Rebuild a DC Server (2003)

Hi,
I'm considering rebuilding our DC Server over the summer (I will only have a 37 hour week tho).

a) Do you think it's possible in this timeframe and what is the best way of going about it without too much hassle? (RAID 5?)

b) I have another server of the same spec that runs our AV software which could be temporarily promoted but as there will be minimal staff in over the holidays, is this necessary? (No RAID)

c) A lot of apps which run over the network are installed on this server (it was set up this way already). Do you think it's better to have these on a different server?

d) and finally, does anyone know of a step-by-step guide on doing this as I'm bound to forget to back something up, and then remember just as I'm formatting it!! :doh:

Sorry for the amount of info I'm asking but not really confident I can pull this off in a week! :eek:

Why do you want to do this? If it ain't broke, don't fix it :-)

Do you have another DC? If not, then wiping this will lose your entire domain - you really don't want to do that so definitely promote the other server and move the FSMO roles to it.

If you can move the other apps then do so first - life's easier if the DC is just a DC - and if you get the other apps off (one at a time!) then you can test that they run OK from another server.

It doesn't take long to build a server - you can easily do one in a day - but it does depend on what else has to go on it.

I think the general consensus of opinion here is that you should have two DC's. Just one is normally seen as a high risk, if this goes down, you loose all ability to authenticate on the other servers until you are able to rebuild it (assuming the AD backups can be restored). For the simplicity of an easy rebuild, these DC’s normally have a minimum of 3rd party software installed. I would consider looking into getting an additional DC’s. Once you have a couple of these in place, then it should be fairly simple to demote the existing DC to simple becoming a member server.

Quote:

---

Originally Posted by srochford

Why do you want to do this? If it ain't broke, don't fix it :-)

Do you have another DC? If not, then wiping this will lose your entire domain - you really don't want to do that so definitely promote the other server and move the FSMO roles to it.

If you can move the other apps then do so first - life's easier if the DC is just a DC - and if you get the other apps off (one at a time!) then you can test that they run OK from another server.

It doesn't take long to build a server - you can easily do one in a day - but it does depend on what else has to go on it.

---

No we dont have another DC unfortunately.

The server it isn't totally broke but the thing is running very slow (prob due to all the apps installed on it) and some strange things are happening with it that I cannot seem to fix (like when you press copy, it sits there & thinks about it for at least a minute before it copies the file - even a shortcut for instance).

Off the top of my head, the things I would have to put back on (in no particular order):
a) active directory
b) dns/dhcp
c) data protector express (backup)
d) group policies
e) papercut
f) wsus
g) outlook
h) lanview
i) ghost
j) then all the apps or move them one by one to another server

So just a few things there!

As I've never had to rebuild an existing server - whats the best way to backup & restore the above important things such as a) b) c) d) f)?

Thanks :nerd:

Quote:

---

Originally Posted by tonyd

I think the general consensus of opinion here is that you should have two DC's. Just one is normally seen as a high risk, if this goes down, you loose all ability to authenticate on the other servers until you are able to rebuild it (assuming the AD backups can be restored). For the simplicity of an easy rebuild, these DC’s normally have a minimum of 3rd party software installed. I would consider looking into getting an additional DC’s. Once you have a couple of these in place, then it should be fairly simple to demote the existing DC to simple becoming a member server.

---

[gulp] this is sounding way beyond my capabilities now...(see previous reply) and as there is only me here if it goes wrong I'm stuffed!! :eek:

Quote:

---

Originally Posted by katem

[gulp] this is sounding way beyond my capabilities now...(see previous reply) and as there is only me here if it goes wrong I'm stuffed!! :eek:

---

Before you do anything, put Ghost on the other server and take a copy of the one you want to rebuild, just in case :)

c) data protector express (backup)
e) papercut
f) wsus
g) outlook
h) lanview
i) ghost
j) then all the apps or move them one by one to another server

Move all these services first and see how the server performs then! Might find it starts working alot better. Make sure you have a full backup of the server before you start moving things as it is your only DC!

