Migrating 2003 AD to 2008 R2 (Part 1)

Force promote DC2 as PDC when DC1 who hold FSMO roles no longer exist

Symptoms:
Want to migrate DC from Windows 2003 server to Windows 2008 R2 server. But DC1 who hold PDC no longer exist.

Solution:
Force moving FSMO to DC2 using ntsdutil

1. ntdsutil
2. roles
3. connections
4. connect to server DC2
5. quit
6. seize PDC
7. seize schema master
8. seize RID master
9. seize infrastructure master
10. seize domain naming master
11. quit

Remove DC1 from AD using ntdsutil

1. ntdsutil
2. metadata cleanup
3. connections
4. connect to server DC2
5. quit
6. select operation target
7. list domains
8. select domain 0
9. list sites
10. select site 0
11. list servers in site
12. select server DC1
13. quit
14. remove selected server
15. Confirm by click YES in message box (make sure removing DC1 server)

Remove any trails of DC1 record in:

1. Active Directory Sites and Services
1. remove from server object
2. Active Directory Users and Computers
1. remove from server object
3. DNS
1. remove all DC1 ip records
2. remove from replicate

Windows Server 2003 Error event 8194 with error code 0x8007000d

Symptoms: 

8194 Group Policy Files NT AUTHORITY\SYSTEM nodename The client-side extension could not remove computer policy settings for '  { }' because it failed with error code '0x8007000d The data is invalid.'

1085 Userenv NT AUTHORITY\SYSTEM nodename. The Group Policy client-side extension Group Policy Files failed to execute. Please look for any errors reported earlier by that extension.

Cause: 

Error event 8194 with error code 0x8007000d is usually caused by a corrupt file in the server’s group policy cache and/or by corruption of Group Policy\History registry hive

Solution:

Clear the Global Policy cache and delete the registry hive on the Windows 2003 server that is exhibiting the problem and get the cache/registry repopulated as per the following:

• Open Windows Explorer.
• Save the contents of folder %ALLUSERSPROFILE%\Application Data\Microsoft\Group Policy\History to another location.
• Delete all files and folders in the History folder.
• Delete the following registry hives:
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History
• HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\History
• Open Command Prompt and type gpupdate/force .

Export and Import a readable DHCP scope

Export:

Readable:

netsh dhcp server \\SERVERNAME dump all > filename.txt

Unreadable:

netsh dhcp server \\SERVERNAME export d:\filename all

Full Export with policies (2012) using PS with Administrator Rights

Export-DhcpServer -ComputerName SERVERNAME -File "D:\filename.xml" -Force

Import:

Full Import with policies (2012) using PS with Administrator Rights

Import DhcpServer -ComputerName SERVERNAME -File "D:\filename.xml" -Force

for New 2003 server format

netsh exec filename.txt

for 2000 server format

netsh dhcp server import filename.txt all

Authorize:

1. Activate

2. Authorized from currently authorized DHCP server

SYSVOL and NETLOGON location

SYSVOL and NETLOGON are the shared from \\DOMAIN.NAME


Share name     SYSVOL
Path              C:\WINDOWS\sysvol\sysvol
Remark            Logon server share
Maximum users     No limit
Users
Caching           Manual caching of documents
Permission        Everyone, READ
                  BUILTIN\Administrators, FULL
                  BUILTIN\Authenticated Users, FULL


Share name        NETLOGON
Path              C:\WINDOWS\sysvol\sysvol\DOMAIN.NAME\SCRIPTS
Remark            Logon server share
Maximum users     No limit
Users
Caching           Manual caching of documents
Permission        Everyone, READ
                  BUILTIN\Administrators, FULL

fSMORoleOwner location on ADSIedit

- Domain []
   -- DC (properties)

- Domain []
   -- DC
       --- CN=Infrastructure (properties)

- Schema []
   -- CN=Schema (properties)

- Configuration []
   -- CN=Partitions (properties)

Ncomputing over windows 2003 server problem and solution

Symptom

Error “Server yet not ready, try again a bit later” an error where the hpvcard.dll failed to initialize.

