Upgrading a Windows 2003 Domain to Windows 2012R2

So as the life of Windows 2003 is finally coming to an end, I am seeing a big push for domain upgrades and the pitfalls that come with it. So I created a walkthrough to help that process go smoother and to help avoid the common issues. I included DHCP in this posting due to the many servers I see that are Domain Controllers and DHCP servers. If you are getting DHCP from another device like another server or router, the steps outlined are still applicable as far as changing the DNS server to point to the new DC before you decommission the old DC.


My environment at the start of the migration:
DC01.matrix.local

OS: Windows 2003 x86 SP1
IP: 192.168.90.1
Subnet: 255.255.255.0
GW: None – completely isolated environment
DNS: 192.168.90.1
Services for clients – DHCP, DNS, Active Directory
DHCP looks like:

Note: Excluded the range 192.168.90.1 – 192.168.90.50 as this is how I would normally deploy DHCP – Statically needed IP Addresses would be within the range that was excluded. Examples would be Routers, Servers and Printers.

    DNS zones look like this:

Really everything at this point is default with the exception that I added the reverse zone. Matrix.local and the reverse zone replicated to all DNS servers in domain and the _msdcs zone is replicated to all dns servers in forest.

Client01.matrix.local

OS: Windows 8.1 (I selected this one as client machines tend to get the new stuff especially now with the BYOD or Bring Your Own Device movement)
IP: Dynamically assigned by DC01
Subnet: Dynamically assigned by DC01
GW: None – completely Isolated environment
Client01 is joined to the domain and is able to authenticate, access dns, and gets an IP – the user that is authenticated is Mr. Testy Tester or Matrix\TTester

DC02.matrix.local

OS: Windows 2012R2
IP: Dynamically assigned by DC01
Subnet: Dynamically assigned by DC01
GW: None – completely isolated environment
DNS: 192.168.90.1


Okay, let’s review some configuration items to get us started.
Active Directory:
It’s always best to review the health of active directory to make sure there is no gotchas to sneak up on you. If not installed and you have the install cd for 2003 install the support tools from CD:\Support\Tools\SUPTools.msi or downloaded from http://www.microsoft.com/en-us/download/details.aspx?id=15326.

  1. From a command prompt run netdom query fsmo as below:

    This lets you know where the fsmo’s are located – If any of these has an error where it is unable to locate the role holder, stop because you will need to probably need to seize the role and perform a metadata cleanup.
    Seize FSMO Role – http://support.microsoft.com/kb/255504/en-us
  2. Run is a “net share”

    These two shares are where your group policies are stored and if they are missing your DC will not act as a domain controller and will not authenticate users.
  3. Run a repadmin /showreps – if you currently only have 1 dc I would expect the output to look like:
  4. Check the Eventlogs for errors relating to Active Directory, File Replication Service, Netlogon, Time
    1. Directory Service
    2. System
    3. File Replication Service

If everything appears normal then we are ready to introduce our 2012 R2 server into the environment. If there are errors stop now and investigate!


Setup the new 2012 R2 Server

  1. Statically set the IP Address of the server
    My IP Address will be 192.168.90.2 / Subnet will be 255.255.255.0 / No Gateway/ DNS 192.168.90.1

    Note:
    I don’t have a gateway because my test environment does not have internet access, your environment likely does so you will likely have a gateway.
  2. Rename the server and join the domain with your 2012R2 server
  3. Once you click OK, you will be prompted for credentials – put the credentials of your domain admin account in and press ok.
    If you get a message like:

    Once the server reboots, sign in as the domain admin account
    Note: If you are using the default Administrator account, sign into Windows with Domain\Administrator as Windows by default will change the domain to local when it detects a local account with the same name.
  4. Once Server Manager comes up, Click Manage, Add Roles and Features
  5. The Add Roles and Features Wizard will come up – Click Next
  6. Make sure Role-based or feature-based installation is selected and click next.
  7. Verify your sever is the selected server then click next
  8. Select Active Directory Domain Services, on the popup click Add Features, then Click next
  9. Click next on the features page
  10. Click Next on the AD DS page
  11. Then Click Install

Promote Server to a Domain Controller

  1. Once that completes Click Close, You will be back on the Server Manager Screen – Click the Flag on the Top Menu and select the link to promote the server to a domain controller
  2. This will start the process to make this a domain controller

    Make sure the Domain information, Add a domain controller to an existing domain, and the current domain administrator is correct.
  3. This would be a good time to make sure that the user doing the promotion is a member of the Enterprise Admins and Schema Admins group on the 2003 domain controller.

