1
  1. I have a AD DC 2008
  2. i installed AD DC on another 2012 host, transferred the 2008 domain PDC and all other FSMO roles to the 2012 server.
  3. the 2008 server has a E: drive with shared folders accessed network-wide and have permissions based on AD users and groups
  4. In-place upgrade of this 2008 failed.
  5. AD Users must come in and transparently access these shares tomorrow

Q1. if i install 2012 on the C partition, install AD DS and join domain as BDC will the permissions on that E: drive be transparent to the new installation since these permissions were set based on AD users and groups?

1
  • If i install 2012 on the C partition, install AD DS and join domain as BDC will the permissions on that E: drive be transparent to the new installation since these permissions were set based on AD users and groups? Yes.
    – Greg Askew
    Oct 11, 2020 at 14:45

1 Answer 1

0

First, validate that replication from the old DC to the new one is successful. Use repadmin /replsummary and repadmin /showrepl to see your results.

Second, if at all possible, make every effort to move other roles onto their own server instead of sharing a domain controller.

Did remove the AD DS role from the 2008 server before attempting the in-place upgrade? If not, complete this step, and then try the upgrade again. Note exactly what the errors are during the upgrade if it fails again.

If you cannot get the upgrade to work, you'll clearly want to find a way to complete your migration away from Windows Server 2008. To maintain access to shares, you can build a new file server and either upgrade the drive mappings using Group Policy, or use a DNS alias to redirect the current UNCs to the new one.

4
  • replication is fine all roles are on the 2012 server AD DS is still running i can remove it The issue with these shared folders is there are a lot of permissions set on them for over a hundred users and groups and we dont want to lose these permissions on this partition. Is there a way of doing a clean install of server 2012 on the c: partition and MAINTAIN the folder permissions on the shares on the E: drive without reassigning the permissions. The users are all AD users Oct 14, 2020 at 16:32
  • If the permissions (Access Control Lists) all use AD-based user accounts, then you'll be fine. Each ACE (Access Control Entry) in the ACL actually records the SID of the user account being granted permission. When you view the permissions, the OS actually resolves the SID to the users' display names to make it easier for humans to read. :) So again, since you have used AD users in the permissions, and their SIDs won't change, you will be fine.
    – Sam Erde
    Oct 14, 2020 at 19:17
  • thanks for the clarification on ACLs one more thing, when i am in the new OS after reinstall, obviously the new OS wont know the folder shares right? if so i will have to recreate them. is there are way of saving/exporting the current meta data/folder shares/structure and permissions from the current 2008 so that when i have the new clean 2012 i can somehow "import" these new folder shares and permissions into windows and we restore previous shares and permissions? even if it means using a commerical tool i wouldnt mind Oct 16, 2020 at 13:31
  • Your shares would not persist through a new OS installation, but permissions may. Still, PLEASE consider building a dedicating file server and moving the shares to it. Domain controllers should have NOTHING other than the AD DS and DNS Server roles running on them.
    – Sam Erde
    Oct 16, 2020 at 16:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .