Inside Windows Server 1002003 [Electronic resources] نسخه متنی

Chapter 9. Deploying Windows Server 2003 Domains

T

HE

TIME FOR TALK IS OVER . You've assayed the alternatives, written the reports, drawn the drawings, met the meetings, consumed carloads of coffee, parlayed plans, fought fights, arrived at agreements, and now you're ready to do the deed and deploy an Active Directory domain. This chapter covers the following scenarios:

• Upgrading a classic NT4 domain to Windows Server 2003




• Upgrading a Windows 2000 domain to Windows Server 2003




• Migrating from an NT4 or Windows 2000 domain to a Windows Server 2003 domain

In general, organizations make the decision to migrate rather than upgrade when they want to change the structure of their domains during the cutover. The most common circumstances are the following:

• Domain name changes .
  When you do a direct upgrade, you must retain the original NetBIOS flat name as the leftmost element of the new Domain Naming System (DNS) name, such as BRANCH becoming Branch.Company.com. Otherwise, you must create a new Windows Server 2003 domain with a new flat name and migrate your users and groups and computers to that new domain.




• Collapsing account domains .
  If you currently have a multiple-master domain configuration and you want to end up with a single Active Directory domain, your best course of action is migrate the contents of the various NT domains into a new Windows Server 2003 domain.




• Collapsing resource domains .
  Ordinarily, resource domains contain just computer accounts, not users and groups. Migrating these computers out of the NT resource domain into a new Windows Server 2003 domain is not simply a matter of changing the domain affiliation, though. You need to make sure that access permissions assigned to resources are preserved, along with user profiles and other critical structures.




• Restructuring Windows 2000 domains.
  The new Forest trust feature in Windows Server 2003 gives additional flexibility to inter-forest resource sharing. This may encourage your organization to redefine your domain plans to create separate forests rather than separate domains within the same forest. This could happen if you plan on dividing the business in the near future.

Of these reasons, the one that most often causes administrators to retool their cutover strategy is the need to change domain names. Many organizations have a DNS infrastructure with naming conventions that do not accommodate the exiting NT domain names.

For example, the administrators in a university might want to use the existing DNS root name, University.edu, as the Active Directory root domain with child domain names such as Undergrad.University.edu, Grad.University.edu, Law.University.edu, and so forth. If the resultant flat names, UNDERGRAD and GRAD and LAW, do not correspond to existing NT domain names, the administrators will be forced to create new Windows Server 2003 domains and migrate users from the existing NT domains.

This chapter describes several upgrade and migration roadmaps designed with these key elements in mind:

• Keeping user accounts intact




• Maintaining appropriate access to network resources




• Minimizing disruption of user activities




• Obtaining a viable management hierarchy for domain and forest-related objects and processes