2nd server cock up syndrome

[Laphan]

Hi All

 

OK, OK this could be classed as my fault, but I'm really a newbie when it comes to servers, AD, etc. I can manage the process OK, but I'm not what I'd call an edugeek :0)

 

In a nutshell I look after two schools and we had a Windows 2003 Server R2 machine in both so that we could utilise AD to manage users, lockdown the PCs with GPO, shares for teachers, shares for pupils, etc. Nice and basic.

 

After 3 years or so we thought it best to buy new servers with better specs, new warranty, etc and put them in. This is where we got caught out. Originally, one school bought a server from say company A and the other school bought their server from company B. This time we bought both servers from company B.

 

The first installation that had a company A server and then a company B server seemed to move over fine. My plan was that after transferring all of the profile/My Docs and 'shares' data from the old server to the new server, I would 'downgrade/demote' the old server to basically a file server so that this could store the bulk of the multimedia crap (ie video, music and pics) that they produce and the new/main server would only hold the profile/My docs data and leaner shares data.

 

To get the client PCs to 'see/use' the new PC my idea was to 'undomain' them (ie put them on workgroup of FRED), restart, add them to the domain, restart and then we'd be up-and-running. I just thought that would be the process. Nice and simple.

 

I then used the built in feature of W2k3 server to remove the AD stuff from the old server (this automatically put it onto workgroup), stopped the DNS and DHCP services permanently, changed its IP and computer name to not conflict with the new server, restarted, added it back to the domain of the new server.

 

All of the above seemed to work fine and the reason it seems to have is because the domain name of the old server was/is different to the one used on the new server.

 

Unaware of this I proceeded to do the above at the 2nd school and hit a crapstorm of issues. Logging on existing machines with the above in place resulted in completely intermittent GPO stuff coming through (eg desktop shortcuts sometime coming, sometimes not; map drives appearing not appearing; My Docs redirection working/not working) and laptops with offline files enabled going completely gaga such as saying they aren't connected then saying they are and so on.

 

Having thought about it the only thing diff was that the domain name of the old is exactly the same as the new and it **appears** that the existing PCs are logging on and then looking at the old settings (I'm guessing the foolders in C:/Docs&Settings) and losing the plot.

 

To try and remedy the situation I put the PCs back on workgroup, zapped the Offline cache (Ctrl+Shift+Del??) and deleted all of the profile (?) folders that are in a PC's C:/Docs & Settings folder.

 

I've got loads of PCs to do and I just feel like I'm botching something as I go.

 

Before I continue with this task I just wanted to check with the gurus that:

 

a) Am I right in saying because the domain name is the same on both this has caused the issue?

 

b) What should I have really done when going from old server to new?

 

c) Is the approach I'm taking correct?

 

d) Is there a better way or is my cumbersome method the only fix?

 

e) Am I OK leaving the old server on the network in it's demoted state or is this the root of the problem?

 

Thanks for any advice you can give.

 

Rgds

 

Laphan

[m25man]

As your such a newbie I'm going to leave the dressing down to others,

 

What I will tell you is that the key to everything Active Directory is DNS, DNS, DNS...

 

Whatever you do or have done you must have your DNS configured and working correctly. Buy all of the books, go to all of the websites but skip the section on DNS at your peril.

 

Make sure that the new server is working correctly before turning your attention to the clients.

 

Then make sure that the DHCP your using is telling the clients where the AD DNS servers are on your network.

 

If you set up the new server as a DC in a new domain even though it maybe the same name it will have a new SID and the process of joining your clients to the new domain will orphan your old security identifiers along with all of the profiles and users files in the process.

 

At worse you will end up with clients that have unusually large registries unless you rebuild them, but at least once you have your DNS working correctly the AD should come on line.

 

Clearly you did not swot up on migration strategies, because if you had you could have added you new hardware into the domain without doing a lot else in a few hours.... Now you have as you say a crapstorm to contend with.

[Sam_Brown]

I'm calling troll on this one.

[featured_spectre]

I am completely dumbfounded at peoples lack of responsibility. If you did not know what you were doing, you should have read up on it and asked for help. No shame in that.

[elsiegee40]

OP is well aware of his lack of homework... There's nothing he can do about that; it's happened. Let's leave posts on this thread to ones that actually help him get stuff working.

 

Like the rest of us, he has the first day of term looming and our the only reason any of us have work in schools is the kids. Enabling the students to be taught is the priority. Cross as we may feel, flaming isn't going to help him or the schools.

[Laphan]

Hi All

 

Thanks for your response.

 

Please, please, please don't think I'm doing this for effect or a loose cannon. I've only done a few and as you might have experienced ICT techies are sometimes very isolated creatures. I only found this site by chance, I'd never heard of it before, as company B offered me very vague suggestions to the problem and I suddenly knew something was really wrong. Hence the reason I started looking for solutions on the net and found this site.

 

I just thought this was the way because company B never once mentioned any big deal about it. I just thought copy stuff across, drop old server, put new one on. Job done. In an ideal world isn't this what it should be like :0)

 

Any pointers you can give me would be very much appreciated. I'm going to look through the DNS today.

[Guest salan]

Was there any reason why you didn't just create the new server and add it to the existing domain as another dc. change the roles over (GC etc) then demote the old dc?

Unless I have missed soemthing, that is what I would have done. We have nearlly all our servers virtualised, but we keep one physical dc 'just in case'. It does nothing as such but it has the Ad on it! and for that alone its worth it!

