Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Initially when setting up Exchange 2010 CAS I ran into problems with permissions. I got around them by promoting the server to be a DC with a GC.

The Server was initially installed with 2008 R2 Standard ED. I need to do an in-place upgrade to ENTERPRISE which requires me to demote the DC on this server first (AKAIK).

This is a production server.

My question is: How best to achieve this?

If you can only offer some advice for possible problems I would greatly appreciate that too.

share|improve this question
Just curious, why do you need Enterprise? – MDMarra Feb 11 '13 at 2:49
Memory Limits. I need > 32gb. – Ablue Feb 11 '13 at 3:06
For a CAS and Directory Services? Or are there even more roles on this server? – MDMarra Feb 11 '13 at 3:07
store db is there too. – Ablue Feb 11 '13 at 3:09
Oh wow, yeah you need more server (or VMs). Role separation is key. – MDMarra Feb 11 '13 at 3:10
up vote 7 down vote accepted

First thing is first, figure out what the problem was with the CAS installation and figure out how to do it correctly.

After you have that sorted out, you shouldn't run any Exchange roles (or any other roles except DNS for that matter) on a Domain Controller. If you're buying an Enterprise license, you're entitled to run 4 VMs on the same piece of hardware with a single Enterprise license. You should do this. This is how I would handle it.

  1. Resolve your outstanding permissions issue.

  2. Install Hyper-V Server (or other virtualization product).

  3. Install at least two 2008 R2 VMs.

  4. Promote one of them to a DC and make it a GC.

  5. Make the other server a CAS for Exchange and do all of the stuff associated with transferring the CAS role to another server.

  6. Take the old CAS offline and uninstall Exchange from that box.

  7. Run dcpromo on the old box and demote it.

This requires extra hardware, but it's your best bet. Seriously, fix your original problems then separate the roles.

share|improve this answer
I suspected as much. I was hoping to resolve the original issue without doing anything permanent; maybe by disabling DC services temporarily to isolate the CAS issue. – Ablue Feb 11 '13 at 2:36
No, that's not a good solution, because then you're going to have all of the DNS records indicating that the server is a DC and a GC, but it's not going to respond to Directory Service requests. If anything, that will make it harder to diagnose. – MDMarra Feb 11 '13 at 2:48
Ok I am going to start another question to try and work out why exchange wont auth without a local gc. – Ablue Feb 11 '13 at 3:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.