topic Re: windows NT migration to 2003 in Windows Server 2003

windows NT migration to 2003

Chucka Eya — Mon, 10 Apr 2006 03:56:29 GMT

Hello,
we've just migrated our system to 2003 from NT, with a winxp client OS on our laptops and workstations.

The laptops pick up dhcp ip from an alternative trusted domain's dhcp.
The workstations and servers have static IPs.
The dns is being resolved by an alternative server on another domain which is trusted to ours (will be moving it soon - but that's by the way)

We have had to rebuild the laptops because they take forever to download profiles, and apply personal and computer settings.
After the rebuild, everything's fine.
The workstations though don't have this problem.

Is there a reason for this or are we doing something wrong.
I'd hate to think that if we had 100 users, that this would be the way to go, esp as we need to do the same for another site.

Thanks.

Re: windows NT migration to 2003

Chucka Eya — Mon, 10 Apr 2006 04:42:43 GMT

I should mention that our profile server is still running NT, but then the profile's okay on the workstations with static IPs.

Re: windows NT migration to 2003

Pieter 't Hart — Tue, 11 Apr 2006 02:28:51 GMT

be aware that in an NT-domain the "internet temporary files" are default part of the profile.
If these temporary files arn't limited in size ore regularly cleaned the profile may grow out of proportions.

Are these laptops also used without network connection ? that's the difference with the workstations.

when some locations (int.temp.files) in the network profile are unreachable, these locations are reset to default locations.
if again connected to the network, the temporary files are copied to the network

Pieter

Re: windows NT migration to 2003

Alan_152 — Tue, 11 Apr 2006 09:53:35 GMT

You need to get to each of your user's home directories on the network and clean them out. Same as with the local versions on each machine. You may have to make the network profile (and directories) somewhat read-only for awhile to keep the excess data transfer down.

You may also want to consider at this time standard desktops and backgrounds to limit data transfer on login and logout.

Also take a look at where the Outlook PSTs and PABs are being stored, and how big they are.

Re: windows NT migration to 2003

Gary Cooper_1 — Tue, 11 Apr 2006 10:18:39 GMT

I think all of this stuff about making your profiles lean is good stuff, but the fact that the machines with the static IP address are OK makes me think it's more a name resolution problem.

Is the profile server using the same DNS server to resolve the notebooks as it is the workstations? It's not using a hosts file for the static IP machines is it? Use nslookup and use one of the debug options to see what's happening when the profile server tries to resolve the name of a workstation and the name of a laptop.

Also use nslookup to check out how the name resolution is working on the workstations and the laptops.

You might want to check your what you've got your TTL set to on your DNS server. If it's too long, this could cause problems if the laptops are swapping IP addresses frequently. (You don't say if the DNS server and the DHCP server are the same machine).

You don't say anything about your network topography. Any slow links?

Regards,

Gary

Re: windows NT migration to 2003

Chucka Eya — Tue, 11 Apr 2006 12:24:07 GMT

Thanks for the feedback.
since I started the thread, I've come across more revealing problems, so in order to get you up to speed, see the following.

*******************************************
NB: this is an inherited network,so if the topography is confusing, welcome to my world
********************************************

we had 3 domains d1 and d2 are 2 NTs with trust.
server1 from d2 supplies Wins services.
*******************************************
d3 is a 2003 domain.
server2 supplies dhcp and dns for all three domains.
it is split this way:
domaind3 - as parent zone
domaind1 - as d1's child zone.
domaind2 - as d2's child zone.
********************************************
cause the 2003 domain was set to native mode, we performed an inplace upgrade of d1 and d2 - because none of us were familiar with nt4.0, we followed instructions and created a new dns zone for d1 and d2.
********************************************
Now d3 is housing dns and dhcp, + secondary versions of the new d1 and d2 dns records so it has all the records. - is there potential problem by doing this?
we are looking to reduce the number of zones to 2, but for now want everyone to talk to everyone.
********************************************
Anyway, laptop users and workstation users use same server for dns
********************************************
That's the long and short of it.

now:
to answer your questions:

-the profile server uses the same dns.
-no host files are involved.
-trying the different nslookup options - so far no problem.

interesting problem though:
when I ran dcdiag from the win2003 support tools - tells me all the connections are fine and beautiful
dcdiag from the SP1 which allows for testing dns connections, ends up with:

Performing initial setup:
[LONDONDC1] Directory Binding Error -2146892976:
Win32 Error -2146892976
This may limit some of the tests that can be performed.
Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\LONDONDC1
Starting test: Connectivity
[LONDONDC1] DsBindWithSpnEx() failed with error -2146892976,
Win32 Error -2146892976.
......................... LONDONDC1 failed test Connectivity
-

how can they both spill out conflicting results.

********************************************
any pointers into this would be helpful. Think I'm looking at a DS RPC problem.

Thanks.
Exhausted but still fighting :)

Re: windows NT migration to 2003

Robert S. Carr — Wed, 12 Apr 2006 02:01:35 GMT

Interesting problems you've got there Chuck. I was curious. Are the domains all in the same physical space? i.e. same building, same floor etc?

From experience, usually each domain will have it's own DNS and DHCP servers (usually on the same server). This tends to make administration a little easier and has a plus where if one domain gets in trouble, all machines are not affected. For example, if I have DHCP on 3 servers, if one dies, only those devices related to that server are affected, not the entired organization.

Anyway, regarding your problems, have you tried this:

http://support.microsoft.com/?id=839880

Good luck.

Rob

Re: windows NT migration to 2003

Gary Cooper_1 — Wed, 12 Apr 2006 02:19:01 GMT

So if I understand correctly, all three domains are Win 2K3?

Have a look at http://support.microsoft.com/?id=898060

Regards,

Gary

Re: windows NT migration to 2003

Pieter 't Hart — Wed, 12 Apr 2006 02:24:24 GMT

You should separate DNS-namespace domains with Windows logon-domains. These are seperate things.
It IS possible that, when NOT using WINS but only DNS as name-resulotion mechanism, that when trying to connect a server by its short name, connection will fail.
if the server prforming the test is server1.domain1 then for DNS, londondc1 (londondc1.domain1) is another server than the server in the root-domain (londondc1.domaind3).

Pieter

Re: windows NT migration to 2003

Chucka Eya — Thu, 13 Apr 2006 04:44:55 GMT

Thanks guys,

I'm starting to narrow down possible potential trouble spots.

The dns settings on the some servers was pointing to an old switched off one - so that resolved a few dcdiag errors.

The trusts between the domains - which weren't working properly initially cause my predecessor tried it bw nt and 2003 domains - probably need to be restablished.
Getting a lot of trust denials etc when connecting to machines - esp between laptops (dhcp enabled) and workstations (statics)

Not out of the woods yet, but the scenario is more familiar.
The dns namespaces are all okay now and every domain has secondary records of the others.

I will get back to you over the next couple of days.

Thanks for the feedback so far...

By the way: any reason why the dcdiag from 2003 support tools would be generating different results from dcdiag on sp1 (the latter is supposed to be new, but always ends up with a DS RPC failure) whatever I do.
if you've got SP1 - try it from:
c:\windows\servicepackfiles\i386\dcdiag.exe

Re: windows NT migration to 2003

Chucka Eya — Sat, 15 Apr 2006 22:06:50 GMT

well, my dns is sorted and everything's working fine now.

However, I'd like to move my dns A records between zones, so i can consolidate what we have and reduce the number of dns zones.

Apart from the manual way of deleting and creating each A pointer, is there a way to move all info on one dns server to another.

nf

Re: windows NT migration to 2003

Pieter 't Hart — Tue, 18 Apr 2006 03:05:53 GMT

if you have w2k3 based DNS then it's "dynamic".
so when configuring a server's network properties all you have to do is fill in it's domain suffix!
The server itself should register itself in the right namespace.
again DNS-namespace is a separate thing from windows logon-domain.

again this is related to authentication so if the previous A-records are not registrerd by the server itself it may be denied to overwrite the info.
If this is so it can be seen bij looking at the properties of the DNS-record (owner should be the computeraccount)

if the computer itself is not the owner of it's A-record you can either
- manually delete the A-records.
- at the DNS zone properties you can temporarily alow "dynamic updates" as "nonsecure and secure" this will allow records to be overwritten by someone else but the owner.

next
- type ipconig/registerdns
- or click repair in the network-connection properties
- or reboot the server.

Pieter

Re: windows NT migration to 2003

Chucka Eya — Tue, 18 Apr 2006 05:21:00 GMT

Thanks Pieter,

That makes sense and I believe everything's working fine with dns entries replicated across all three domains.
However, I want to rid myself of the dns zones and limit to just 2.
That means moving the A-records from one domain name space to another..
ie.
moving A-records from zzzz.com to xxxx.com
That would mean an A-record:
dice.soft.com
moves to
dice.hard.com

can this be done automatically? or am I doomed to manual entries.

I know its easier to transfer only the zones - just curious as I want to leave the current zone names (and client suffixes) we currently use.

Thanks

Re: windows NT migration to 2003

Pieter 't Hart — Tue, 18 Apr 2006 05:39:03 GMT

As i said before when reconfiguring the server's domain suffix (at the server) from dice.soft.com to dice.hard.com the server itself should be able to remove the old A-record from dice.soft.com and register the new a-record in dice.hard.com.

manually adding A-records should just prevent this (the server is not owner of this a-record).

NB! whan you do add A-records and the server configuration is not altered it will again register itself under its original domain-suffix so you would never get rid of the old domain.

as for the workstations, you probably have to change/add the DHCP-server option "015 DNS domain name".

Pieter

Re: windows NT migration to 2003

Pieter 't Hart — Tue, 18 Apr 2006 05:44:49 GMT

my previous post was focused just on DNS-configuration, but maybe what you really want is to change the dns-name of the windows root-domain.
try this article
http://technet2.microsoft.com/WindowsServer/en/Library/996741d8-28e4-4d20-9949-8f17fb9d3cfd1033.mspx

Pieter

Re: windows NT migration to 2003

Chucka Eya — Tue, 18 Apr 2006 06:32:49 GMT

okay.
I understand everything you're saying, but maybe we're not saying the same things, so I'll simplify...

you have two domains A & B.
A trusts B
A & B use dns server in B.

A gets a new dns. you want to replicate the records in B in A as well.

You add B's dns as a secondary dns for A and verse versa.

Problem solved.

I want to move B's records to A under A's zone name because obviously they are 2 diff zone names.

I can change the suffixes and dns server entry on the workstations & member servers & they will begin to appear gradually.
problem solved.

question is: can I move the records from B to A with A's zone name, on the dns servers automatically.

I think your answer is referring to one dns server handling everything.

if your previous answer compliments this seanrio - just say it does - and I'll look at it again. I understand what you've said but I can't relate it a 100% to my scenario.

Sorry about this.

Re: windows NT migration to 2003

Pieter 't Hart — Tue, 18 Apr 2006 07:27:14 GMT

As i stated earlier you should make the change at the server. if the server is configured as server.dom1.com it will not register as server.dom2.com

i advise not to use a-records for the same host in different namespaces.
what you might do is add an alias (cname-record) so for a server with an a-record in dom1.com, there is an corresponding cname-record in dom2.com.
Microsoft has in de w2k3 support tools a "dnscmd" commandline utility with wich you can create a list with all A-records in dom1.com, and subsequently edit this file to add all cname-records to dom2.com.

http://technet2.microsoft.com/WindowsServer/en/Library/cee759b0-7a2a-4ba7-904e-ff399814b1711033.mspx

but then again you do still have to keep the old zone active.

Re: windows NT migration to 2003

Chucka Eya — Thu, 20 Apr 2006 13:11:45 GMT

dns is okay, Its running fine for now. I am leaving it as is and will run a few more tests, after which I can close this thread.

watch this space.

Thanks for your help so far.

Re: windows NT migration to 2003

Chucka Eya — Thu, 20 Apr 2006 16:47:44 GMT

Okay,
Strange problem, I've just noticed that nobody can actually change their passwords on the domain including myself.
when anybody tries it, it generates the following message:

"your password must be at least 3 xters, cannot repeat any of your presious 1 password and must be at least 30 years old. please type a different password which meets this requirements in both text boxes"

I haven't defined password policies on AD yet?

Any ideas?

Re: windows NT migration to 2003

Alan_152 — Thu, 20 Apr 2006 17:01:40 GMT

That's the default password policy...