Implementing a Migration to the Active Directory for Windows 2000
As with any major network upgrade project, you should be sure to
Start by Upgrading Primary Domain Controller
When you decide to upgrade your network to a Windows 2000 Active Directorybased network, you'll need to plan the order in which servers and workstations will be upgraded. The Active Directorybased Windows 2000 domain controller is backward compatible with Windows NT 4.0 domain controllers, so upgrading the PDC is transparent to the users and domain controllers that are still operating under Windows NT 4.0. Backup domain controllers in the domain see the new Active Directory domain controller just as if it were a PDC in the Windows NT 4.0 domain. One consideration to keep in mind is that after you upgrade a server to be a Windows 2000 Active Directory domain controller, you can't, in the same domain, promote a Windows NT 4.0 BDC to become a PDC. The new Active Directory domain controller provides this capability as far as Windows NT 4.0 BDCs are
Upgrade the Domain's PDC and Then Any BDCs
When you upgrade the PDC to become an Active Directory domain controller, you're prompted to either join an existing domain tree or create a new domain tree. If this is the first Active Directory domain controller in the network, you have to create a new domain tree. The operation is a simple, painless oneno complicated setup or configuration is required to create a domain tree.
After you've created the first Active Directory domain controller from the domain's PDC, you'll have a mixed network environment that still can function normally from the user's standpoint. That is, users still can authenticate using the BDCs that
The new Active Directory domain controller uses the single-master replication method to
However, after you've finally converted
your Windows NT 4.0 BDCs to be Active Directory domain controllers and have made the switch to the native-mode Windows 2000 Active Directory, only multimaster replication will occur from that point on. This implies that
you will no longer be able to add Windows NT Server 4.0 domain controllers to the domain
. If you're
After you have made the switch and all
are based on the Active Directory, all clients, including those down-level nonWindows 2000 clients, will be capable of taking advantage of the transitive trust relationship that's created between all domains in the domain tree. This is because the trust relationship is created between domain controllers, which perform authentication functions, not by the individual workstations or other clients in the network. That means you can proceed to upgrade all your BDCs to Windows 2000 Active Directory domain controllers and then, as you find opportunities to schedule the required downtime, you can upgrade client machines, such as Windows NT 4.0 Workstation
Adding Other Domains to the Active Directory
In a multidomain network, you'll first create a domain tree using one of the domain controllers in an existing domain or you can even create a new domain from a fresh install to serve as the first domain in a new domain tree.
When you later decide to upgrade other domains in your network to use the Active Directory, you can still create a new domain tree or you can choose to join the existing domain tree. Again, the operation is simple. To join an existing domain tree, you need only supply the
Several things occur when you join an existing tree:
Upgrade the Master Domain First
In the master domain model, all user accounts reside in the master domain and resources are created in separate resource domains. When you upgrade a network that's based on a single domain, there isn't much choice: first upgrade the PDC and then upgrade the domain's BDCs.
In the master domain model type of network, you should choose to upgrade the master domain first and then upgrade the resource domains. At the completion of the basic upgrade, you use the Active Directory Installation Wizard to install the Active Directory (see Figure 62.1).
Figure 62.1. The Installation Wizard guides you through the process.
Figure 62.2. If this is the first controller to be upgraded, you create a new domain tree.
The wizard then prompts you for the domain name that you want to use. You have to specify it as a fully qualified DNS name, however (see Figure 62.3).
Figure 62.3. Use a fully qualified DNS name when prompted by the wizard.
The wizard then asks you to enter a NetBIOS-compatible name for the new domain. Previous versions of Windows use this name for the domain until you've finished the migration and are running a Windows 2000only network.
The wizard then asks you where you want to create the files that will serve as the database for the directory and for a device to store the log file for the directory (see Figure 62.4). If your domain is large, you should specify a different device for each of these files to improve performance.
Figure 62.4. Enter the paths that will be used to create the Active Directory database and log files.
The next dialog box prompts you to enter a path that will be used to store files that are replicated to other domain controllers in the domain. As you can see in this figure, the
If you are not yet using a DNS server in the domain, the wizard will prompt you to install Microsoft's DNS Server. Click the OK button to dismiss this dialog box. The Configure DNS dialog box pops up and asks whether you want to install DNS now or wait until later. For Active Directory to function correctly, a DNS server is required. It's best to go ahead and elect to install Microsoft's DNS at this time because the Active Directory must register resource records that clients will use to locate domain controllers.
The next dialog box is an important one. If you're planning on a gradual migration where you will keep preWindows 2000 clients on the network for a while, you'll need to run Windows 2000 in mixed mode so that the Windows 2000 domain controller can act as the PDC in the domain for these down-level clients. You can see this dialog box in Figure 62.5.
Figure 62.5. For a gradual upgrade, take the first selection so that down-level clients will have permission to access the Active Directory as if it were a PDC.
The wizard then prompts you to enter a password that will be used as an administrator password for this server if you need to start the computer in Directory Services Restore Mode. Finally, you'll see a summary dialog box that shows the options you've selected. Scroll through this dialog box to re-examine your choices and, if they're correct, click Next.
An informational dialog box appears telling you that the wizard is configuring the Active Directory. Depending on your selections and the information stored on the server when it was operating in Windows NT 4.0 PDC mode, this could take some time. Existing data stored in the Windows NT 4.0 Security Accounts Manager (SAM) database needs to be migrated to objects in the new Active Directory. Drink a cup of coffee or two. At the bottom of this dialog box, you'll see the processes that are being performed, such as installing DNS and configuring databases for the Active Directory.
As a last step, the wizard adds shortcuts to several tools in the Administrative Tools folder that you can use to manage the directory and then prompts you to restart the computer.
After upgrading the first server, you should experiment with it to get used to the new tools and review your plans for the other servers in the domain. When you're sure that you want to proceed, upgrading backup domain controllers is done in the same way except that you don't create a new domain for the BDCs. When upgrading servers in other domains that you want to place into the same domain tree, you can choose to create a child domain and construct the fully qualified domain name according to where you want to place the domain in the tree.
Upgrade the BDCs Next
After you've upgraded the Windows NT 4.0 PDC to become a Windows 2000 domain controller, your network will be operating in what is called mixed mode as long as other Windows NT 4.0 (or prior versions) backup domain controllers exist on the network. To continue your migration, use the same steps on each BDC as you did to upgrade and promote the PDC. After you've upgraded all down-level domain controllers to Windows 2000 domain controllers, you can switch the network to native mode.
A domain administrator using the MMC Active Directory Domains and Trusts snap-in must perform this function. This step should not be done until you're absolutely sure that you no longer need to
To take this final step and make the switch to a native-mode Windows 2000 domain network, follow these steps:
That's it. There's no going back (unless you've saved a prior Windows NT 4.0 PDC or BDC offline for recovery purposes). You'll now be operating in an allWindows 2000 environment.