A few basic questions about replacing 2003 DC with 2008R2 DC

[edutech4schools]

Hi all,

 

My primary school currently have a single 2003 server and I am going to replace this next week with a new server and 2008R2.

 

I am planning on using the old server as a DC backup server.

 

Q1. is this the best use for my old 2003 server? or should I just leave the school as a single server setup which seems common in primary schools.

 

Q2. Does the old server need 200R2 installed to be a backup server? or can I leave 2003 on?

 

Cheers.

[sukh]

Hi

 

1. If you have a spare server and there's no other use for it. I would use this a a backup DC, provide HA/FT.

 

2. You can leave the server as Windows 2003 but I would recommend you rebuild to W2K8R2. As windows 2003 will be retired soon and to use new features of W2k8R2, you need to get rid of Windows 2003 DC and raise Fores/Domain func.

 

Sukh

Edited April 26, 2011 by sukh

[edutech4schools]

Thanks sukh. Good to know I am on the right track. What is HA/FT?

[sukh]

High Availability/Fault Tolerence.

 

Sukh

[TechSupp]

Did this at two schools (well the engineer did), the old 2003 server became the nackup domain server and ran the printers and the new server 2008 took over everything else (except wsus as I didnt want to shift that as its working fine, as usual dont fix what aint broke!).

[Michael]

I would probably install a single 2008 R2 Server and have the 2003 Server as a member server. This can be used for less critical applications such as WSUS or your AV software. All roles would then be transferred to your new 2008 R2 Server. The only thing you need to bear in mind is 2008 R2 is 64Bit only, so if you have any server specific applications they may or may not run.

 

2003 and 2003 R2 are supported until 2015, but they're now in Extended Support. In English this means Microsoft will only create security updates and no new features.

 

To be honest I think for most servers I support, I'll make the jump directly to Windows Server 2012

[elsiegee40]

I would probably install a single 2008 R2 Server and have the 2003 Server as a member server. This can be used for less critical applications such as WSUS or your AV software. All roles would then be transferred to your new 2008 R2 Server. The only thing you need to bear in mind is 2008 R2 is 64Bit only, so if you have any server specific applications they may or may not run.

 

This is exactly what we did. We had a single Server 2003 R2 server and now have have a server at 2008 R2 with the old server as a member running WSUS, anti-virus, and print manager plus.

[sukh]

@Michael - I suppose the disadvantage would be that if the main DC goes down, then all your users (staff, admin and students) will be impacted serverly and wont be able to work. Moving all the roles to a single server is a single point of failure. Depending on what the server does in addition to being a DC (DNS/DHCP/WINS) I do see this as an oppportunity to make services highly available and minimise downtime.

 

Most applications will still work on a 64bit server it still has a 32bit hive. More issues are around drivers/hardware.

 

Sukh

[edutech4schools]

So basically the debate is between installing 2008R2 on the old server and using as a backup DC or leaving 2003 on and using as a member server.

 

Currently leaning towards backup dc but old hp printers might be a problem. hmmmm I'll have a think. Thanks for all your advice so far.

[sukh]

No reason why you can have WSUS or your AV on your DC as well.

[Michael]

@Michael - I suppose the disadvantage would be that if the main DC goes down, then all your users (staff, admin and students) will be impacted serverly and wont be able to work. Moving all the roles to a single server is a single point of failure. Depending on what the server does in addition to being a DC (DNS/DHCP/WINS) I do see this as an oppportunity to make services highly available and minimise downtime.

 

Most applications will still work on a 64bit server it still has a 32bit hive. More issues are around drivers/hardware.

 

Sukh

 

If you have just one DC and all user files, shares and profiles are also stored on this server, it'll make no difference at all having a second DC. It'll just mean users can logon and access nothing.

Every server I setup has RAID1 on the system drive, so the probability of everything going down is minimised. The only downtime is swapping the faulty drive, then either the RAID re-builds itself or you can restore a backup from File which is fairly quick generally speaking.

[sukh]

If you have just one DC and all user files, shares and profiles are also stored on this server, it'll make no difference at all having a second DC. It'll just mean users can logon and access nothing.

Every server I setup has RAID1 on the system drive, so the probability of everything going down is minimised. The only downtime is swapping the faulty drive, then either the RAID re-builds itself or you can restore a backup from File which is fairly quick generally speaking.

 

IF there is only one server as stated in the post which peforms the role of a DC in addition to holding the files, then users wont be able to access files. Edutechforschools will only know. can However they can at least access the internet/intranet. Even so, why not have the files/shares replicate to the second DC and provide more availabilty instead of seperating the DC/shares on each server.

 

 

Even if your have RAID setup, this only protects you from hardware failure. This doesn't cover protection at the application layer. Where as having multiple server DC's (and other roles such as DNS/WINS/DHCP) offer this. This way you're covered at the hardware level and application level. This doesn't mean you shouldn't have RAID.

 

Also, if it is a single server then need to ensure that it FT all around, i.e network cards, teamming, CPU's, RAM etc..

 

This is why I recommend having two DC's, this way your core infrastructure is HA.

 

Sukh

[edutech4schools]

If you have just one DC and all user files, shares and profiles are also stored on this server, it'll make no difference at all having a second DC. It'll just mean users can logon and access nothing.

 

I think I am more worried about AD corruption and that side of things as rebuilding a corrupted DC is a a pain, but I can always get at user files as once a week I do a file backup to USB (we do have offsite backup but if the server is down its no help)

 

As for running 2003 type of software I could install 2003 as a hyper-v system although cant think of anything that might need it.

[Firefox]

Personally I would make both old and new windows 2008 R2 DC's

 

Put your schema and domain naming on the same box, the other 3 roles on the 2nd box...make both GC's

Setup DFS, and replicate the file shares between the 2 servers. If entirely possibly I would also team network cards on both servers across 2 switches.

