6

I asked a similar question to this last week...now that I'm ready to move forward I'm just running this by all to make sure I don't screw it up

I have inherited a new office which until last weekend when I upgraded them had W2K domain controllers.

They are now W2K3 domain controllers.

I tried to add a W2k8 DC and ran into some serious issues because the Default Domain Controller policy had been modified with a W2k DC security template that changed registry and file permissions and screws up multiple services that W2k8 relies on.

Here's my proposal, just looking to you to tell me if it sound or not:

  1. Create a new W2k8 box on the domain
  2. Backup the current DCs
  3. Backup the current GPOs
  4. Change Default Domain Controller Policy manually by removing all entries that are causing issues.
  5. Wait 30 minutes
  6. Promote new W2k8 box as a DC
  7. Replicate
  8. Transfer ALL FSMO roles to W2k8 box
  9. Demote all older DC's (this seems necessary since they are still "affected" by the bad GPO)
  10. Bring up a 2nd DC

Does that seem logical to you? Seems like it would work to me.

Improve this question

1 Answer 1

Reset to default
2

I would prefer to use the dcGPOFix from Microsoft:

http://technet.microsoft.com/en-us/library/cc772811(WS.10).aspx

http://support.microsoft.com/?scid=kb;en-us;833783&x=17&y=8

Improve this answer
3
  • Microsoft recommends only using DCGPOFIX in disaster-recovery scenarios, as stated in the second link you provided.
    – Evan Anderson
    Feb 9, 2010 at 13:15
  • It's often better to start again on something you know instead of relying on something you don't. Guys before him played so good that he can't add a w2k8 server. Putting back the default domain controller policy to it's default is the good way to handle the problem. Microsoft also state that playing with the registry could lead to hard problems...
    – Mathieu Chateau
    Feb 9, 2010 at 19:26
  • 1
    I'm awarding the answer to Mathieu because that was what ended up actually fixing it with MS Directory Services team on the phone tonight. It turned out that the broken was way too borked to fixed manually even despite their own efforts.
    – TheCleaner
    Feb 12, 2010 at 2:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .