• The location for Adprep.exe is different in Windows Server 2008 and Windows Server 2008 R2. You must run Adprep.exe before you can add a domain controller that runs Windows Server 2008 or Windows Server 2008 R2 to an existing Windows 2000 Server or Windows Server 2003 Active Directory environment. In Windows Server 2008, Adprep.exe is located in the /Sources/adprep folder of the operating system installation disk. In Windows Server 2008 R2, Adprep.exe is located in the /Support/adprep folder. Windows Server 2008 R2 includes a 32-bit and 64-bit version of Adprep.exe. The 64-bit version runs by default. If you want to run one of the Adprep.exe commands on a 32-bit computer, you must use the 32-bit version of Adprep.exe.
  
  
• The adprep /rodcprep command can log an error if the infrastructure operations master for an application directory partition is not available when you run the command. The error indicates the name of the application directory partition whose infrastructure operations master role is not available. For more information about how to fix this issue, see article 949257 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkId=114419). This issue affects the adprep /rodcprep command in Windows Server 2008 and Windows Server 2008 R2. However, if you have already run the adprep /rodcprep command for Windows Server 2008, you do not have to run it again for Windows Server 2008 R2.
  
  
• If you have not run the adprep /rodcprep command, Dcdiag.exe returns an error when it runs the NCSecDesc test. This test checks that the security descriptors on the naming context heads have appropriate permissions for replication. The error indicates that the Enterprise Domain Controllers group does not have Replicating Directory Changes In Filtered Set access rights for the DNS application directory partitions. If you do not plan to add an RODC to the forest, you can disregard this error. If you plan to add an RODC to the forest, you must run adprep /rodcprep. For adprep /rodcprep, you can run the version of Adprep.exe that appears in either Windows Server 2008 or Windows Server 2008 R2 because that parameter performs the same set of operations in each version. For more information about running adprep /rodcprep, see Prepare a Forest for a Read-Only Domain Controller.
  
  
• When you run adprep /forestprep for Windows Server 2008 R2, Windows 2000 domain controllers that are configured as global catalog servers perform a full synchronization of their partial domain replicas. This occurs because the /forestprep operation modifies the global catalog's partial attribute set (PAS). A reduction in the performance of Windows 2000 domain controllers is possible during the rebuild process. This is expected behavior for Windows 2000 domain controllers only; later versions of Windows Server add the additional attributes incrementally. To avoid the full synchronization, upgrade the Windows 2000 domain controllers to Windows Server 2003. Demoting the Windows 2000 domain controllers is also possible, but this action requires sufficient planning to ensure that no service outages are experienced.
  
  
• If you run Adprep.exe or Adprep32.exe on a non-English version of Windows, the status and progress information does not appear.
  
  

• When you install a new Windows Server 2008 or Windows Server 2008 R2 domain controller with DNS server into a domain such as treyresearch5.net, you might encounter the following error:
  
  A delegation for this DNS server cannot be created because the authoritative parent zone cannot be found or it does not run Windows DNS server. If you are integrating with an existing DNS infrastructure, you should manually create a delegation to this DNS server in the parent zone to ensure reliable name resolution from outside the domain “treyresearch5.net”. Otherwise, no action is required.
  
  
  
  If you are not concerned that people in other domains or on the Internet will not resolve DNS name queries for computer names in the local domain, you can disregard the message and click Yes.
  
  The error occurs when:
  
  
  • The Active Directory Domain Services Installation Wizard (Dcpromo.exe) has been configured to install the DNS server role.
    
    -and-
    
    Enough delegations do not already exist between DNS servers in the immediate parent DNS zone and the subdomain where you are installing the new domain controller.
    
    -and-
    
    The domain controller you are installing is unable to create a delegation to the DNS subdomain on a DNS server that is authoritative for the parent zone.
    
    
  Dcpromo.exe tries to create the delegation to ensure that computers in other domains can resolve DNS queries for hosts, including domain controllers and member computers, in the DNS subdomain.
  
  Dcpromo.exe can auto-create such delegations only on Microsoft DNS servers and will always fail if the parent DNS domain zone resides on third party DNS servers such as BIND.
  
  You can see this error when you install domain controllers in forest root domains with two or three-part names (such as contoso.com or corp.contoso.com) that are immediately subordinate to top-level domains on the internet such as .COM, GOV, .BIZ, .EDU or two-letter country code domains such as .NZ and .AU.
  
