Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

A Very Good Year: Page 2 of 5

Additionally, some of the features that claim to reduce customer apprehension about AD migration don't work as advertised. When rolling out Windows 2000 AD, it was sometimes impossible to reverse mistakes once AD was implemented in a production network. To alleviate customer fears, Server 2003 includes a domain-rename procedure that purportedly lets customers rename and restructure domains and correct any domain design errors. But there are problems with this workaround. Prerequisites for the domain rename procedure are unattainable, and the domain-rename process is far too complex (read more on the workaround in the sidebar, below.)

In previous versions of AD, the time required to replicate AD over slow WAN links was prohibitive and left customers with no viable option beyond building domain controllers at a central site and shipping them to the remote offices for installation. To address this problem, Microsoft created an "Install From Media" procedure. An AD database can be backed up to CD or other removable media and sent to remote sites, then used to build a domain controller--a big time-saver. This process installs the bulk of the AD database on the remote server via CD and then resynchronizes the new domain controller via the normal replication process, so there should be minimal worry about lag time between taking the snapshot and installing at the remote site.

To test Install from Media, I did a system-state backup of one of my working Windows Server 2003 machines and copied the backup file to CD. I then "shipped" the CD to a "remote site" and restored the system state from backup to a temporary directory on a local drive on the machine that I wanted to promote to domain controller. I ran DCPROMO/ADV and, at the "Copying Domain Information" page, I selected "from these restored backup files." Next I pointed to the system state that was restored to the temp directory earlier. A detailed procedure can be found by searching for "Creating additional domain controllers" on TechNet.

The Active Directory Migration Tool (ADMT) has been upgraded to address shortcomings in the Windows 2000 version. Specifically, ADMT now migrates passwords between domains and has scripting and command-line interfaces. And it's possible to develop and test migration scripts before the actual migration. These features once were only available in third-party tools.

Policy Improvements