Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In the following period I have to migrate the AD over to 2008 schema level.

I currently have a x64 Windows 2008 R2 domain controller and one x32 Windows Server 2003 domain controller. The x32 server is a old machine which doesn't even support the upgrade to 2008. I have began my transition plan and installed 2 servers (one with 2008 R2 x64 and one with x64 2003). No problem with transferring the roles, but I can't seem to be able to transfer the Certificate Authority (CA) over to a x64 machine.

  1. Scope

    1.1. Upgrade the AD schema to 2008.

  2. Restrictions

    2.1. I can't use the old root server as it doesn't support Windows Server 2008.

    2.2. I have to get to x64 as Windows Server 2008 R2 doesn't support x32.

    2.3. I have to move the CA because I have to demote the server.

  3. What I've done so far for the CA move

    3.1. Installed a x64 2008 R2, tried to make the restore of the CA there -not working. It should work, but it doesn't according to this TechNet.Error message "Restore of an incremental image cannot be performed before you perform restore from a full image. The directory name is invalid. 0x8007010b (WIN32/HTTP:267) "

    3.2. Installed a x64 2003, tried to make the restore of the CA not working because the database is in a different format.

Any ideas would be greatly appreciated, as a last resort I can keep the CA there, but to keep a server only for a CA role seems pointless.

share|improve this question
Would you mind posting actual error messages and stuff? – MichelZ Jul 23 '12 at 15:03
Could you give an overview of your CA infrastructure? Single/Multi Level? How much time is left on this CA's certificate life? Depending on that and the number of certs that have been issued, another alternative may be to build a new CA, and issue new certs. – Craig620 Jul 23 '12 at 15:21
Single level 1 root CA @100 servers + desktops . Renewed the certificate a couple of months ago . Thanks for the tip, however I don't know exactly what risk is implied in this, but I will definitely check it up . Thanks! – Alex H Jul 23 '12 at 16:00
Posted the error message for 2k8 , the same one apears for 2003 , and depending on the options chosen, it changes to path not found 0x80070002 , from certutil it says that the ANSI headers are not correct with the same error message . – Alex H Jul 23 '12 at 16:34
up vote 1 down vote accepted

What i'm trying to do now :

  1. Created Image with disk2vhd of the old physical server.

  2. Got the image running in a isolated VM on Hyper-V (without networking )

  3. Extended disk in order to prepare it for an in-place upgrade to windows 2008 x86(since the physical drive had only 14 GB on C: - done that with GParted after I've deleted the D: partition to make room because I have a basic disk - not a dynamic one)
  4. Powershell needs to be uninstalled if you go on that path , after some searching I couldn't find that KB with powershell , so I've deleted C:\windows\system32\powershell .
  5. Ran adprep/ forestprep ,adprep/ domainprep,adprep/ rodcprep - I want to get a RODC in place after the upgrade , that step failed , but I supose it should have because I only have the Schema Master role there , the rest are migrated to another DC and since the DC doesn't have network connection it can't see it / upgrade it .
  6. Result BSOD without a error code , going to try that again .
  7. Update 1 : Restarted the server a couple of time before the upgrade and escaped the BSOD , but when I try to boot it just gives me the error about "vmbus.sys" missing which I discovered it's part of Hyper-V integration tools (thanks MS!) . Going to take the backup and uninstall Integration tools 1st then attempt the upgrade (Uninstall didn't work so I just took another backup).
  8. Update 2 : Managed to upgrade to windows 2008 (not R2) x86 .No show-stoppers error occurred . Shut down the old physical DC (with the comment "goodbye old friend" . connected the VM DC to the network and checking for AD replication , DNS and CA ).
  9. will perform a normal AD functionality level upgrade .
  10. Checked that everything looks ok , performed remote backups for all DC's (disk2vhd) and windows server backup .
  11. Succesfully upgraded with no errors .Checked for errors with "repadmin /showrepl","dcdiag /test:replications"and "repadmin /replsum /bysrc /bydest /sort:delta"
  12. Schema can be verified with dsquery * cn=schema,cn=configuration,dc=yourdomain,dc=local -scope base -attr objectVersion
  13. Be sure to verify in event viewer(on all DC's) that there aren't any errors that might affect AD as a last precaution .
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.