    Being a member of these 2 groups will allow you to promote the DC into the domain and perform the necessary schema updates needed for 2012 R2.
  4. Clicking next on the Active Directory Domain Services Configuration Wizard I received an error

    Fixing this issue is fairly simple, we just need to raise the Domain and Forest Functional to 2003
  5. Open Domains and Trusts on the 2003 DC
    Right click on the Active Directory Domains and Trusts, Select Raise Forest Functional Level
    If you get a message like:

    You will need to do the domain functional level first.
  6. Open Active Directory Users and Computers
    Right click on the domain in the left pain and select Raise Domain Functional Level

    Select Windows Server 2003 from the dropdown and click Raise
  7. Once that completes, and if you have more than one domain controller, replication completes. Go back to Domains and Trusts
    Right click and raise Forest Functional Level

    Again if there are more than one domain controller it may take a minute to replicate, if not than this change is really quick.
  8. We are now ready to try the promotion process again, Click Next on the deployment configuration

    Note: We get a warning stating that there are no 2008 domain controllers in the domain so this server will be unable to become a read-only domain controller. This is just a warning and nothing to be concerned about.
  9. Type in the Directory Services Restore Mode password and click next
  10. Under DNS option there is another warning about DNS delegation, ignore that and click next
  11. Additional Options: Click Next
  12. Under Paths, Modify any paths or accept the defaults and click Next
  13. Under Preparation Options click Next
  14. Under Review Options, Click Next
  15. After the Prerequisite Check Runs Click Install
  16. After install is clicked the forest and domain will be prepped for 2012. Once the install is completed and the server reboots and will then come up as a domain controller in your domain.

Verify Active Directory on the New Server

  1. One of the first things to validate is that the Netlogon and Sysvol shares
    Run net share from PowerShell
  2. Run repadmin /showreps – notice we get a lot more information this time
  3. Lets also check that on the 2003 server
  4. Lets check DNS on the new 2012R2 server

    What you want to look at here is to make sure that both DC’s have SRV records inside dns. SRV records is how clients locate available DC’s in which to use for authentication. You can also validate that the same records appear on the 2003 server.
  5. Check the event logs
  6. Open Active Directory Users and computers, create a test user validate that it replicates from 2012 to 2003, then rinse and repeat from 2003 to 2012
  7. Open Group Policy Management console and validate all group policies that are expected to be there are there

