+ Post New Thread
Results 1 to 10 of 10
Windows Thread, Moving Domain Roles in Technical; I'm the process of rebuilding my main server from 2003 R2 to 2008 R2. As part of it to keep ...
  1. #1
    Trapper's Avatar
    Join Date
    Apr 2007
    Location
    Birmingham
    Posts
    1,140
    Thank Post
    71
    Thanked 137 Times in 110 Posts
    Rep Power
    91

    Moving Domain Roles

    I'm the process of rebuilding my main server from 2003 R2 to 2008 R2.

    As part of it to keep my AD intact I have a secondary domain controller running 2008 R1. It's been in for months.

    In final prep I was going to transfer all the domain roles over from Svr1 (2003) to Svr2 (2008) and then back to Svr1New (2008 R2)

    However when I try to transfer any roles I get an error saying the FMSO holder is not able to be contacted. But it's online and running fine.

    My DNS look fine, and I can ping each server from the other. So I'm a little stuck on what to do.

    I know I can take the old server offline and forcefully sieze the roles on my secondary DC and then transfer them back - but that seems a harsh way to do it. I'd prefer to do it gracefully than to sieze them.

    This is really annoying me, as all the results I can find on this deal with a dead DC going offline in a disaster and then needing to sieze the roles. The only post I can find regarding a graceful transfer where this error occurs with the orginal DC online deals with DNS. But my DNS seems fine.

    Any ideas folks?

    If not then I'll just have to take the old DC offline, sieze the roles and hope

    M

  2. #2

    Michael's Avatar
    Join Date
    Dec 2005
    Location
    Birmingham
    Posts
    9,241
    Thank Post
    239
    Thanked 1,567 Times in 1,249 Posts
    Rep Power
    339
    I presume as you're running a 2008 R1 Server that you've already upgraded the schema and ran /forestprep and /domainprep commands?

    You'll need to update the schema on your PDC again (up to 47, for 2008 R2). The firewall on 2008/2008 R2 is quite robust, so for this excercise I would recommend you switch it off.

    You need to make sure both your 2003 R2 and 2008 R1 servers can replicate. Check both are nameservers and that they can replicate between each other. Until you can do this, I wouldn't think about 2008 R2 or even seizing roles, that's not a good idea.

    I'm guessing you're upgrading at least the 2003 R2, so (once the server can replicate) transfer all roles to your 2008 R1 server (same process as 2000 to 2003 mostly), then demote 2003 R2 as a DC, demote it from the domain, then install 2008 R2.

    Don't forget to export DHCP server too Good luck!

  3. #3
    Trapper's Avatar
    Join Date
    Apr 2007
    Location
    Birmingham
    Posts
    1,140
    Thank Post
    71
    Thanked 137 Times in 110 Posts
    Rep Power
    91
    Both are happily replicating between each other.

    Both are nameservers. Hence why I'm stuck on this!

  4. #4

    Michael's Avatar
    Join Date
    Dec 2005
    Location
    Birmingham
    Posts
    9,241
    Thank Post
    239
    Thanked 1,567 Times in 1,249 Posts
    Rep Power
    339
    And I presume you've tried selecting a different Domain Controller on the context menu?

  5. #5
    Trapper's Avatar
    Join Date
    Apr 2007
    Location
    Birmingham
    Posts
    1,140
    Thank Post
    71
    Thanked 137 Times in 110 Posts
    Rep Power
    91
    Finally moved the roles. Turns out Sophos Endpoint was doing something funky - despite the Firewall being off and Sophos Tech Support saying it was nothing to do with them!

    I'm now having replication issues, namely SYSVOL and NETLOGON. It appears to be a DNS error, although my DNS looks fine. I've even deleted all the entries and rebuilt.

    When my old DC is off (which has no roles now) no AD tools can connect to the directory, and the DNS doesn't seem to run properly. With it turned on the AD tools connect (only on new DC as it should be, as there is no AD DB on old DC) and the DNS works fine.

    Any ideas?

  6. #6
    Trapper's Avatar
    Join Date
    Apr 2007
    Location
    Birmingham
    Posts
    1,140
    Thank Post
    71
    Thanked 137 Times in 110 Posts
    Rep Power
    91
    Ideas folks?

    I'm still can't get full replication (even after demoting and re-promoting. I can get DNS running only on new DC but in AD U&C advanced mode the AD dnsNode still points to the old DC. Hence when it's off AD tools won't connect and I've not got a SYSVOL or NETLOGON.

    I'm at the verge of chucking all this in and rebuilding the domain from the ground up (not that much hassle anyway, all the client machines - every last one - need to be re-imaged before the end of the summer, along with brand new GPOs) I only have 2 problems 1) The LEA is part way through a Sophos encryption install and 2) I would have to re-create my SHarepoint sites.

  7. #7

    Michael's Avatar
    Join Date
    Dec 2005
    Location
    Birmingham
    Posts
    9,241
    Thank Post
    239
    Thanked 1,567 Times in 1,249 Posts
    Rep Power
    339
    Even without the old DC hosting any roles, you should run dcpromo and properly demote it as a domain controller. This will transfer any remaining domain information to your new DC.

    I would also demote it from the domain to a workgroup. I have always done both of these just to be 100% the new DC will run without the old one.

  8. #8

    Michael's Avatar
    Join Date
    Dec 2005
    Location
    Birmingham
    Posts
    9,241
    Thank Post
    239
    Thanked 1,567 Times in 1,249 Posts
    Rep Power
    339
    Just a thought, did you make your new DC a Global Catalog and have you enabled DNS Zone Transfers (on both your existing and new DC, both Forward and Reverse zones)?

  9. #9
    Trapper's Avatar
    Join Date
    Apr 2007
    Location
    Birmingham
    Posts
    1,140
    Thank Post
    71
    Thanked 137 Times in 110 Posts
    Rep Power
    91
    Both are fine.

    The DNS just doesn't seem be transfering and when I try and demote the old DC I'm just told it can't find any other DCs in the forest.

    It seems like there are some real problems with this entire setup, so I'll start it again. I think now even if I get it replicating away, there are probably many more problems hidden away.

  10. #10

    Michael's Avatar
    Join Date
    Dec 2005
    Location
    Birmingham
    Posts
    9,241
    Thank Post
    239
    Thanked 1,567 Times in 1,249 Posts
    Rep Power
    339
    I would switch the Firewall off and make sure Zone Transfers are enabled. It doesn't sound like anything's majorly broken.

SHARE:
+ Post New Thread

Similar Threads

  1. Moving users to new domain
    By ravenadsl in forum Windows Server 2008 R2
    Replies: 8
    Last Post: 21st May 2010, 11:51 AM
  2. Moving domain name from ISP to another
    By superatticman in forum Internet Related/Filtering/Firewall
    Replies: 3
    Last Post: 18th March 2010, 07:25 PM
  3. Moving server roles
    By modcoms in forum Windows
    Replies: 10
    Last Post: 8th September 2008, 10:30 AM
  4. Moving from single label to dotted domain name..
    By johnny in forum How do you do....it?
    Replies: 8
    Last Post: 23rd February 2007, 01:31 PM
  5. Replies: 28
    Last Post: 28th November 2006, 03:32 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •