Domain Rename for Windows 2003/2008

Domain Rename for Windows 2003/2008

Prerequisites for a domain rename in a simple single domain forest for windows 2003/2008:
•Enterprise Administrator credentials are required.
•The domain should be well formed and healthy. Ran dcdiag /q and repadmin /replsum to check for any errors and fix the same before you proceed. Ran gpotool can check all the policies are OK.
•The forest functional level must be Windows Server 2003 or 2008, and all DC’s running at least Server 2003.
•A DNS zone for the new domain must be in place.

The Rendom and Gpfixup tools must be copied to a domain member workstation to perform the rename operations. The operations should not be initiated from a domain controller.

See the TechNet link below for details on requirements if you’re using DFS redirection, roaming profiles, running a CA, or Exchange Server.

The domain rename is performed using the Rendom tool, which is installed with Active Directory when running dcpromo. Once this process is started, you must ensure that no changes are made to the forest configuration until complete. The steps are as follows.

1.To generate the current forest description file
Run “rendom /list” to generate a state file named Domainlist.xml. This file contains the current forest configuration.

2.To edit the domainlist.xml file
Using a simple text editor such as notepad, edit the state file, changing the and fields to the desired values for the new domain name.

3.To review the new forest description in domainlist.xml
Run “rendom /showforest” to show the potential changes; this step does not actually make any changes.

4.To generate the domain rename instructions and upload them to the domain naming master
Run “rendom /upload” to upload the rename instructions to the configuration directory partition on the domain controller holding the domain naming operations master role. The instructions are then replicated to all other DC’s in the forest. Once replicated to all DC’s, the rename instructions are ready to be carried out. You can force replication by running the “repadmin /syncall” command.

5.To verify the readiness of domain controllers in the forest
Run “rendom /prepare” to verify the readiness of each domain controller in the forest to carry out the rename instructions. This should contact all DC’s successfully and return no errors before proceeding.

6.To execute the domain rename instructions on all domain controllers
Run “rendom /execute”, this verifies readiness of all DC’s, then performs the rename action on each one. There will be a service interruption during this period. Upon completion domain controllers will be rebooted. If an error occurs on a DC during this phase, the entire transaction is rolled back. Any DC’s that don’t complete successfully after this phase must be demoted and removed from service.

7.To fix up Group Policy in every renamed domain
Run “gpfixup” to refresh all intradomain references and links to group policy objects.
For example,
Gpfixup /olddns:xyz.com.au /newdns:abc.com.au /oldnb: xyz /newnb: abc /dc:dc.zyz.com.au

8.Reboot client computers and member servers twice to obtain new domain name.
Because the GUID’s of the domain remain the same during the rename process, domain membership is not affected. The DNS suffix of the client machines will also be updated assuming the default option of “Change primary DNS suffix when domain membership changes” is enabled.

9.To perform attribute clean up after domain rename
Run “rendom /clean” to remove references of the old domain name from Active Directory.

10.To unfreeze the forest configuration
Run “rendom /end” to unfreeze the forest configuration and allow further changes. This was frozen during the rendom /upload step. \
Should you have any problems with clients recognizing the new domain name, you can remove them by running “netdom remove /Domain : /Force”, rebooting, and then rejoining the new domain. Once the rename is complete, there is one final change required on domain controllers. The DNS suffix of a DC is not changed as part of this process. This must be changed manually or the DC’s will have a DNS suffix that differs from the AD domain name.

For further details on renaming Server 2008 domains, reference this TechNet article: http://technet.microsoft.com/en-us/library/cc794869.aspx

Authoritative /Non-Authoritative Restore in Windows2008

 How to restore Server 2008 Active Directory (Non-Authoritative / Authoritative Restore)

Windows Server Backup
Windows Server Backup the Windows Server Backup feature provides a basic backup and recovery solution for computers running the Windows Server® 2008 operating system. Windows   Server Backup introduces new backup and recovery technology and replaces the previous Windows Backup (Ntbackup.exe) feature that was available with earlier versions of the ntbackup.

The ntbackup command is not available in Windows Vista or Windows Server 2008. Instead, you should use the wbadmin command and subcommands to back up and restore your computer and files from a command prompt. You cannot recover backups that you created with ntbackup by using wbadmin.

How to take systemstate backup.