  If your Active Directory domain was to be registered on the Internet by the time it was promoted, the logging of this warning text may indicate that your ISP or DNS hosting provider has not yet created the necessary delegation to your Active Directory subdomain.
  
  Administrators may also encounter this error when creating domain controllers in a forest root domain that is subordinate to an existing corporate intranet namespace. For example, if the internal domain contoso.com is owned by BIND DNS Servers, this error will be encountered when Dcpromo.exe attempts to create the delegation from contoso.com to the Active Directory forest root domain corp.contoso.com subdomain.
  
  In order for Dcpromo.exe to create the delegation on authoritative DNS servers in the parent domain:
  
  
  1. The parent DNS server must run the Microsoft DNS Server service.
     
     
  2. The Microsoft DNS server in the parent domain must be online and accessible over the network from the domain controller you are installing.
     
     
  3. The user running Dcpromo.exe on the domain controller that you are installing must have Domain Admins, Enterprise Admins, or DNS Admin credentials in the parent DNS zone.
     
     
  Given that many Active Directory domains are not registered with an Internet registrar, and that the DNS servers for top level domains (TLDs) run BIND, this error message can safely be ignored by clicking Yes to continue the promotion.
  
  Where delegations should exist between the parent domain and the subdomain being promoted, they can be created and validated before or after the Dcpromo.exe promotion. There is no reason to delay the promotion of a new domain controller presenting this error.
  
  To avoid this error message in future Dcpromo.exe promotions, either:
  
  
  1. Pre-create the delegation on third-party DNS Servers in the immediate parent domain.
     
     
  2. Make sure that domain controllers that are being promoted have network connectivity and the necessary administrative credentials to create delegations on Microsoft DNS servers that host the parent DNS zone.
     
     
  Alternatively, specify the /CreateDNSDelegation:No argument in the Dcpromo.exe command line or answer file.
  
  For more information about delegation, see Understanding Zone Delegation (http://go.microsoft.com/fwlink/?LinkId=164773). If zone delegation is not possible in your situation, you might consider other methods for providing name resolution from other domains to the hosts in your domain. For example, the DNS administrator of another domain could configure conditional forwarding, stub-zones, or secondary zones in order to resolve names in your domain. For more information, see the following topics:
  
  
  • Understanding zone types (http://go.microsoft.com/fwlink/?LinkID=157399)
    
    
  • Understanding stub zones (http://go.microsoft.com/fwlink/?LinkId=164776)
    
    
  • Understanding forwarders (http://go.microsoft.com/fwlink/?LinkId=164778)
    
    
• If you cancel the Active Directory Domain Services Installation Wizard, the wizard closes, but the AD DS binary files are not removed.
  
  If you want to uninstall the binary files, use Server Manager to uninstall the AD DS role or run dcpromo /uninstallBinaries at a command line, and then restart the computer. This applies to Windows Server 2008 or Windows Server 2008 R2.
  
  

• Disk space requirements for upgrading to Windows Server 2008
  
  
• Disk space requirements for upgrading to Windows Server 2008 R2
  
  
• SYSVOL location on an RODC
  
  
• AD DS installation failure if SYSVOL is located at the root of a drive
  
  
• A Stop error occurs if Active Directory database and log files are located in the root of a directory of a disk that does not contain %systemroot%
  
  
• AD DS installation can fail if directory components or operating system files are placed on advanced drive types such as iSCSI devices
  
  

• Servers that run Windows Server 2008 or Windows Server 2008 R2 have a change to the default startup type for the Computer Browser service. The default startup type is changed to Disabled. In previous versions of Windows Server, the default startup type was Automatic. The change in default startup type was made so that anonymous access is no longer allowed, which helps improve the default security of a new server installation.
  
  However, applications and services that depend on the Computer Browser service to be running can be adversely affected. For example, Remote Desktop can rely on the Computer Browser service to locate remote computers.
  
  Because the default startup type is changed, as you retire domain controllers that run Windows Server 2000 and Windows Serer 2003 and add domain controllers that run Windows Server 2008 or Windows Server 2008 R2, you might be inadvertently dismantling the Computer Browser service infrastructure.
  
  If you need the Computer Browser service—for example, for application or service support—create a policy that changes the startup type for Computer Browser from Disabled to Automatic.
  
  
• An additional domain controller that is running Windows Server 2008 and that has the Japanese language locale installed does not receive updates to some attributes on an object during inbound replication. There are steps that you can take to prevent this issue from occurring and steps that you can take to recover if the issue has already occurred. For more information, see article 949189 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkId=114418). This issue does not affect domain controllers that run Windows Server 2008 R2.
  
