Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I asked a similar question to this last week...now that I'm ready to move forward I'm just running this by all to make sure I don't screw it up

I have inherited a new office which until last weekend when I upgraded them had W2K domain controllers.

They are now W2K3 domain controllers.

I tried to add a W2k8 DC and ran into some serious issues because the Default Domain Controller policy had been modified with a W2k DC security template that changed registry and file permissions and screws up multiple services that W2k8 relies on.

Here's my proposal, just looking to you to tell me if it sound or not:

  1. Create a new W2k8 box on the domain
  2. Backup the current DCs
  3. Backup the current GPOs
  4. Change Default Domain Controller Policy manually by removing all entries that are causing issues.
  5. Wait 30 minutes
  6. Promote new W2k8 box as a DC
  7. Replicate
  8. Transfer ALL FSMO roles to W2k8 box
  9. Demote all older DC's (this seems necessary since they are still "affected" by the bad GPO)
  10. Bring up a 2nd DC

Does that seem logical to you? Seems like it would work to me.

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

I would prefer to use the dcGPOFix from Microsoft:

http://technet.microsoft.com/en-us/library/cc772811(WS.10).aspx

http://support.microsoft.com/?scid=kb;en-us;833783&x=17&y=8

share|improve this answer
    
Microsoft recommends only using DCGPOFIX in disaster-recovery scenarios, as stated in the second link you provided. –  Evan Anderson Feb 9 '10 at 13:15
    
It's often better to start again on something you know instead of relying on something you don't. Guys before him played so good that he can't add a w2k8 server. Putting back the default domain controller policy to it's default is the good way to handle the problem. Microsoft also state that playing with the registry could lead to hard problems... –  Mathieu Chateau Feb 9 '10 at 19:26
1  
I'm awarding the answer to Mathieu because that was what ended up actually fixing it with MS Directory Services team on the phone tonight. It turned out that the broken was way too borked to fixed manually even despite their own efforts. –  TheCleaner Feb 12 '10 at 2:55
    
thanks for that –  Mathieu Chateau Feb 12 '10 at 15:20
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.