To perform a system state backup, you must be a member of the Backup Operators group or the Administrators group, or you must have been delegated the appropriate permissions. In addition, you must run wbadmin from an elevated command prompt. (To open an elevated command prompt, click Start, right-click Command Prompt, and then click Run as administrator

Syntax: Wbadmin start systemstatebackup –backupTarget: <VolumeName>[-quiet]

Example: Wbadmin start systemstatebackup –backupTarget: F:

How to Restore Server 2008 Active Directory (non-authoritative)

1. On Server 2008 DC, open the command prompt on the server.

2. Run below commands to enter Directory Services Restore Mode (DSRM).                                           

 Bcedit / set safeboot dsrepair
 Shutdown –t 0 -r

Note: To manually boot in Directory Services Restore Mode, press the F8 key repeatedly. Do this immediately after BIOS POST screen, before the Windows logo appears. (Timing can be tricky; if the Windows logo appears you waited too long.) A text menu menu will appear. Use the up/down arrow keys to select Directory Services Restore Mode or DS Restore Mode. Then press the Enter key.

3. Login using administrator and DSRM password.

4. Run below command (note that e: is the drive letter of your backup), this will show you the version identifier of the backup.

Wbadmin get versions –backuptarget:e:

5. Run below command to start the restore.

Wbadmin start systemstaterecovery -version:10/08/2011-17:27–backuptarget :e:

6. After the restore process is completed, run following commands to reboot.

Bcedit /deletevalue safeboot
Shutdown –t 0 -r

How to Restore Server 2008 Active Directory if Someone Accidentally Deletes an Object. (Authoritative restore)

1.Restore Server 2008 Active Directory (non-authoritative), do not reboot the server

2. Open command prompt, run following commands, where CN=JIM,OU=HR,DC=TEST,DC=LOCAL is the object you wish to restore.

C:\>ntdsutil

ntdsutil: activate instance ntds

Active instance set to “ntds”.

ntdsutil: authoritative restore

authoritative restore: restore object CN=JIM,OU=HR, DC=TEST,DC=LOCAL

3. Once it’s completed. Type quit

4. After the restore process is completed, run following commands to reboot.

     Bcedit /deletevalue safeboot
     Shutdown –t 0 -r

How to transfer or seize FSMO roles

How to transfer or seize FSMO roles

The first Microsoft Windows 2000 Active Directory (AD) domain controller in a forest is granted five FSMO roles when you run the Dcpromo.exe program and install the AD. There are two FSMO roles that are forest wide and three that are per domain. If child domains are created, the two forest wide roles do not change. A forest with two domains would have eight FSMOs; two for the forest and three domain specific FSMO roles in each domain.

The five FSMO roles are:

• Schema master – Forest wide and one per forest.

• Domain naming master – Forest wide and one per forest.

• RID master – Domain Specific and one for each domain.

• PDC emulator – Domain Specific and one for each domain.

• Infrastructure master – Domain Specific and one for each domain.

If you only have one server (like SBS) it holds all the roles, if you have multiple domain controllers there is a chance that the roles have been divided to other servers (by whomever installed the forest…).

In order to find out which server holds which role you can use the following command on one of the servers:

Ntdsutil roles Connections “Connect to server<ServerName> ” Quit “select Operation Target” “List roles for connected server” Quit Quit Quit
**replace <ServerName> with the name of one of your DC’s
OR
Open command prompt and type netdom query fsmo

To move the FSMO roles from one computer to another, you can use two different methods. You can use the first method if both computers are running. This method is a Transfer and is the method that is recommended. Use the second method if the FSMO roles holder is offline. The second method requires you to use the Ntdsutil.exe tool to seize the roles.

NOTE: Only seize the FSMO roles to the remaining Active Directory domain controllers if you are removing the FSMO role holder from the domain or forest.

Transfer FSMO roles

To transfer the FSMO roles by using the Ntdsutil utility, follow these steps:

1. Log on to a Windows 2000 Server-based or Windows Server 2003-based member computer or domain controller that is located in the forest where FSMO roles are being transferred. We recommend that you log on to the domain controller that you are assigning FSMO roles to. The logged-on user should be a member of the Enterprise Administrators group to transfer Schema master or Domain naming master roles, or a member of the Domain Administrators group of the domain where the PDC emulator, RID master and the Infrastructure master roles are being transferred.

2. Click Start, click Run, type ntdsutil in the Open box, and then click OK.

3. Type roles, and then press ENTER.

Note To see a list of available commands at any one of the prompts in the Ntdsutil utility, type? and then press ENTER.