This is my first post on this forum, figured I'd leap right in .... :D

I tend to agree with the p.o.v that if you have no reason to rebuild it, why risk it? If its running slow - have you checked that all disks in RAID 5 array are online and functioning properly. Have you checked event viewer for faults? Run performance monitor to detrmine if something is hogging resources.... etc.

Some guides for each point:

a) 37 hours is doable, just don't leave it till then to plan everything. Take screen dumps of specific application configs where applicable. Save them anywhere but on the server in question :). Also leave time to backup AND verify. Takes twice as long but worth it.

b) If you have a separate server, promote it to DC no harm in having a secondary DC anyway - guess it shouldn't matter at this stage about RAID5 on second DC especially if you've got good full backups.

c) Take most applications off the DC keep it for name resolution & DHCP (recommended for security and performance reasons) ... and if you move apps - remember to update workstations .... avoids the 'just-got-back-from-holiday-and-IT-broke-the-network' grumps

Planning is key, make sure you have:
1) An implementation plan - how you are going to do this
2) A contingency & backout plan - In the event of data loss or disaster .... know what your critical apps are and make sure you know how to sort them, if not - who to contact for support.
3) A communication plan - although nobody is expected to be there, just let everyone know that things will be offline to avoid too many system changes

Plan, plan and plan ....
:eek:

Quote:

---

Originally Posted by katem

[gulp] this is sounding way beyond my capabilities now...(see previous reply) and as there is only me here if it goes wrong I'm stuffed!! :eek:

---

Katem; I and I suspect a number of other Forum users find your first postings extremely useful. I have been in post now for close on 5 years; there is still a heck of a lot that comes as second nature to many here that is brand new to me.

I currently have a lone Win 2K DC that is not just DC but everything else as well. Recently we purchased a new Win 2003 server which is going to be my mission to promote to DC during the summer holidays. I was going to buy in help but the folks here convinced me that I should be able to crack the nut myself!

The help and feedback to my enumerate questions here has been fantastic and I know that should I get stuck then all I need to do is holler and someone will almost certainly have an answer to help me.

In preparing for the new server I have created a list that I'm happy to share - pm me if you want a copy.

Quote:

---

Originally Posted by speckytecky

In preparing for the new server I have created a list that I'm happy to share - pm me if you want a copy.

---

I shall be doing the same this holiday, am just about to order the server to do it on.

Any chance i could get a copy of that list also?

Thanks

If you've never built a DC from scratch before, I would suggest (if you've got time) trying it first in a virtual environment, means you can find out any gotchas first. You don't have to do the whole thing, but it gives you the chance to mess around with the important things like DHCP, DNS and practise restoring your Active Directory and group policies. That's what I would do anyway if I had the time of course!)

Mike.

Quote:

---

Originally Posted by Busybub

Before you do anything, put Ghost on the other server and take a copy of the one you want to rebuild, just in case :)

---

Now that's a good idea, thanks! It's just being in when no one else is to do it as I'm only here mornings 4 days a week. Would be the 1st thing to do in the hols tho I suppose.

Quote:

---

Originally Posted by RobFuller

c) data protector express (backup)
e) papercut
f) wsus
g) outlook
h) lanview
i) ghost
j) then all the apps or move them one by one to another server

Move all these services first and see how the server performs then! Might find it starts working alot better. Make sure you have a full backup of the server before you start moving things as it is your only DC!

---

This also is a good idea - the main server is trying to handle a lot of things at once whereas the other one is only handling Sophos. Thanks for that I'll try this first before going for a total rebuild ;)

Quote:

---

Originally Posted by DragynVee

This is my first post on this forum, figured I'd leap right in .... :D

I tend to agree with the p.o.v that if you have no reason to rebuild it, why risk it? If its running slow - have you checked that all disks in RAID 5 array are online and functioning properly. Have you checked event viewer for faults? Run performance monitor to detrmine if something is hogging resources.... etc.

