Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I asked a similar question to this last that I'm ready to move forward I'm just running this by all to make sure I don't screw it up

I have inherited a new office which until last weekend when I upgraded them had W2K domain controllers.

They are now W2K3 domain controllers.

I tried to add a W2k8 DC and ran into some serious issues because the Default Domain Controller policy had been modified with a W2k DC security template that changed registry and file permissions and screws up multiple services that W2k8 relies on.

Here's my proposal, just looking to you to tell me if it sound or not:

  1. Create a new W2k8 box on the domain
  2. Backup the current DCs
  3. Backup the current GPOs
  4. Change Default Domain Controller Policy manually by removing all entries that are causing issues.
  5. Wait 30 minutes
  6. Promote new W2k8 box as a DC
  7. Replicate
  8. Transfer ALL FSMO roles to W2k8 box
  9. Demote all older DC's (this seems necessary since they are still "affected" by the bad GPO)
  10. Bring up a 2nd DC

Does that seem logical to you? Seems like it would work to me.

share|improve this question
up vote 2 down vote accepted

I would prefer to use the dcGPOFix from Microsoft:;en-us;833783&x=17&y=8

share|improve this answer
Microsoft recommends only using DCGPOFIX in disaster-recovery scenarios, as stated in the second link you provided. – Evan Anderson Feb 9 '10 at 13:15
It's often better to start again on something you know instead of relying on something you don't. Guys before him played so good that he can't add a w2k8 server. Putting back the default domain controller policy to it's default is the good way to handle the problem. Microsoft also state that playing with the registry could lead to hard problems... – Mathieu Chateau Feb 9 '10 at 19:26
I'm awarding the answer to Mathieu because that was what ended up actually fixing it with MS Directory Services team on the phone tonight. It turned out that the broken was way too borked to fixed manually even despite their own efforts. – TheCleaner Feb 12 '10 at 2:55
thanks for that – Mathieu Chateau Feb 12 '10 at 15:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.