Upgrading Windows2000 Server to .....

[IanGude]

I've been tasked with migrating an existing Domain Controller, running on Windows 2000 Server (yes, I know.....) to something more up to date........

 

Anyone got any experience of this ? Obviously we're going to have to use an intermediate stage (2003 ?) and then migrate from there (?)

 

Any tools people can recommend to migrate users / shares / DHCP etc ?

 

All suggestions welcomed !

 

Thanks

Ian

Edited October 17, 2022 by IanGude

[steveg]

How big / intricate is the domain? Just wondering if it's been neglected for that long it may be very small and actually easier to set a new one up from scratch and just migrate data?

[IanGude]

About 40 users - no storage reqs. Just AD (inc logon scripts to mount drives that are going to remain on the old server for now), DHCP, DNS etc.

[Accura2k7]

First things first, in place upgrades wont work. Modern server networks run 64 bit, Windows 2000 server is highly likely 32 bit.

 

Better off starting from scratch and building the network from the floor up, migrating users and data as you go.

[IanGude]

Yes, sorry, thats my plan. new gear, new OS, create new Domain and then migrate users over. So looking for tool(s) that will help us migrate the users from the old domain into the new one, without having to start from scratch. If this can be done 'direct' - ie without having to go via an intermediate 'compatible' OS, then all the better.

[steveg]

What hardware is it running on? Presumably it is being replaced as well?

[DalekSec]

As much as it may be a PITA, kill it and start again. The amount of issues you will have with the migration and legacy issues will vastly outweigh the time it takes to rebuild it.

[IanGude]

Yes, replaced in terms of a new server running something more up to date. The machine will physically still be there as network storage and the links etc to it will be migrated once we have the new Domain in place and working.

[steveg]

Yes, replaced in terms of a new server running something more up to date. The machine will physically still be there as network storage and the links etc to it will be migrated once we have the new Domain in place and working.

 

How old is the hardware? Can't imagine a modern server os will run well / at all on 15+ year old hardware to host the storage?

[IanGude]

How old is the hardware? Can't imagine a modern server os will run well / at all on 15+ year old hardware to host the storage?

 

Yes, new hardware.

[steveg]

Yes, new hardware.

 

You have server 2000 running on modern hardware? I do have to ask how it got there?!

 

I definitely think the easiest way is manually in this instance. There are tools for bulk creating user accounts, you won't gain much from migrating the existing accounts. Unless you have an unusual setup I can't see there being a need for login scripts etc on the new setup so a good chance for a clean up of things.

[FN-GM]

I wouldn’t jump to rebuilding the whole domain. There might not be anything wrong with it. If it’s been setup and left all these years it might mean nobody has been in tinkering. I would seriously considering working on this to upgrade.

 

Windows Server 2000 was end of life in 2010. So maybe an intermediate could be Server 2008 R2. Although I am not sure this is even necessary.

 

You can migrate shares with Robocopy. For DHCP with such a small network I could recreate the scope.

Edited October 17, 2022 by FN-GM

[3s-gtech]

Agreed with the above - you should be able to do this with intermediate DCs. Add them to the domain (after updating the schema etc), transfer roles, demote the old DC, then again up to the newest version you're licensed for.

 

Our domain started on 2000, and is happily on 2019 without any real issues along the way.

[jthompson]

Assuming that the domain is at a 2000 functional level, the latest OS that will work with that is 2008 R2.

Adding a 2008 R2 DC would allow you to raise the functional level to 2008 R2.

You could then add a DC running anything up to Server 2022 to get the functional level up to 2016 (current latest). Don't retain that 2008 R2 server.

 

After doing all that, use PingCastle to identify and address any dangerous legacy configurations.

Edited October 17, 2022 by jthompson

[IanGude]

You have server 2000 running on modern hardware? I do have to ask how it got there?!

 

I definitely think the easiest way is manually in this instance. There are tools for bulk creating user accounts, you won't gain much from migrating the existing accounts. Unless you have an unusual setup I can't see there being a need for login scripts etc on the new setup so a good chance for a clean up of things.

 

Sorry, no - it's ancient hardware - I mean we are GETTING new hardware.

[Oaktech]

For 40 users... Blow it away and start again. Consider whether they even need an on-prem domain or whether Azure would be better.