4. Type connections, and then press ENTER.

5. Type connect to server servername, and then press ENTER, where servername is the name of the domain controller you want to assign the FSMO role to.

6. At the server connections prompt, type q, and then press ENTER.

7. Type transfer role, where role is the role that you want to transfer. For a list of roles that you can transfer, type? at the fsmo maintenance prompt, and then press ENTER, or see the list of roles at the start of this article.

For example,

To transfer the Domain Naming master role, type transfer naming master

To transfer the infrastructure master role, type transfer infrastructure master

To transfer the Domain Naming master role, type transfer pdc

To transfer the RID master role, type transfer rid master

To transfer the Domain Naming master role, type transfer schema master

Note: The one exception is for the PDC emulator role, whose syntax is transfer pdc, not transfer pdc emulator.

8. At the fsmo maintenance prompt, type q, and then press ENTER to gain access to the ntdsutil prompt. Type q, and then press ENTER to quit the Ntdsutil utility.

Seize FSMO roles

To seize or transfer the FSMO roles by using Ntdsutil, follow these steps:

2. Click Start, click Run, type ntdsutil in the Open box, and then click OK.

3. Type roles, and then press ENTER.

4. Type connections, and then press ENTER.

5. Type connect to server servername, and then press ENTER, where servername is the name of the domain controller you want to use.

6. At the server connections prompt, type q, and then press ENTER.

7. Type seize role, where role is the role that you want to seize. At the fsmo maintenance prompt, and then press ENTER,

For example,

To seize the Domain Naming master role, type seize naming master

To seize the infrastructure master role, type seize infrastructure master

To seize the Domain Naming master role, type seize pdc

To seize the RID master role, type seize rid master

To seize the Domain Naming master role, type seize schema master

Notes• Under typical conditions, all five roles must be assigned to “live” domain controllers in the forest. If a domain controller that owns a FSMO role is taken out of service before its roles are transferred, you must seize all roles to an appropriate and healthy domain controller.

If the domain controller that formerly held any FSMO role is not present in the domain and if it has had its roles seized by using the steps in this post, remove it from the Active Directory by following the procedure that is outlined in the following Microsoft Knowledge Base article: 216498 (http://support.microsoft.com/kb/216498/) How to remove data in active directory after an unsuccessful domain controller demotion.

Domain Rename in Windows2003/2008

Prerequisites for a domain rename in a simple single domain forest for windows 2003/2008:

  • Enterprise Administrator credentials are required.
  • The domain should be well formed and healthy. Ran dcdiag /q and repadmin /replsum to check for any errors and fix the same before you proceed. Ran gpotool can check all the policies are OK.
  • The forest functional level must be Windows Server 2003 or 2008, and all DC’s running at least Server 2003.
  • A DNS zone for the new domain must be in place.

 The Rendom and Gpfixup tools must be copied to a domain member workstation to perform the rename operations. The operations should not be initiated from a domain controller.

See the TechNet link below for details on requirements if you’re using DFS redirection, roaming profiles, running a CA, or Exchange Server.

The domain rename is performed using the Rendom tool, which is installed with Active Directory when running dcpromo. Once this process is started, you must ensure that no changes are made to the forest configuration until complete. The steps are as follows.

1.       To generate the current forest description file

Run “rendom /list” to generate a state file named Domainlist.xml. This file contains the current forest configuration.

2.       To edit the domainlist.xml file

Using a simple text editor such as notepad, edit the state file, changing the <DNSname> and <NetBiosName> fields to the desired values for the new domain name.

3.       To review the new forest description in domainlist.xml

 Run “rendom /showforest” to show the potential changes; this step does not actually make any changes.

4.       To generate the domain rename instructions and upload them to the domain naming master

Run “rendom /upload” to upload the rename instructions to the configuration directory partition on the domain controller holding the domain naming operations master role. The instructions are then replicated to all other DC’s in the forest. Once replicated to all DC’s, the rename instructions are ready to be carried out. You can force replication by running the “repadmin /syncall” command.

 5.       To verify the readiness of domain controllers in the forest

Run “rendom /prepare” to verify the readiness of each domain controller in the forest to carry out the rename instructions. This should contact all DC’s successfully and return no errors before proceeding.

 6.       To execute the domain rename instructions on all domain controllers

Run “rendom /execute”, this verifies readiness of all DC’s, then performs the rename action on each one. There will be a service interruption during this period. Upon completion domain controllers will be rebooted. If an error occurs on a DC during this phase, the entire transaction is rolled back. Any DC’s that don’t complete successfully after this phase must be demoted and removed from service.

