We merged with a company and I'm taking over the IT duties there.
They had a 2000 domain that was upgraded to 2003.
The problem is that someone applied the W2k security policy templates to "harden" the DC's and after the upgrade it doesn't seem to work right at all.
This means that the DEFAULT DOMAIN CONTROLLER POLICY is jacked up and has tons of security settings that are messing up the upgraded domain controllers.
I am going to build up 2 new domain controllers and replicate AD/DNS/DHCP between them and then demote the existing DCs.
- I think in order to do what I want I'll need to blow away and recreate the true default Default Domain Controller Policy. Then add the new DCs to the domain and replicate AD/DNS and then demote the old domain controllers and remove them.
Does that sound logical? Anyone else have to deal with such a mess?