 

You can find any machine to carry out your WSUS role, I personally wouldn't have this on my DC.

[edutech4schools]

If I split the GC across both units how does this help me? and if one server goes down how would I (a) get the working server to have all the rolls and (b) move them back once the server has been fixed?

 

Also what happens to the users if one server goes down?

 

Sorry but I am new to multi server setups.

[sukh]

If both sevrers are GC, then your DC will stil lbe available and be able to serve logon request/authentication. It can still provide access to the network and resources.

 

You don't always need to transfer the roles across, You probably wont notice that some arent working unless your performing a specific action/task, for e.g, the schema master, you wont know until say, you were going to deploy Exchange and you coundt update the scheme. As well with config. These are forest wide roles. The only issue I can see you may have is with the PDC emulator which you can seize and move via NTDSUTIL. Depends on the state of the DC failure.

 

If one server goes down, then you should be OK. As your other DC should continue to provide services, Need to make sure this DC is alos a DNS/DHCP too.

 

Sukh

[Firefox]

For DHCP depending on your ranges you also have the ability to split the scope across multiple DHCP servers (but this maybe OTT for your needs)

 

Make both servers DNS and have this Active Directory intergrated.

 

All these suggestions might seem over the top, because you might be thinking "we've been running ok on 1 server long enough"

 

But as with everything, it works great...until it dies lol had my fingers burnt before, now I build in resiliency whereever I can.

 

For the FSMO roles - as mentioned

 

Schema Master - only really needed for when you wish to make Schema updates

Domain naming - if you're not planning on making any new domains hardly used.

RID - very critical

Infrastructure Master - pretty much negated if all your DC's are GC's

PDC - critical role, but easily seized if it was to fail.

[PiqueABoo]

Also, if it is a single server then need to ensure that it FT all around, i.e network cards, teamming, CPU's, RAM etc..

 

On my planet, that or a second DC replicating all the data, or hyper-v failover or whatever would cost a "heck" of a lot more in terms of equipment, routine management effort and energy usage than a single DC w. RAID and next day on-site h/w cover. That a single-DC Primary system may be out of action until tomorrow once every few years if they're unlucky, just doesn't seem to bother them much and nor should it.

 

I think I am more worried about AD corruption

 

I've had a 3-figure number of systems under my radar and have seen genuine AD corruption just twice - a single DC one I fixed via a system-state restore in < 30 mins, the other was one of a multi-DC but would have been similar except the dodgy RAID system had made "holes" in lots of files so a large full backup needed restoring... and with multi-DC you have a lot more "is everything happy now" checks to do afterwards. The thing I have seen much more often is faux-corruption i.e. typically someone deleted or changed something (or ran something that did that) and then lied about it being a complete mystery - and that is the kind of corruption that replicates to other DCs.

 

 

Do whatever you feel is best for the school, but I'm on Michaels "side" and would contemplate potential use as a member server with shares for all the photos/videos or something... and subject to the spec we don't know, perhaps just get rid.

[edutech4schools]

PiqueABoo Thanks for your advice. lots to think about.

[sukh]

@PiqueABoo

 

That is interesting, but your post seems to be based on probabilities. If this is acceptable to the school then it's fine. If a school can tolerate downtime for whatever length of time, then make sure you have that agreement in writing or is known. Where I have deployed DC, it's always been a min of 2. It not only MSFT best practise but industry best practise. However, if you're limited to budget or hardware, then I guess you cant do much.

 

Sukh

[edutech4schools]

In my case the old server is not that old. DELL PE2900 with 2 years still on the warranty.

[PiqueABoo]

your post seems to be based on probabilities

 

Precisely: They're based on the risks I've experienced in the bit of the real-world I experience. They're also based on my default "less is more" approach - add a second DC and your system is now more complex, it can break in interesting new ways etc.

 

YMMV, I'm not claiming mine is the only approach.

 

It not only MSFT best practise but industry best practise

 

::shrug:: No one ever asked me, so "best practice" (BP) according to whom and where did they get their extensive hands-on experience of every sector and size? I haven't seen that much BP that hasn't been forged in, or for, genuine Enterprises. I reckon a lot of BP exists to get people who don't thoroughly understand what they're doing, to do something that should work well-enough in most scenarios, but there can be an even better way in some of them.

 

And of course MSFT want to sell you more licences (preferably over and over again), h/w vendors want to sell you boxes, support organisations want to sell you their time configuring and managing the former on the latter. Note: MSFT clearly weren't worried enough about violating BP to stop some of those licences being for SBS.

 

PS:

if you're limited to budget or hardware, then I guess you cant do much.

 

When it's public money I take cost-benefit very seriously and if I don't see a notable benefit for them, won't add something that increases the cost even if there is ample room in the budget.

Edited May 18, 2011 by PiqueABoo
PS:

[sukh]

"Precisely: They're based on the risks I've experienced in the bit of the real-world I experience. They're also based on my default "less is more" approach - add a second DC and your system is now more complex, it can break in interesting new ways etc."

 

I hear you, BUT the risk is still there. Like I say, if youre scholl doesnt mind the downtime then do it. Adding a second DC may involve more admn, i,.e backups, patches, SP, upgardes, but these out weigh the fact that if a DC is down and you have no other, then you simply can work, users or staff. Having 2 DC than one is always good, I cant hink of a reason not to. In my experience, having one DC when you have a chance to have two, you should do so. A system doesnt just break, espicially DC. Some makes a change to the DC then they break.

 

Industry best practise is from all sectors and industires, public and private. In this case, we are referring to a DC, which clearly in my opinion is best practise.

 

Sukh