  
• If you are upgrading a domain controller that runs Windows Server 2003 to Windows Server 2008 or Windows Server 2008 R2, some error event messages for the Netlogon service and the Windows Time service are logged by design and you can safely disregard them.
  
  In the System log in Event Viewer, Event ID 5706 for the Netlogon service is logged because the SYSVOL directory is moved at the end of the upgrade process. This avoids replication during the upgrade. Event ID 46 for Windows Time service indicates a failure to start because the Netlogon service is not started. After the last reboot of the upgrade process, the SYSVOL directory is already moved and the Netlogon service and the Windows Time service start successfully.
  
  
• Clients that support only the Data Encryption Standard (DES) will not be able to establish a secure channel with Netlogon on domain controllers that run Windows Server 2008 or Windows Server 2008 R2. As a result, unsecure domain join operations will fail, including operations that are performed by Windows Deployment Services and the Active Directory Migration Tool (ADMT). In addition, non-Microsoft Server Message Block (SMB) and network-attached storage (NAS) devices that do not support MD5 will also fail to establish a secure channel.
  
  To avoid this, upgrade all client computers and domain controllers to Windows 2000 or later. Contact the vendor of any non-Microsoft SMB and NAS devices to obtain a version that supports MD5.
  
  If you must support DES, enable support for Windows NT 4.0 cryptography. Open the Group Policy Management snap-in, click Computer Configuration, click Administrative Templates, click System, and then click Netlogon. Right-click Allow cryptography algorithms compatible with Windows NT 4.0, click Properties, click Enabled, and then click OK.
  
  For more information about similar errors that can occur if older cryptography methods are used to communicate with domain controllers that run Windows Server 2008 or Windows Server 2008 R2, see article 942564 (http://go.microsoft.com/fwlink/?LinkId=198011) in the Microsoft Knowledge base.
  
  
• If the domain naming master operations master role is hosted on a domain controller that runs Windows 2000 Server, the msDS-BehaviorVersion attribute is not stamped on the crossRef object when you create a new Windows Server 2008 or Windows Server 2008 R2 child domain or domain tree. This might lead to some application compatibility problems. In particular, replication tests that you can perform with Dcdiag.exe will fail. To avoid this problem, transfer the domain naming master role to a domain controller that runs Windows Server 2003, Windows Server 2008, or Windows Server 2008 R2 before you create the new child domain or new tree root.
  
  

In Windows 2000 and Windows Server 2003, the Active Directory performance counters are single-instance and located under NTDS. Also, in Windows Server 2003, the Active Directory Application Mode (ADAM) performance counters were multi-instance and located under ADAM. In Windows Server 2008 and Windows Server 2008 R2, performance counters for both AD DS and Active Directory Lightweight Directory Services (AD LDS) are located under those same locations and also under DirectoryServices, which is multi-instance. The AD DS performance counters are under the NTDS instance, while the AD LDS performance counters are located under the instance that corresponds to the AD LDS service name (the same as they were in Windows Server 2003).

For example, on a computer running Windows Server 2003 with Active Directory installed and two ADAM services named ADAM_instance1 and ADAM_instance2, the following names appear under Instances of selected object in Performance Monitor (where the square brackets indicate the names shown):

• NTDS
  
  
• ADAM [ADAM_instance1]
  
  
• ADAM [ADAM_instance2]
  
  

On a computer running Windows Server 2008 or Windows Server 2008 R2, the following names appear:

• NTDS
  
  
• DirectoryServices [NTDS]
  
  
• DirectoryServices [ADAM_instance1]
  
  
• DirectoryServices [ADAM_instance2]
  
  

On a computer running Windows Server 2003 that has only Active Directory installed, the following name appears:

• NTDS
  
  

On a computer running Windows Server 2008 or Windows Server 2008 R2 that has only AD DS installed, the following name appears:

• NTDS
  
  
• DirectoryServices [NTDS]
  
  

On a computer running Windows Server 2008 or Windows Server 2008 R2 that has only AD LDS instances named ADAM_instance1 and ADAM_instance2 installed, the following name appears:

• DirectoryServices [ADAM_instance1]
  
  
• DirectoryServices [ADAM_instance2]
  
  

The counters in the NTDS block are an exact copy of those in the DirectoryServices [NTDS] block. In the future, applications should start to use the DirectoryServices [NTDS] counters. The NTDS block is simply for backwards compatibility and may not continue to exist in future versions of Windows.