Some guides for each point:

a) 37 hours is doable, just don't leave it till then to plan everything. Take screen dumps of specific application configs where applicable. Save them anywhere but on the server in question :). Also leave time to backup AND verify. Takes twice as long but worth it.

b) If you have a separate server, promote it to DC no harm in having a secondary DC anyway - guess it shouldn't matter at this stage about RAID5 on second DC especially if you've got good full backups.

c) Take most applications off the DC keep it for name resolution & DHCP (recommended for security and performance reasons) ... and if you move apps - remember to update workstations .... avoids the 'just-got-back-from-holiday-and-IT-broke-the-network' grumps

Planning is key, make sure you have:
1) An implementation plan - how you are going to do this
2) A contingency & backout plan - In the event of data loss or disaster .... know what your critical apps are and make sure you know how to sort them, if not - who to contact for support.
3) A communication plan - although nobody is expected to be there, just let everyone know that things will be offline to avoid too many system changes

Plan, plan and plan ....
:eek:

---

Wow thanks guys for all the great responses to this, seems I am not alone in this rebuild dilemna.

In response to your list:
b) I have now run dcpromo on the second server so I do have another DC. this seems to have worked and shows up on the main server as a DC.
c) going to do next
1-3) all these are essential things i must do!

Seems you guys know what you are doing!!

Quote:

---

Originally Posted by speckytecky

Katem; I and I suspect a number of other Forum users find your first postings extremely useful. I have been in post now for close on 5 years; there is still a heck of a lot that comes as second nature to many here that is brand new to me.

I currently have a lone Win 2K DC that is not just DC but everything else as well. Recently we purchased a new Win 2003 server which is going to be my mission to promote to DC during the summer holidays. I was going to buy in help but the folks here convinced me that I should be able to crack the nut myself!

The help and feedback to my enumerate questions here has been fantastic and I know that should I get stuck then all I need to do is holler and someone will almost certainly have an answer to help me.

In preparing for the new server I have created a list that I'm happy to share - pm me if you want a copy.

---

I think the thought of it all going pear shaped and not being able to sort it out is what bothers me but you are right, the guys & girls on here are fantastically helpful, and should anything go wrong I'm sure they'd have the answers :D

I will PM you for that list too - incase removing all the apps & all the rubbish off the main server doesn't work and I end up doing a complete rebuild after all!

Thanks :D

Quote:

---

Originally Posted by maniac

If you've never built a DC from scratch before, I would suggest (if you've got time) trying it first in a virtual environment, means you can find out any gotchas first. You don't have to do the whole thing, but it gives you the chance to mess around with the important things like DHCP, DNS and practise restoring your Active Directory and group policies. That's what I would do anyway if I had the time of course!)

Mike.

---

I've built up two server 2003 machines before from scratch but not had to rebuild, so didn't have the problem of transferring AD, DHCP etc. etc... with all the help from people here tho I think I've got it sorted now!
I'll bear in mind the virtual machine option though, good for testing stuff on too before its put into a live environment.:nerd:
Thanks Mike.

With the best will in the world, this forum is just that - a forum and the members - although they excel in what they do - are not sitting next to you when you do it, and won't be sitting next to you when you have to explain why your network no longer works. I say this with all the respect for everyone here.

I was surprised - although I admit, I only scanned quickly through the posts so may be wrong - that no one who suggested building up a second DC and transfering AD - no one also recommended you set the second DC as a Global Catalogue. If you don't do this, you will lose your domain.

There is a process to this, and I rebuild / replace and recover DC's quite often in the job I do - almost all the time, I will use a virtual server to transfer AD. This process is quite precise when you're working on a 'live' environment.

My single biggest advise is that if you are not 100% confident in what you are doing on a virtual environment, then please don't attempt it on a live network.

As many of the posts have said, rule out rougue software causing the issues. Maybe start with LanView - which shouldn't be installed on a DC anyway!

Look at the CPU usage and see which applications are taking most CPU / Disk and Network usage.

Which ever way you look at it though, the OS is 8 years old and i'm guessing the hardware not far behind it. Perhaps add a new server with 2003 (or 2008) if you have the finances, then you can add it as a second DC which gives you an easier ride transfering the AD - along with the original server as a backup!