 7.       To fix up Group Policy in every renamed domain

 Run “gpfixup” to refresh all intradomain references and links to group policy objects.

For example,

Gpfixup /olddns:xyz.com.au /newdns:abc.com.au /oldnb: xyz /newnb: abc /dc:dc.zyz.com.au

 8.       Reboot client computers and member servers twice to obtain new domain name.

Because the GUID’s of the domain remain the same during the rename process, domain membership is not affected. The DNS suffix of the client machines will also be updated assuming the default option of “Change primary DNS suffix when domain membership changes” is enabled.

 9.       To perform attribute clean up after domain rename

Run “rendom /clean” to remove references of the old domain name from Active Directory.

 10.   To unfreeze the forest configuration

 Run “rendom /end” to unfreeze the forest configuration and allow further changes. This was frozen during the rendom /upload step.

Should you have any problems with clients recognizing the new domain name, you can remove them by running “netdom remove <machine-name> /Domain :< old-domain> /Force”, rebooting, and then rejoining the new domain. Once the rename is complete, there is one final change required on domain controllers. The DNS suffix of a DC is not changed as part of this process. This must be changed manually or the DC’s will have a DNS suffix that differs from the AD domain name.

For further details on renaming Server 2008 domains, reference this TechNet article: http://technet.microsoft.com/en-us/library/cc794869.aspx

Secure channel between the DC’s broken

Secure channel between the DC’s broken:

Follow these steps to reset KDC password :-

1. Stop the Key Distribution Center (KDC) service on Server2. To do so, open
a Command Prompt, type net stop KDC, and press Enter.

2. Load Kerbtray.exe. You can do so by clicking Start, clicking Run, and
then typing c:\program files\resource kit\kerbtray.exe and pressing Enter.
You should see a little green ticket icon in your system tray in the lower
right corner of your desktop.

3. Purge the ticket cache on Server2, right-click the green ticket icon in
your system tray, and then click Purge Tickets. You should receive a
confirmation that your ticket cache was purged. Click OK.

4. Reset the Server domain controller account password on Server1 (the PDC
emulator).

To do so, open a command prompt and type: netdom /resetpwd /server:server2
/userd:domain.com\administrator /passwordd:password, and then press Enter.

5. Synchronize the domain. To do so, open a command prompt, type repadmin
/syncall, and then press Enter.

6. Start the KDC service on Server2. To do so, open a command prompt, type
net start KDC, and press Enter. This completes the process, and the domain
controllers should be replicating success-fully now

How to install 2008 DC in 2003 domain

There are a couple of very important considerations, that you should have in mind, before you proceed with your migration scenario.
–Check, and raise, if necessary, the Domain and Forest functional levels. You cannot upgrade directly from Windows 2000 mixed, or Windows Server 2003 interim domain functional levels.

–The first Windows Server 2008 Domain Controller in the forest must be a Global Catalog Server, and it cannot be a Read Only Domain Controller, RODC.

–Check the FSMO roles assignments. When you prepare the existing AD, you should run adprep /forestprep on the Schema operations master, and adprep /domainprep /gpprep on the infrastructure master.In your case as there is a single Dc you need to run on the same server.

Steps to Install Windows 2008 R2 DC

1.First prepare the domain.
Insert Win 2008 R2 DVD on windows 2003 DC and execute adprep as below
Ran D:\2008DVD\Support\Adprep\adprep32.exe /forestprep on the server holding the Schema Master role.
Ran D:\2008DVD\Support\Adprep\adprep32.exe /domainprep /gpprep on the server holding the domain master role.

Reference article:http://www.petri.co.il/prepare-for-server-2008-r2-domain-controller.htm

2.Install DNS role in win2k8
Reference KB article:http://technet.microsoft.com/en-us/library/cc725925.aspx

3.Once DNS role is installed.Ran dcpromo on win2k8 R2.
Reference KB article:http://technet.microsoft.com/en-us/library/cc753720(WS.10).aspx

4.After the Win2k8 Dc promotion is completed restart the win2k8 DC.

5.You must transfer the FSMO roles to the 2008 machine then the process is as outlined at http://www.petri.co.il/transferring_fsmo_roles.htm

6.Ran dcdiag /q and repadmin /replsum on DC to check for any errors.

7.Change all of the clients (and the new 2008 DC itself), to point to the 2008 DC for their preferred DNS server this may be in DHCP options or the TCP/IP settings.