|
Microsoft's release of Windows Server 2003 has created lots of excitement and lots of questions. You may be asking if Windows Server 2003 is better for your environment. Once you have answered that question, you may ask: "How am I going to implement 2003 across my current network?" This brief will give you the nuts and bolts of how to prepare your Windows 2000 environment for the 2003 upgrade and point out many of the known pitfalls inherit to the process.
Documenting Client and Server Configurations for Existing Domains
This section will explain the first steps of preparing your network for the 2003 upgrade including preparing security, clients, domain controllers, and Exchange 2000.
Just a brief statement in regards to Window NT 4.0 vs. Window 2000 domain upgrades before we delve into upgrading from Windows 2000. Regardless of whether you are running NT 4.0 or 2000, Microsoft fully supports upgrades from NT 4.0 or Windows 2000 domains directory to 2003. The main difference is that upgrading from NT 4.0 requires substantial planning and training because the addition of Active Directory will be involved. If you are already running Windows 2000 domains, don't get too excited yet. The upgrade from Windows 2000 domains will be a tedious process. The good news is that overall it will be less time consuming and more transparent with the Active Directory deployment already behind you.
Security is one of the most important considerations during your upgrade. So, what is the 2003 security impact on Clients and Administrators? With Windows Server 2003 being more secure out-of-the-box than Windows 2000, down level clients and administrators will likely run into functionality issues due to stronger security settings. Here are some of the reasons why:
-Administration tools now require LDAP signing which requires Kerberos authentication.
See Microsoft KB 325465 and 811765 for more details.
-Anonymous SID translation is turned off on the Default Domain Controller Policy preventing down level (NT4 and W2K) trusting domains from browsing security principals such as user and machine accounts.
- "Everyone" group no longer includes "Anonymous Logon."
-Pre-Windows 2000 compatible group membership list additions may be required for legacy application compatibility.
Client compatibility is another area to understand and prepare for prior to your 2003 upgrade. Windows 9x, NT 4.0, Windows 2000, XP, and Windows Server 2003 can all coexist and inter-operate together on the same network with a few minor adjustments.
Domain Controller compatibility must be considered for Windows Server 2003 as well. Your best bet is to apply Windows 2000 SP4 or higher because there are some minor issues with Windows 2000 domain controllers running SP3 or prior. For example, ADPrep, a process run prior to your first upgrade, adds new permissions, objects and attributes. SP3 must be applied on Domain Controllers prior to ADPrep or apply appropriate QFEs (Quick Fix Engineering) as detailed in Q331161 in order for these changes to take effect. However, even though SP3 would appear to be sufficient, extended 2000/2003 interoperability requires SP3 + hot fix Q812499 in order to keep the File Replication Service (FRS) running smoothly. Below you will find a pre-upgrade checklist for your Windows 2000 Domain Controllers.
-And if any DCs are not functioning right you should run dcpromo/forceremoval and perform Metadata clean up using NTDSUtil
What about Exchange 2000? How is it going to be affected by the 2003 upgrade? Exchange 2000 extends the Schema in Active Directory with two non-RFC compliant attributes (Labeled URI, Secretary). The ForestPrep portion of the ADPrep process defines the very same attributes with rfc compliancy. This is not a problem for the Domain Controller that the changes are made on but when replication occurs you will see mangled ldapdisplaynames, a symptom which has the potential to affect all objects that use these attributes, namely user objects. This can be prevented beforehand or fixed afterwards if necessary.
-If Exchange 2000 is already installed prior to upgrading to Windows 2003 then you must apply the inetOrgPersonPrevent.ldf file.
-If you do not, you will need to run the inetOrgPersonFix.ldf file located on the Windows Server 2003 CD in the SupportToolsSupport.cab with LDIFDE
|