Alan

[Laphan]

Hi

 

I know this might sound medieval, but I was warned off ever having two DCs on the same network/domain for fear of conflict. That's why I thought you copy stuff across, get the old one off, put the new one on.

 

I'd put myself down as a manager (lite) of a primary school server rather than a proper network manager.

 

I know the basics and that's all we've got/can afford. Willing, but probably not able :0) We have been fine other than this new process of moving from an old one to a new one.

[featured_spectre]

Microsoft and a few other vendors do free modules from their courses (ie mcitp, mcse, ccna etc) so look into those to learn a bit for free.

[ZeroHour]

Stay on topic all, no troll comments please.

 

I know this might sound medieval, but I was warned off ever having two DCs on the same network/domain for fear of conflict. That's why I thought you copy stuff across, get the old one off, put the new one on.

 

I'd put myself down as a manager (lite) of a primary school server rather than a proper network manager.

 

I know the basics and that's all we've got/can afford. Willing, but probably not able :0) We have been fine other than this new process of moving from an old one to a new one.

 

I think you may have misunderstood, 2 domains can have issues if DNS is not done correctly but a standard network should always have 2 DC's.

What you should do when getting a new server is join it to the current domain, make it a DC, transfer FSMO roles to the new DC, change default ip in DHCP to point to new DC for dns, then you can think about demoting old one but you dont have to. Running 2 is recommended.

 

Go to a client/desktop, run cmd and do a gpresult and see what errors it gives to give a few clues.

[PiqueABoo]

a standard network should always have 2 DC's.

 

I've argued this before, but for 1-form entry Primary my OTS vanillas, a large number of other folks and lots of RM CC3/4s have all been perfectly happy running single server i.e. 1 DC. Ditto for lots of small orgs. using Windows SBS. You obviously need a good backup regime but that's true for any system. Far as I'm concerned adding a second DC to a such a school because you "should always" is a waste of money they usually haven't got.

 

[Not arguing with what you should do when getting a new server.]

[ZeroHour]

I've argued this before, but for 1-form entry Primary my OTS vanillas, a large number of other folks and lots of RM CC3/4s have all been perfectly happy running single server i.e. 1 DC. Ditto for lots of small orgs. using Windows SBS. You obviously need a good backup regime but that's true for any system. Far as I'm concerned adding a second DC to a such a school because you "should always" is a waste of money they usually haven't got.

 

[Not arguing with what you should do when getting a new server.]

 

Yeh but tbh most places would have 2 servers anyway in some form or other. Hell you can even use a desktop if you want. It does though depend on how essential your server is, if you can live without a network for a few days/week for replacement hardware then its more viable.

[PiqueABoo]

Around here in Primary it is very common to see one Nearly Everything Server[tm] and usually with next-day h/w cover. SIMS might be on someone's decent spec. workstation in the school office, or on a modest h/w member server. Their dependency on tech isn't that great that they can't survive < 24 hours without the system, and of course teacher laptops are usually configured to work without the domain at home etc. This model does work, and realistically an outage isn't that much more troublesome than having a working AD without profiles, my docs, shares, run-from-server apps etc. that are resident on the dead box. Try fixing all the continuity problems and before you know it you're designing serious failover clusters with redundant n/w infrastructure..

[Achandler]

Firstly before this gets way way off topic.

 

Have you managed to sort the problem out at all yet?

 

Secondly whereabouts in the country are you? If you are local to some people, then they may well be willing to come help you for half a day.

[elsiegee40]

Firstly before this gets way way off topic.

 

Have you managed to sort the problem out at all yet?

 

Secondly whereabouts in the country are you? If you are local to some people, then they may well be willing to come help you for half a day.

 

Echoed... @Laphan ?

[Laphan]

Hi All

 

Many, many thanks for your feedback.

 

DNS and DHCP settings on the new server appear to be OK now and if I ping the domain name and server.domain name from a client I get the new server's details as response.

 

If I delete the local user profile (??) folders from a client PC's document & settings folder (not the local admin ones, but the server created ones) and re-login to make the network re-create a folder in this area then the GPO **appears** to all come through as expected.

 

We use batch login scripts to map drives, printers, etc and if I could put something in here to auto-zap the existing doc & settings folders (with exceptions) then I would, but my colleague needs the exp and has the time so he's going to go through the client PCs and bin the old folders to let the new ones come through.

 

What I don't understand is that it sounds like people are suggesting the new server's DHCP and/or DNS servers weren't set up correctly and if they were and we continued to do the plan that we had, ie copy data across, drop old server, put new one in and put old one in with a new name and IP then this is OK. Am I right?

 

Old server def has no AD stuff on it, new ip, new name, DHCP server service stopped and DNS server service stopped, but then added back to the domain so that it's connected to the same network so that users don't have to enter a username and password to access files and folders that are on it. Does anybody have any issues with this? We only wanted it as a glorified file server and local backup location.

 

I know this is also a bit of trivial thing in comparison to everything else, but I can never get the desktop wallpaper to appear 100% on every login there is always the occasion when you have to press the F5 key to bring it up. Is there a belt and braces approach to make this work every time?

 

Thanks agian.

[Dom_]

 

I know this is also a bit of trivial thing in comparison to everything else, but I can never get the desktop wallpaper to appear 100% on every login there is always the occasion when you have to press the F5 key to bring it up. Is there a belt and braces approach to make this work every time?

 

Thanks agian.

 

Use BGinfo - and a small script to run it - works every time, and you can add custom messages etc. Plenty of posts on here to explain it :-)