Decommission 2003 Server

  1. Transfer the FSMO roles to new server
    1. PDC – http://technet.microsoft.com/en-us/library/cc739670(v=WS.10).aspx
    2. RID – http://technet.microsoft.com/en-us/library/cc781063(v=ws.10).aspx
    3. Infrastructure –    http://technet.microsoft.com/en-us/library/cc782485(v=ws.10).aspx
    4. Domain Naming Master – http://technet.microsoft.com/en-us/library/cc738685(v=ws.10).aspx
    5. Schema – http://technet.microsoft.com/en-us/library/cc759254(v=ws.10).aspx
  2. Transfer DHCP services to the new server
    1. Install the feature on the 2012R2 server
    2. In Server Manager, Click Manage, Add Roles and Features
    3. Role-based or Feature-based – Click Next
    4. Validate 2012 is selected Click Next
    5. Select DHCP from the list, Click Add features from the Pop-up, Click next
    6. Click Next
    7. Click Next
    8. Click Install
  3. Configure the scope for DHCP (I deliberately broke this up into three distinct steps, Setting up DHCP on the new server, deactivating the old server and Activating the new server – this is to allow the cutover to be planned according to a migration schedule. In an actual migration I would lower the lease times to something really short 2 days to allow clients to renew their leases from the new server without administrative intervention)
    1. Click Complete DHCP configuration
    2. Click Next
    3. Select Skip AD Authorization (We already have an Authorized DHCP server)
    4. Select Commit
    5. Select Tools, DHCP
    6. In DHCP MMC, Drill down to IPv4, Right Click and select New Scope
    7. Under New Scope Wizard select Next
    8. Name your new Scope and click Next
    9. Set your Range up and Click Next
    10. Set up your Exclusion Range
    11. Setup your Lease Duration Time
    12. Select Yes to configure the scope Options, Select Next
    13. Set your gateway address
    14. On Domain Name and DNS Servers, Remove any old DNS servers so that only the new 2012 Server is listed
    15. Leave Wins Blank, Click Next
    16. On Activate Scope, Select No, I will activate this scope later, Then Select Next
    17. Click Finish
  4. Deactivate the 2003 DHCP Server
    1. Right Click the Scope and Select Deactivate – I am deactivating the scope – in case the server is reathorized later – the server will not automatically start handing out IP’s
    2. Right Click the Server and Unauthorize
  5. Turn on DHCP on the new 2012R2 Server
    1. In the DHCP MMC, Right Click the Server Name and select Authorize
    2. Right Click the Scope and Select Activate
    3. DHCP Console should appear similiarly to:
  6. Validate clients receive DHCP Address from the new server
    1. Check current settings, notice that the lease from the old server is still good so this client has not yet requested a renewal on the lease, this is important because the DNS server for the client has changed – if we were to demote the 2003 server at this time the clients would have issues resolving and authenticating
    2. On the client run IPConfig /Release
    3. On the Client run IPconfig /renew
    4. Then Validate that the 2012 R2 server handed the clients IP Address
  7. Once all FSMO’s, DHCP to all clients have been updated shut down the old server for a few days to make sure nothing was missed and that clients are able to authenticate to Active Directory, Get to the internet, etc
  8. Last step is to demote the 2003 server
    1. Run DCPromo on 2003, Click Next
    2. Do not select this is the last domain controller in the domain, Click Next
    3. Type a new Local Administrator Password, Click Next
    4. Click Next on the Summary Screen
    5. Active Directory will then be removed, and the server will be rebooted
Advertisements
Posted in Active Directory, How To, Migrating, Setup, Windows 2012 R2
12 comments on “Upgrading a Windows 2003 Domain to Windows 2012R2
  1. Ron Long says:

    I wanted to drop you a note and say THANK YOU for this step-by-step article. It was a life saver! Moved a 12 year old Windows 2003 domain controller to Windows 2012 R2. You made it a piece of cake for me.

  2. denoel says:

    Thank you for your brilliant post

  3. Irfan Hussain says:

    Thank You for the clear and simple step by step article… With regards to MS Exchange Server 2007 what Service pack maximum it has to be upgraded to work with Windows 2012 R2 domain controller. Many Thanks in advance for your support and guidance .

  4. Jonathan G says:

    Awesome step-by-step. Thank you for the clear documentation. Your effort enabled me to get through this migration without a hitch!

  5. just added new a new DC running on 2012 R2 in 2003 network and transferred all the FSMO roles. Used another site to transfer the DHCP. your setbystep manual was very helpful. Many thanks

  6. Kendall says:

    Many thanks to you..The step by step was perfect and migration was seamless

  7. coollok says:

    Great post, without this I won’t be able to migrate from 2003 to 2012.

  8. Carric says:

    Great article , I did notice when I ran DCdiag on the 2003 DC I was getting a KCCEvent error , This was caused by a Samsung printer driver, Once I removed the driver from the DC I reran the DCdiag and got the all clear.

  9. H says:

    Great stuff, What time frame would you give in terms of scoping a project of this size of AD upgrade from 2k3 to 2012 for a medium organisation (1 domain, 9 sites with DC at each and to at head office all on 2k3 with exchange and number of apps). This is from planning this in from start to finish that is doing discovery of you environment\apps\service etc, testing any apps and doing a full assessment and then the actual deployment and phase out of old DC’s. How long would you give you self as a time scale?

    • Brad Held says:

      Hi H,
      So depending on the discovery, the entire project could take anywhere from a couple months to a year. A lot of it depends on the discovery of course and how the organization handles change.

      In the discovery section remember of course that DNS and DHCP needs to be addressed but also remember file shares and other services that may need to addressed.

      Applications will definitely need to be reviewed for compatibility and if customer built address any interactions to servers that may be changing and of course Active Directory.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: