Windows Server - windows 2008 dc and trust

Asked By 2010

17-Sep-09 01:19 PM

We are adding a windows 2008 r2 dc into a windows 2003 domain that is in a
trust with another windows 2003 domain.  WIl upgarding the active directory
to 2008 and adding new domain conroller have any affect on the trust
replationship?

17-Sep-09 03:10 PM

After you raise the forest/domain functional level to Windows Server 2008 R2
it should not affect the the trust relationship with the other domain.  For
grins, after raising the forest & domain functional level to W2K8 R2, I would
look in Active Directory Domains & Trusts just to verify the one-way or
transative or external trust already configured remains intact.

Mind you that all the domain controllers must be W2K8 R2 OS in order to
raise the forest - domain functional level to Windows Server 2008 R2.

Cheers!

mattmjf@yahoo.com

17-Sep-09 03:15 PM

We will still have 2003 DCs.  What does it mean if we do not have
forest-domain functional level to 2008 R2?  Are we basically only able to use
windows 2003 features?

17-Sep-09 03:21 PM

Howdie!

2010 schrieb:

You're able to use Server 2008R2 features on the Server 2008R2 box.

However there are features related to Active Directory (eg the
RecycleBin feature) that need to have a domain functional level of
functional restrictions Active Directory has to make sure those features
run properly.

Cheers,
Florian
--
Microsoft MVP - Group Policy
eMail: prename [at] frickelsoft [dot] net.
blog: http://www.frickelsoft.net/blog.
Maillist (german): http://frickelsoft.net/cms/index.php?page=mailingliste

17-Sep-09 03:26 PM

I would advise you upgrade the Windows Server 2003 DCs to Windows Server 2008
R2.  Once all the domain controllers are at W2K8 R2 level, then you can raise
the forest and domain functional level to W2K8 R2 taking advantage of the new
features such as AD recycle bin, granular password policies, improved group
policy processing, more forensic event logging etc. etc.

Until all your DCs are at W2K8 R2 level then you raise forest & domain level
to W2K8 R2, you are only able to use Windows Server 2003 Active Directory
features.

17-Sep-09 03:38 PM

Just a side note, I would rather install fresh, new 2008 R2 servers instead
of upgrading, especially if you want to take advantage of 64 bit versions.
The once FSMO roles have been transferred, remove the old 2003 DC. Besides,
upgrading just brings some of the old issues from the previous OS to the new
server.

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Please reply back to the newsgroup or forum for collaboration benefit among
responding engineers, and to help others benefit from your resolution.

Ace Fekay, MCT, MCTS Exchange, MCSE, MCSA 2003 & 2000, MCSA Messaging
Microsoft Certified Trainer

For urgent issues, please contact Microsoft PSS directly. Please check
http://support.microsoft.com for regional support phone numbers.

17-Sep-09 03:44 PM

According to this is looks(see link) it looks like I can use windows 2008 r2
dc with a windows 2003 sp2 dc and exchange server 2003 as long as I am in
'windows server mode 2003'?  Then when we replace our Exchange 2003 server
with 2007 and 2008 r2 dc we should be able to raise domain to 'windows 2008
r2 mode', correct?  Thanks for your help.

http://technet.microsoft.com/en-us/library/ee338574.aspx

According to

17-Sep-09 04:19 PM

Based on the Matrix, you can run Exchange 2007 in an R2 AD environment, it
must be SP2 with minimal Rollup 9.

It also states that Exchange 2007 cannot be run on 2008 R2, rather just
2008. Not sure if the matrix has been updated, or why Microsoft has not
approved it yet. It could simply be that it has not been tested yet.

As for raising domain and forest levels, you would have to make sure all DCs
are up to the latest version of any operating system before you can raise
the levels to that operating system level. Similar to when you had a mix of
Windows 2000 and 2003 DCs, you could not raise the forest of domain levels
to 2003 as long as a 2000 DC exists in the mix.

Ace

17-Sep-09 04:21 PM

Correct.  YW.

mattmjf@yahoo.com