably less painfull than adding a 2008/2008 R2 domain controller to a 2003 domain was. You dont have to maually prep the schema on the schema master, or run forestprep and domainprep. The wizard does everything for you.

Solution

1. Launch server manager from the taskbar > Select Local Server > Manage > Add Roles and Features.

2. Role Based… > Next.

3. Select local server > Next.

4. Tick ‘Active Directory Domain Service’ > Next.

5. Accept the defaults > Next.

6. Next.

7. Install.

8. Installation may take a while.

9. When finished nothing appears to change, but it does say “Suceeded” > Close.

10. Now the role is on the server you just need to promote it, you can do this by selecting AD DS in the left hand menu > and click ‘More’.

11. ‘Promote the server to a domain controller’

12. By default it will fill in the domain you are already a member of > Next

13. Enter your directory servies restore mode password (DON’T ever lose this password!) > Next.

14. I dont want anyone outside my domain browsing my domain so I don’t care about the delegation error > Next.

15. If you want to reboot as soon at it’s finished tick the box, and (optionally) select a Dc to replicate from > Next.

16. Accept or change the paths as required > Next.

17. Heres a nice touch, now it preps the forest, schema, and domain for you > Next.

18. Next.

19. Install (I’d suggest a reboot when its done).

Related Articles, References, Credits, or External Links

NA

Deploying a Windows Server 2008 Domain Controller in a Windows 2003 Domain

Posted on by

KB ID 0000239

Problem

Before you can add a Windows Server 2008 Domain Controller to a Windows Server 2003 Domain you need to carry out some preparation, this can be done during working hours, as the process only has a slight performance hit no one will notice there is work going on.

Solution

Before you start, have a good look round your existing domain controllers, get the latest service packs and updates installed. Have a good look through the event logs on the domain controllers, and make sure you domain is happy and replicating, before introducing 2008.

1. First locate the server that holds the FSMO role “schema master”

Locate your FSMO Servers

netdom query /domain:YOURDOMAINNAME fsmo

Note: this is a test network, so all my roles are on the same server – yours will probably be spread out more efficiently.

Prepare the Forest for 2008

2. Go to the schema master server and put in the Server 2008 Install DVD (if it does not have a DVD drive then share then copy the contents of the “support” folder to the schema master).

3. Change to the directory that contains adprep, and issue an “adprep /forestprep” command. (or adrep32 /forestprep on an x32 bit server see below).

4. Read the warning! Make sure your domain controllers comply. Press C {enter} to continue.

Adprep32/ forestprep

5. It will run for a few minutes (Coffee!). When it’s finished it should say that it was successful.

Prepare the Domain for 2008

1. You need to locate the FSMO server that’s holding your Infrastructure Master Role. CLICK HERE.

2. Go to the Infrastructure master server and put in the Server 2008 Install DVD (if it does not have a DVD drive then share then copy the contents of the “support” folder to the schema master).

3. Change to the directory that contains adprep, and issue an “adprep /domainprep” command. (or adrep32 /domainprep on an x32 bit server see below).

Adprep32 /domainprep

Note: This will fail if the domain is not in “Native Mode”

Note: You may also want to run “adprep /domainprep /gpprep” when the above had completed successfully.

Prepare the environment for a 2008 RODC (Read Only Domain Controller)

1. Only really a problem if you want to deploy an RODC. You need to locate the FSMO server that’s holding your Infrastructure Master Role. CLICK HERE.

2. Go to the Infrastructure Master server and put in the Server 2008 Install DVD (if it does not have a DVD drive then share then copy the contents of the “support” folder to the schema master).

3. Change to the directory that contains adprep, and issue an “adprep /rodc” command. (or adrep32 /domainprep on an x32 bit server).

4. Skip to this step.

If you DONT Prepare for Server 2008 you will see the following errors

Seen when adding a 2008 domain controller to a domain with an earlier schema/domain version.

Error 1: To install a domain controller into this Active Directory forest you must first prepare the forest using “adprep /forestprep”. The Adprep utility is available on the Windows Server 2008 R2 installation media in the supportadprep folder.

Error 2: To install a domain controller into this Active Directory domain, you must first prepare the domain using “adprep /domainprep”. The Adprep utility is available on the Windows Server 2008 R2 installation media in the supportadprep folder.

Error 3: You will not be able to install a read-only domain controller in this domain because the “adprep /rodcprep” was not yet run.

Install the New Windows Server 2008 Domain Controller

I’m assuming you have a new server built with Windows Server 2008 / 2008 R2 installed on it, and that you have applied all the necessary service packs and updates to it. It should also be joined to the domain (as a member server) and preferably have a static IP address.

1. Whilst logged on with administrative access > Start > In the Search/Run > type dcpromo {enter}

2. Next.

3. Read the warnings > Next.

4. We are adding a new DC in an existing domain > Next.

5. Confirm the domain name is correct > Next.

6. Check again > Next.

7. If your domain has multiple sites > Then select the site that this DC will be deployed into > Next.

8. The first 2008 Domain controller, should be a global catalog server, and the promotion will install and configure DNS as well > Next.

9. If you have a flat single domain with AD integrated DNS zones this is OK > Simply click Yes > Next.

10. Accept the defaults, (unless you want to host these in a different location) > Next.

11. Enter a recovery mode password. NEVER FORGET, or lose this password, you will need it, if you ever need to restore active directory by booting to directory restore mode.

12. Review the settings > Next.

13. Active directory will install, you can tick the box to reboot when finished if that,s OK (It will need a reboot anyway).

14. When completed simply click finish.

15. If you did not select reboot above then you will be asked to do so now.

 

Related Articles, References, Credits, or External Links

NA