Solution 1

Add the following key to the host:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management]
“SessionImageSize”=dword:00000020

Solution 2

Remove Security Update KB956572 also remove update KB958690

Symptom

Error "to log on to this remote computer, you must be granted the Allow log on through Terminal Services right. By default, members of the Remote Desktop Users group have this right. If you are not a memeber of the Remote Desktop Users group or another group that has this right , or if the Remote Desktop Users group doesn not have this right, you must be granted this right manually"

Solution 1 

Add user to Remote Desktop User Group

Solution 2 

Configure the security setting in Default Domain Controller Policy GPO:

1.    Run gpmc.msc  to open the Group Policy Management console.
2.    Expand  Domain Controllers, right-click Default Domain Controller Policy, and click Edit.
3.    In the Group Policy Management Editor window, expand Computer Configuration\Windows Settings\Security Settings\Local Policies\User Right Assignment\Allow log on locally
4.    Add User or Group and click OK three times to apply the settings.
5.    Run gpupdate /force to apply the policy.

Old DHCP Servers appear in the list of Authorized servers

Symptoms:

1. You may see the old server’s name still listed when you view DHCP Authorized servers

2. You may get the following error: "There is no such object on the server” when tried to unauthorized

Solution:

Remove the objects from Active Directory using ADSIEDIT:
1. Start Adsiedit.msc.
2. Open the configuration Container.
3. Expand Services.
4. Expand Net Services.
5. On the right hand side, find a record named CN=DHCPRoot
6. Right Click the CN=DhcpRoot entry and then click Properties
7. Highlight DhcpServers Attribute and click Edit
8. Highlight the entry with the old Domain name and click Remove from DHCPServers Attribute. Click OK to close DHCPServers editor’s screen
9. Once deleted the DHCPServers value will be “not set"
10. Save the change by clicking OK and close Adsiedit.
11. Restart the DHCP server service
12. run the following command: “Netsh DHCP show server” to check
13. If the servers are still listed, run the command “netsh DHCP delete server ServerFQDN ServerIPAddress”

Event ID: 7023 DHCP Client service does not start

Symptoms:

The DHCP Client service does not start after you upgrade a Windows 2000 Server-based domain controller to Windows Server 2003

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7023
Date: Date
Time: Time
User: N/A
Computer: ServerName
Description: The DHCP Client service terminated with the following error: Access is denied.

Cause:
This problem occurs because the Network Service account does not have sufficient permissions to access the following registry subkeys when you upgrade to Windows Server 2003:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

Solution:

To resolve this problem, assign the Network Service account Full Control access to the following registry subkeys and subkeys under:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip

http://support.microsoft.com/kb/895149

Prevent the network adapter from detecting a link state

To prevent the network adapter from detecting a link state, follow these steps.

Note The NetBEUI protocol and the IPX protocol do not support Media Sensing.

1. Start Registry Editor.
2. Locate the following registry subkey:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters

3. Add the following registry entry to the Parameters subkey:

Name: DisableDHCPMediaSense
Data type: REG_DWORD (Boolean)
Value: 1

Note This entry controls the behavior of Media Sensing. By default, Media Sensing events trigger a DHCP client to take an action. For example, when a connect event occurs, the client tries to obtain a lease. When a disconnect event occurs, the client may invalidate the interface and routes. If you set this value data to 1, DHCP clients and non-DHCP clients ignore Media Sensing events.

4. Restart the computer.

Note Microsoft Windows Server 2003 supports Media Sensing when it is used in a server cluster environment. By default, however, Media Sensing is disabled in a Windows Server 2003-based server cluster, and the DisableDHCPMediaSense registry entry has no effect. In Windows Server 2003 Service Pack 1 (SP1), the DisableClusSvcMediaSense registry entry was introduced. You can use this registry entry to enable Media Sensing on the Windows Server 2003-based nodes of a server cluster. The details of the DisableClusSvcMediaSense registry entry are as follows:

Key: HKEY_LOCAL_MACHINE\Cluster\Parameters
Name: DisableClusSvcMediaSense
Data type: REG_DWORD (Boolean)
Default value: 0

By default, the DisableClusSvcMediaSense entry is set to 0. When this entry is set to 0, Media Sensing is disabled. If you set the DisableClusSvcMediaSense entry to 1, you can use the DisableDHCPMediaSense entry to enable Media Sensing. This behavior matches the behavior of a Microsoft Windows 2000 Server cluster environment.

More info: http://support.microsoft.com/kb/239924/

How to access Domain Group Policies

Symptoms:
Need to Apply Domain Group Policies for AD Windows server 2003 R2 sp2 ?

Solution:
1. Administrative Tools > Active Directory Users and Computers.
2. In the left console tree, right-click the name of the domain to which the policy is applied, and then click Properties.
3. From Group Policy Tabs, Choose Default Domain Policy continue by click Edit Button

Beside this, you can upgrade to Group Policy Management Console (GPMC) to improve.