2

i am planning to migrate an office (windows xp sp3 clients and a windows 2003 server named ServerA) to a Active Directory. I already have an AD Server (ServerB) running Windows 2008 Server in compatibility mode to 2003 (so i decrease the issues with xp clientes).

the main issue is that the moment i include the ServerA into the AD (ServerB), xp clients will lose all conectivity to folders and services running in ServerA until i include, one per one, all xp clients to AD (as far as i understand, all old 'static' credentials in ServerA will be deleted).

the office is quite large, so i want to avoid disconnections during an uncertain time while am doing troubleshooting machine per machine.

is there any kind of solution, advice or strategy so that i can maintain a "compatibility" mode between the old system and the new system? i mean, that after i include ServerA into the AD, all the xp clients that are still not connected to AD, still have access to resources (shared folders, services, etc.).

thank you very much in advance

Improve this question

2 Answers 2

Reset to default
6

If i understand correctly, you are talking about migrating from an existing peer to peer network to AD. If you promote ServerA to a domain controller, then local user accounts will be removed and yes, your existing XP clients will lose their connectivity.

If you simply add the server as a member server to the directory, then user accounts will stay, and users can access resources until you add the computers to the domain and adjust permissions.

Basically, join ServerA to the existing domain, but do not run a DCPROMO on it. This will retain all existing user accounts, and until you join clients to the domain (and login with domain accounts.(you can join computers, login locally and still access)), they will be able to access resources on ServerA.

If you are planning on phasing ServerA out altogether, there will still be some downtime as you move data to ServerB and add computers to the domain, and reassign permissions to AD users, rather than local users. There really isn't a way to achieve a P2P > AD migration without at least a little headache.

Improve this answer
2
  • Hi DanBig. Thank you very much for your advices. Could you advice me some docs about how to make ServerA join the AD without losing the old 'static' accounts and permisions while i still have workstations that are members and not members of the new AD? thanks in advance!
    – Michael Trend
    Sep 13, 2013 at 9:01
  • 1
    On ServerA: Right click My Computer > Properties > Change Settings. Click the Change button, pick Domain under 'Member Of' and put in the ServerB directory name, then authenticate when you click ok. Thats it.
    – DanBig
    Sep 13, 2013 at 12:15
6

The answer depends on your terminology: When you say "include the ServerA into the AD", what exactly do you mean?

If you mean making ServerA a domain member server then doing this will not erase its local accounts, so any actions that require those local accounts will proceed just fine after the server has joined the domain.

Therefore you can join it to the domain and migrate the workstations, the users, and the permissions for these folders and services on ServerA to AD accounts/permissions in your own time.

If you meant to say that you're planning to make ServerA an additional domain controller then yes, this will give you problems. When a server becomes a domain controller, its local accounts will not be available, and therefore permissions that are based on local accounts on the server will have problems.

This can be worked around with a bit of planning perhaps, but the best option may be to make ServerA a domain member server rather than a domain controller.

Improve this answer
2
  • Hi RobM, thank you very much for your answer. and yes, i meant making the ServerA a domain member server. So as i understood, i will be able to, for instance, apply new AD permissions to ServerA folders, while maintaining the 'static' older ones, so two different workstations (one not member of the AD, and another new member of the AD) can continue working without issues. Did i understand correctly? thank you very much in advance.
    – Michael Trend
    Sep 13, 2013 at 8:58
  • 1
    @MichaelTrend you understand perfectly. There's really not much to it (though don't get me wrong, if you've never done it before I understand your reluctance to just plunge in). You can totally have 'stand alone' and domain permissions applied on an object side-by-side with one another on a domain member server. Just add additional permissions for the domain members without removing your current 'stand alone' permissions and you'll be fine.
    – Rob Moir
    Sep 13, 2013 at 9:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .