7

Can you manage a Windows 2003 functional level domain with the Active Directory PowerShell modules?

The modules were introduced with Server 2008 R2, so they don't work on Server 2003, but I have read about doing this with the AD management gateway service. I'm not clear if this would work if I just have Windows 2003 domain controllers and no Windows 2008 R2 domain controllers.

Does anyone out there know for sure?

2 Answers 2

6

Aha!

Yes, you can manage a 2003 FL domain with the AD PowerShell Modules. (I do it myself... well, 2k3 R2... and check this [old] thread at PowerShell Community.)

However, the modules themselves are intended to be installed on Server 2k8 or Win7, and though I've seen reference to hacks to install it on XP or 2k3, that seems pretty foolish to me. Get a Win7 workstation and you can manage your 2k3 domain from it with the AD PowerShell Module you mention.

Also, as from that PS Community thread, you will require ADWS, which is available for Server 2003, and your DCs may also require some patches and updates to the .NET 3.5 framework. Two years later, I'd hope that's already the case in your environment, but you never know.

EDIT: And here's a technet blog about how to set it up, the important bits of which are posted below in case the link goes dead or whatever.

Required tools/patches:

  1. Remote Server Administration Tools (RSAT) for Windows 7
  2. Active Directory Management Gateway Service (ADMGS) (Active Directory Web Service for Windows Server 2003 and Windows Server 2008) and Install Guide
  3. Microsoft .NET Framework 3.5 Service Pack 1
  4. KB969166 - A hotfix rollup package for Active Directory Web Service is available for the .NET Framework 3.5 SP1
  5. KB969429 - Windows 7 clients cannot locate the Active Directory Management Gateway service that is installed on Windows Server 2003-based domain controllers
  6. KB967574 - Windows 7 clients cannot locate the Active Directory Management Gateway Service installed on Windows Server 2008-based domain controllers

[And as usual, you only want to install the hotfixes if you need them, and you have to hunt through the KB article and then go through the email-us-to-get-a-download-link junk to actually download them.]

Installation/Setup:

On your 2003 DC:

  1. Install .NET 3.5.1 (SP1 for .NET 3.5)
  2. Install hotfix KB 969166
  3. Install hotfix KB 969429
  4. Install the appropriate version of ADMGS KB 968934
  5. Go to Services and observe/ensure that the Active Directory Web Service is now installed and started.

On your Windows 7 workstation:

  1. Install Windows 7 RSAT.
  2. Add the Windows 7 RSAT features bolded below (Control Panel, Programs, Turn Windows features on or off):

    Remote Server Administration Tools

    • Role Administration Tools
      • AD DS and AD LDS Tools
        • Active Directory Module for Windows PowerShell
        • AD DS Tools
          • Active Directory Administrative Center
          • AD DS Snap-ins and Command-line Tools

Fire up PowerShell and punch in Import-Module ActiveDirectory. Sure beats VB or ADSI Edit, huh?

4
  • Hello I can confirm that this works perfectly! Those two hotfixes however are crucial :). Have 2 vms: a 2k3 dc and a win7 client. AD modules installed on win7 client and are managing the 2k3 AD instance.
    – floyd
    Jul 19, 2012 at 2:27
  • Also if you happen to have any links for any hacks on getting those AD modules installed on W2k3 server I would appreciate it.
    – floyd
    Jul 19, 2012 at 2:28
  • Glad it was helpful. I'll check tomorrow (afternoon, probably) when I get to work and have access to my old work desktop. It's XP, and I ended up finding a way to force all kinds of tools on there that weren't supposed to run on XP, and I did manage AD with Powershell on it, so I should be able to figure out how I did it and give you instructions. (My shiny new Win7 machine arrived a few weeks after I started.) Jul 19, 2012 at 2:47
  • 1
    @Floyd: Sorry, false alarm on actually installing the modules on XP/2k3. I couldn't get it done with the hacks and workarounds out at the time, so I used the free Quest approximation. A good alternative if you're somehow still unable to get your hands on a Win7 or Server 2008 host. (quest.com/powershell/activeroles-server.aspx) Jul 19, 2012 at 18:59
-1

Nope. The MS-provided modules described here do require a 2008 R2 domain controller, and ADWS (Active Directory Web Services).

Now, you can still use PowerShell to call dsmod, dsadd, etc ; and there are 3rd-party AD modules as well.

3
  • You sure about that? I have a 2003 FL forest and domain that I manage with the AD Powershell Modules referenced there. Granted, we do have some 2k8 R2 DCs (haven't decommed all those yet), but I was under the impression that the requirement of the AD PowerShell Modules was to run it from Server 2k8 or Win7 and not related to the FL of the domain in question. I'll go check Google, but you could same me some effort if you knew the answer. Jul 19, 2012 at 0:08
  • I have confirmed in lab that the instructions I accepted do work. Have two vms a 2k3 DC and a Win7 client. AD modules installed on win7 client and are managing the 2k3 domain. I believe the only requirement is that the AD module code can only be installed on Win7/2k8 OS not what it can actually manage.
    – floyd
    Jul 19, 2012 at 2:31
  • @Floyd: Actually, I'm pretty sure that the original requirement for having a 2008 R2 DC relates to the original release of ADGWS/ADWS. As I recall, at first, it could only be installed on 2k8 R2. But now that there's a working version on 2k3 and 2k8 R1, none of the AD PowerShell Module prereqs require a Server 2k8 R2 DC. Jul 19, 2012 at 2:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .