Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am curious... Would there be any problems having 2 domain controllers on a network being different versions (03 and 08)?

Also, In the case that all that should work fine... can you tell me the compatibility with group policies?

Ex. Can you set some group policies on the 03 server and then use some of the newer group policies on the 08 server?

Thank for the help, Cory

share|improve this question

AD is designed to let this work. The Schema needs to be extended to allow the Server 2008 server to hold the Domain Controller roll, but so long as the Functional Level is still on 2003, that 2003 server can remain a DC. It might be wise to move some of your FSMO roles around as you upgrade, but it should work without problems. We ran like this for a couple days as we upgraded our Domain Controllers. Our group-policies continued to work just fine.

share|improve this answer
It will work fine with the FSMO roles on either OS, assuming that machine meets the other requirements for holding that role. – MDMarra Sep 17 '10 at 18:16
Moving the PDCe FSMO (at least temporarily) to the 2008 DC will enable creation of various groups and security principals that 2008 depends on. – Brian Desmond Sep 19 '10 at 20:45

A note regarding group policies, as mentioned they will continue to oporate without issue. Just be sure that when it comes time to edit or create a polciy that you don't work on a policy from multiple versions of GPMC.

Last spring when we were mid way with out intergration of 08 DCs with our 03 DCs we had this issue, and found the only way to keep a consistant application of a given policy was to only modify it in the same GPMC version (ie on XP/W2k3 only or 7/W2k8 only.)

share|improve this answer

I assume you want to add a 2k8 DC to your 2k3 AD environment. This is totally fine. First you have to prep the domain and possibly the forest to enable the 2k8 machine to become a DC. Then, you promote the 2k8 machine to be a DC and everything works great.

You will not be able to upgrade the forest or domain functional levels to 2k8 unless you decomission your 2k3 domain controllers though.

In terms of group policy and other AD features - the GPOs will be supported by both DCs. Usually it is the targets (the managed servers) that will vary in terms of which GPOs are supported.

Example: A 2k8 DC running a 2k8 functional level domain will be able to apply GP to a bunch of 2k3 servers, but the 2k3 servers won't support the hundreds of new GP functions available in 2k8.

Example: A 2k3 DC will apply 2k3-functional level GP to a group of 2k8 member servers, but none of the new GP functions available in 2k8 will be available to deploy to the group (since the DC is 2k3).

share|improve this answer
That was the exact information I was looking for. I just put a Server 2008 DC server in the domain with little problems. I have quite a few windows7 machines and I wanted the ability to customize their firewalls through GPO's and 03 just didn't have the policies to do it. – Cory Sep 17 '10 at 19:42

Just keep your "Domain Functional Level" at the lowest level for all your domain controllers. I.e. if you have 2003 domain controllers mixed with 2008... never raise your domain functional level above 2003. The downside is that once you raise the level... you can't go back. You can still have 2003 servers... interacting with the domain... but not functioning as domain controllers. Alternatively, you can have 2 domains... at 2 different levels & setup a domain-trust between them in order to inter-operate between them. (of course this can be even more headache than it's worth trying to manage 2 domains)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.