Active Directory Migration: Take One ..
To the hospital, that is.
Work like this is never fun to undertake. Especially when you are unprepared for such a feat. And that was me, on August 12. You heard right, I've got no formal training in Active Directory. Or Windows NT. Or unix, for that matter. I've turned down training for Server 2003 because the courses that are offered I already know how to do. I know DNS. I know DHCP. OK, well, I admit, I don't know WINS. But I do know permissions. And File/Printer sharing. I also have experience with Windows Registry, Group Policy Editor, and MMC. I know what know from working the front lines, along with perhaps a certain aptitude and patience for dealing with situations like this.
Anyway, I've been itching to move along our library's upgrade to Windows Server 2003. Dealing with the SCSI failures on the file server made me want to quickly remove the interim IDE hard drive. The adaptech hostraid drivers installed themselves simply enough. Had to disable the system drives on the old controller first (Windows has this *thing* about copying files to the first hard drive on the first controller it finds, in this case Windows was finding the failing hard drives first). After that, Windows Server 2003 is reasonably straight forward. Even after the reboot and the configuration of Active Directory through the "Configure Your Server" and "Manage Your Server" wizard. I retyped all the groups that existed on the previous domain, retyped all the users. Recreated the login scripts - even found the right place to store them.
The only problem I had with DNS was for reverse DNS lookups. Their Reverse Lookup Zone Wizard does the reverse for you: the zone text for you '192.168.0.x' becomes 'in-addr.arpa.0.168.192', which has to be typed in reverse in ISC's Bind.
Once everything is said and done, I (with the help of my boss) ran around to all the client machines and either installed Active Directory Client for Windows 9x or joined to the new domain name. I thought, "Horay, we're done".
There was hell to pay the next day.
Questions like "Why can't I print?", "Where is my email?" rang from around the library as I tried to get a grip on understanding what went wrong. I was thinking like "Since all user profiles are local to that machine, why aren't the XP machines using the profiles already on the client?".
The answer, in my humble opinion (now if this all, half, or none of the correct answer please feel free to flame this journal entry by using the comment section below), Microsoft's Domain security structure greatest strength in fexibility is also it's greatest weakness when it comes changing the network/domain structure of the client computers. Those profiles are so tied to the domain security that it cannot be carried over into a new domain - atleast, not without help.
The help, as I discovered later, comes in the form of Active Directory Migration Tool. There are some tricks to get the tool to work properly, which will be covered in Take Two in this Library's network upgrade to Server 2003. To use the migration tool, however, it is imperative that the existing NT domain server be alive and well. So, I took a spare P3 machine, slapped the IDE HD that has Windows NT installed on it, re-applied NT and Service Pack 6 (had to - the hardware was not the same), and began reading "How To"'s on migrating to Server 2003. Oh jolly what fun.
Some saving graces during the 3 days I forced the library to be off line (eg no printing, no shared files, limited drive c access - Internet was OK though) was
- Library Director away that week
- NT already on IDE drive
- Had spare same-generation hardware with lots of memory
- Original NT CDROM, and service packs
- An understanding boss
So I didn't quite go to the hospital. Sure felt like hell during that time though.