[jthompson]

A new from-scratch domain build is the ideal, but that that does mean having to sort out getting all your computers joined to the new domain or reimaged. If you've got more than a handful of computers, that's going to be annoying. The recreation of user accounts would be reasonably straightforward compared to that, since they lend themselves to being done in bulk.

 

I suppose you could do a phased approach rather than a hard cutover. Build a new domain on the new server, create user accounts for everyone, and then work through the computers over a period of time, moving them to the new domain. The rest of the users/computers continue on on the 2000 domain until it's their turn to be migrated.

[IanGude]

The recreation of user accounts would be reasonably straightforward compared to that, since they lend themselves to being done in bulk.

 

I'm all for starting from scratch - but is there a tool that will allow me just to 'port' over all of the user accounts from Windows 2000 to ANO version ?

[steveg]

Sorry, no - it's ancient hardware - I mean we are GETTING new hardware.

 

Ah ok. Thought you meant that storage was staying on the old hardware, so was just checking what OS was going to run on the old hardware to host the storage.

[round2it]

might be cheaper time wise to get a company in to do that for you,they will have done it 1000 times and they know what to look out for

[jthompson]

I'm all for starting from scratch - but is there a tool that will allow me just to 'port' over all of the user accounts from Windows 2000 to ANO version ?

 

Not as such, no. You'd bascially be creating new accounts on a new domain, that just happen to have the same names, usernames, etc. There will be GUIDs and things in the background which will necessarily end up different between respective accounts on both domains.

 

To get a usable CSV list of your users exported from your old domain, have a look at WiseSoft BulkADUsers. The attributes you want to export will just be all the obvious ones like first name, last name, job title, department, email, etc but the vast majority of user AD attribues you'll be leaving behind.

 

With a suitable CSV export to hand, you can then look at using WiseSoft Account Management Spreadsheet to create accounts accordingly in your shiny new domain. Users will need to start off with new passwords: you won't be able to carry those across.

 

---

 

Don't forget to note down which AD groups you're going to need to recreate. The tools above won't really help you with that, but with only ~40 users, that's not likely to be too onerous to rebuild by hand.

Edited October 17, 2022 by jthompson

[3s-gtech]

There is a tool - ADMT. It can be a godsend. It can save a huge amount of work, but may be overkill for your application.

[FN-GM]

There is a tool - ADMT. It can be a godsend. It can save a huge amount of work, but may be overkill for your application.

 

Don’t forget all the legacy’s SIDS that will need to be tided.

[psydii]

Just for fun: You will certainly need to familiarise yourself with this on your journey:

 

https://learn.microsoft.com/en-us/windows-server/storage/dfs-replication/migrate-sysvol-to-dfsr

 

Also you are likely to have things like NTLM hashes, and older security defaults in the GPOs. You might want to check it's not still in 'Mixed Mode' for NT4 compatibility. Look into SMB1 support - I'm pretty sure 2022 will have that disabled if not unavailable, but with 2000 it's the default (with fall back to netbios)

 

Also as you progress through the versions, you might find client support an issue, can clients that are happy still talking to W2k Active directory actually talk to a 2022 AD? You may have to pay attention to cypher suites too.

https://learn.microsoft.com/en-us/windows/win32/secauthn/tls-cipher-suites-in-windows-server-2022

https://support.microsoft.com/en-us/topic/improving-cipher-security-in-windows-server-2003-sp2-1ca3df4d-f7c8-b4df-41e6-520279eb478d

 

 

Also with such an old system, might well have tools like telnet and ftp in play.

 

What about imaging client devices - what have they got going on there. I mean, the default back then was RIS. I assume it will be something image based like Ghost? That might not translate well into a modern environment.

 

Finally, is there an exchange server? I'm guessing not or you'd probably have mentioned it. 2003 was the last version that supported AD with only 2K DCs, that would be a fun project on its own!

 

 

 

 

 

 

All that said, though... Before you start though you might want to take some screen shots of any old artifacts is it possible the domain pre-dates AD? There aren't many of those left, and there is a change the DC was an in place upgrade from NT4, having evidence of taking such an old domain to 2022 would give you bragging rights in certain corners of the internet.