MCITP 70-640: Upgrading Active Directory

This video looks at upgrading your current Active Directory environment so that you can deploy Windows Server 2008/R2 domain controllers in your environment. The video looks at the prerequisites required, the commands you need to run and a demonstration of how to prepare your environment for Windows Server 2008/R2

Upgrading demo 05:40

The following only needs to be done if you are planning to deploy Windows Server 2008 or Windows Server 2008 R2 Domain controllers on your network. If you only want to use Windows Server 2008 as a member server (that is, you do not want to promote it to a domain controller), you can do this without having to perform any of the steps in this video.

Upgrading Prerequisites
Remove all NT4 Domain controllers
Upgrade all Domain controllers to Windows Server 2000 SP4 or above
Domain functional level needs to be Windows 2000 or higher
Forest functional level needs to Windows Server 2000 or higher
The user performing the upgrade needs to be a member of the following groups:
Schema /Enterprise/Domain Administrator

For more information on the domain and forest functional levels, please see the following videos.
Forest Functional Level Video
Domain Functional Levels Video

Preparing your environment
In order to prepare your environment you need to run a tool called ADPrep. This can be found on the Windows Server 2008/R2 DVD under the Support folder. ADPrep has been updated since Windows Server 2008 and thus the first two commands listed below need to be run again when installing your first Windows Server 2008 R2 Domain Controller on a network with Windows Server 2008 Domain Controllers.

This command needs to be run once per forest. The command needs to be run on the server holding the schema operational master role.
ADPrep /ForestPrep
The following commands need to be run once on every domain in which you are going to deploy Windows Server 2008/R2 Domain Controllers. The following commands need to be run on the Domain controller holding the infrastructure master.
ADPrep /DomainPrep
ADPrep /DomainPrep /GPPrep
The following command only needs to be run if you are going to deploy Windows Server 2008 Read Only domain controllers. If you are not sure, run the command anyway as it does not affect the run of Active Directory if Read Only Domain Controllers are not deployed.
ADPrep /RODCPrep

Upgrading demo
To check the forest level, run Active Directory Domain and Trusts, right click the domain and select raise domain functional level. Make sure it is Windows Server 2000 native or higher.
To find out which domain controllers are holding which operational master roles, run the following command:
netdom query fsmo
To upgrade the forest, on the Domain Controller holding the schema operational master role, run the command line ADPrep /ForestPrep.
The process normally takes about 5 minutes or so. Once it is completed, allow some time for the changes to replicate through your network or force a replication.

To check whether your domain meets the minimum requirement for the domain functional level Windows Server 2000, run the command Active Directory Users and Computers. Right click the domain and select raise domain functional level.

The following commands need to be run on all domains on which you want to deploy Windows Server 2008 domain controllers. The following commands also need to be run on the Domain Controller holding the infrastructure operational master role.
ADPrep /DomainPrep
ADPrep /DomainPrep /GPPrep
The following command only needs to be run if you are planning on using Windows Server 2008 Read Only Domain Controllers.
ADPrep /RODCPrep

[stanislavailieva]

You are the best lecturer I have ever seen

[ishaik]

Just wanted to give my gratitude and thanks to itfreetraining team for doing such a wonderful job of providing free IT training. I am new to this whole world of IT and was wondering where to start. Came across your interactive videos and learnt a great deal. We appreciate this great service you guys are providing. Keep this good work going.. Cheers :)

[steveperks]

Actually, sir, both can be raised from AD Domains and Trusts; it depends on where you right-click. If you right-click on the ADDT root, not the domain under it, you access the forest functional level. Right-clicking on the domain below the ADDT root in the snap-in, you access the domain functional level. Microsoft got tricky on us. Great videos by the way! Thanks for all the extra help!

[itfreetraining]

Forest function levels are raised in Active Directory Domain and Trusts.
Domain function levels are raised in Active Directory users and computers.
In the GUI for both tools they both say raise domain functional level and refer to them as domain levels so it is a little bit confusing. Not sure why Microsoft naming them this way in the GUI and named them forest and domain functional level in their documentation. I would ignore what the Gui says at it will confuse you.

[itfreetraining]

There is a forest functionally level and a domain functional level.. The domain functional level effects only the domain and can be raised any time assuming you only have Domain Controllers present for that domain level. The forest function level can be raised only if all the domains in the forest have been raised to that function level.

[zukini]

Another thing that confused me - you first mention that "adprep /domainprep" should be run on the DC with Infrastructure Master Role (4:04), but then you only make sure of that after running that command and before running "adprep /domainprep /gpprep" (9:20).

Again - thanks!

[itfreetraining]

There is a play list for the course. If you sign up for YouTube, YouTube will remember which videos you have watched in the playlist.

[itfreetraining]

@Maniello We are working on some more videos for the 70-640 course. They should be on the channel soon.

[itfreetraining]

@christianrevival Your forest functional level will determine how high you can raise your domain functional level. If you lowest domain functional level is 2003 you will only be able to raise your forest functional level to 2003. Thus I guess in answer to your questions the domain functional level needs to be raised first.

[itfreetraining]

It probably does not matter where you run ADPrep. Since it makes a lot of changes to Active Directory some people prefer to run it on the server with the Infrastructure Master role.

[robertkennard]

No one has said anything about you saying "Raise Forest Level" when you were actually raising the Domain level at 5:59. It is what you said and what you were actually doing.

[gandalfm]

great, as other tutorials, and now a stupid question:Can you to highlight your videos in order, the best approach to learning
MCITP 70-640.Thanks for the effort anyway

[itfreetraining]

@msmit1993 I have put two videos responses for this video. These cover how to configure the Windows Server 2008 side and how to configure the Windows 7 side.

[Maniello]

hi, and thank a lot for your work! There are few people like you! i study for exam 70-640 and with your videos I was able to have a good basis for studies...
you have planned in the short to end the collection 70-640?

[zukini]

First of all - thank you very much for these videos, they're all really helpful!

Something confuses me: approx. between 5:40-6:10 it seems that you talk about raising the Forest Functional Level while right-clicking a domain and selecting Raise Domain Functional Level.

Also, in the video about Domain Functional Levels you raise it through the AD Users and Computers tool while here you are using the AD Domains and Trusts tool. Are they, for this operation, the same in essence?

[FastRedPonyCar]

We're wanting to add a windows server 2012 machine to our domain as a backup domain controller.  When I tried to promote it to DC, it said that the current domain is at windows 2000 level and needs to be minimum 2003.

Our current DC is exactly as you have here, server 2003 x86 OS with function level at 2000.

Would running this ad prep/forest prep on our DC make it so the x64 2012 server will properly function as our backup?

Also, would an NTbackup full system backup of the DC allow us to restore back to the original state of the server should anything with the DC promotion go haywire?  Or would a bare metal, bit by bit clone of the OS's hdd be the only thing that could restore it back to the "like it never even happened" state?

Thanks and your vids have been a tremendous help!

[haole]

When you demonstrated how to open the AD management tool, you said, "Open Active Directory Domains from the Administrative Tools under the Start Menu, then right-click the domain then select 'raise forest-fuctional level' ". But you clicked on "Raise Domain Functional level " I didn't see a "Raise Forest Functional Level" option to click on. Don't mean to get nit-picky, but is there a Raise Forest Functional Level" link/option? Didn't see it in your demo (about 5:50 into the video).Thanks.

[msmit]

I'm looking for a VPN tutorial, is this something you could do. Further keep op the good work and manny thanks for the other tutorials.

[FilipposKolovos]

Is there any way to donate to ITFreeTraining? You have done a very good work!

[zukini]

Oh, okay. Ignore I will.
Thanks again!