I asked a similar question to this last week...now that I'm ready to move forward I'm just running this by all to make sure I don't screw it up
I have inherited a new office which until last weekend when I upgraded them had W2K domain controllers.
They are now W2K3 domain controllers.
I tried to add a W2k8 DC and ran into some serious issues because the Default Domain Controller policy had been modified with a W2k DC security template that changed registry and file permissions and screws up multiple services that W2k8 relies on.
Here's my proposal, just looking to you to tell me if it sound or not:
- Create a new W2k8 box on the domain
- Backup the current DCs
- Backup the current GPOs
- Change Default Domain Controller Policy manually by removing all entries that are causing issues.
- Wait 30 minutes
- Promote new W2k8 box as a DC
- Transfer ALL FSMO roles to W2k8 box
- Demote all older DC's (this seems necessary since they are still "affected" by the bad GPO)
- Bring up a 2nd DC
Does that seem logical to you? Seems like it would work to me.