1. Identify the domain controller that holds the schema operations master role (also known as flexible single master operations or FSMO role) and verify that it has inbound-replicated the schema partition since startup:
   
   
   1. Run the dcdiag /test:knowsofroleholders command. If the schema role is assigned to a domain controller with a deleted NTDS settings object, follow the steps in article 255504 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkID=70776) to seize the role to a live domain controller in the forest root domain.
      
      
   2. Log on to the schema operations master with an account that has Enterprise Admins, Schema Admins, and Domain Admins credentials in the forest root domain. By default, the built-in administrator account in a forest root domain has these credentials.
      
      
   3. On the schema master, run the repadmin /showreps command. If schema master has inbound-replicated the schema partition since startup, continue to the next step. Otherwise, use the replicate now command Dssite.msc to trigger inbound replication of the schema partition to the schema master. (See Force replication over a connection (http://go.microsoft.com/fwlink/?LinkId=164634)). You can also use the repadmin /replicate <name of schema master> <GUID of replication partner> command. The showreps command returns the globally unique identifier (GUID) of all replication partners of the schema master.
      
      
2. Locate the correct version of Adprep for your upgrade:
   
   
   • The Windows Server 2008 installation media contain one version of adprep, Adprep.exe, in the \sources\adprep folder Windows Server 2008 installation disk, that runs on both x86-based and x64-based operations masters.
     
     
   • Windows Server 2008 R2 installation media contain both x86-based (Adprep32.exe) and x64-based (Adprep.exe) versions of adprep in the \support\adprep folder of the Windows Server 2008 R2 installation disk.
     
     
   • Windows Server 2008 and Windows Server 2008 R2 schema updates can be added directly to forests with Windows 2000 Server, Windows Server 2003, or Windows Server 2008 schema versions.
     
     
   • Windows Server 2008 and Windows Server 2008 R2 versions of adprep.exe can be run directly on Windows Server 2000 SP4, Windows Server 2003, Windows Server 2003 R2, and Windows Server 2008 (for Windows Server 2008 R2) operations masters.
     
     
   • If you copy Adprep.exe from the installation media to a local computer or a network share, copy the entire adprep folder and provide the full path to the Adprep.exe file.
     
     
3. Update the forest schema with adprep /forestprep.
   
   While you are still logged on to the console of the schema master with an account that has Enterprise Admins, Schema Admin, and Domain Admin credentials, run the appropriate version of adprep /forestprep from the Windows Server 2008 or Windows Server 2008 R2 installation media. Specify the full path to Adprep.exe to prevent running another version of Adprep that may be present in the PATH environment variable.
   
   For example, if you are running the Windows Server 2008 version of Adprep from a DVD drive or network path that is assigned the drive letter D:, the command to run is as follows:
   
   
   >D:\sources\adprep\adprep /forestprep

   The syntax for running Windows Server 2008 R2 Adprep on a 64-bit schema master is as follows:
   
   
   <dvd drive letter>:\support\adprep\adprep /forestprep

   The syntax for running Windows Server 2008 R2 Adprep on a 32-bit, x86-based schema master is as follows:
   
   
   D:\support\adprep\adprep32 /forestprep

   For a list of operations that Windows Server 2008 adprep /forestprep performs, see Windows Server 2008: Forest-Wide Updates (http://go.microsoft.com/fwlink/?LinkId=164636).
   
   For a list of operations that Windows Server 2008 R2 adprep /forestprep performs , see Windows Server 2008 R2: Forest-Wide Updates (http://go.microsoft.com/fwlink/?LinkId=164637).
   
   

If you encounter errors, see “Forestprep errors” later in this topic.

Run Windows Server 2008 R2 adprep /rodcprep in a forest that has already been prepared with Windows Server 2008adprep /rodcprep. Proceed to adprep /domainprepprep.

If you are deploying RODCs for the first time:

While still logged on with Enterprise Admins credentials on the schema master, run adprep /rodcprep.

Note
Rodcprep will run on any member computer or domain controller in the forest if you are logged on with Enterprise Admin credentials. You can run adprep /rodcprep before or after adprep /domainprep. We recommend running adprep /rodcprep on the schema master immediately after adprep /forestprep as a matter of convenience because that operation also requires Enterprise Admins credentials.

For Windows Server 2008 Rodcprep, specify the full path to Adprep. For example, if the DVD or network path is assigned drive D:, run the following command:

c:\windows >D:\sources\adprep\adprep /rodcprep

For Windows Server 2008 R2:

1. If the computer where you run Rodcprep is a 64-bit computer, run the following command:
   
   
   D:\support\adprep\adprep /rodcprep

2. If the computer where you run Rodcprep is a 32-bit computer, run the following command:
   
   
   D:\support\adprep\adprep32 /rodcprep

If you encounter errors, see “Rodcprep errors” later in this topic.

For each domain that you intend to add Windows Server 2008 or Windows Server 2008 R2 domain controllers to:

1. Run netdom query fsmo or dcdiag /test:<name of FSMO test> to identify the infrastructure operations master.
   
   
2. If operations master roles are assigned to deleted or offline domain controllers, transfer or seize the roles as required.
   
   
3. Log on to the infrastructure master with an account that has Domain Admins credentials.
   
   
4. Run Windows Server 2008 adprep /domainprep /gpprep from the Windows Server 2008 operating system disk using the following syntax:
   
   

   Note
   You do not have to add the /gpprep parameter in the following command if you already ran it for Windows Server 2003.

   <drive>:\<path>\adprep /domainprep /gpprep

   For example, if the DVD or network path is assigned drive D, use the following syntax:
   
   
   D:\sources\adprep\adprep /domainprep /gpprep

   For Windows Server 2008 R2:
   
   If the infrastructure master is 64-bit, use the following syntax:
   
   
   D:\support\adprep\adprep /domainprep /gpprep

   If the infrastructure master is 32-bit, use the following syntax:
   
   
   D:\support\adprep\adprep32 /domainprep /gpprep

   If you encounter errors, see “Domainprep errors” later in this topic
   
   

When you upgrade existing domain controllers or promote new domain controllers into existing domains, consider the following:

• Computers running Windows 2000 Server cannot be upgraded in place to Windows Server 2008 or Windows Server 2008 R2.
  
  
• In-place upgrades from Windows Server 2003 or Windows Server 2003 R2 to Windows Server 2008 or Windows Server 2008 R2 are supported, with the following exception: x86-based operating systems cannot be upgraded in place to x64-based versions of Windows Server 2008 or Windows Server 2008 R2 (which supports only the x64-based architecture).
  
  
• A writeable domain controller cannot be upgraded to be an RODC. The reverse is also true.
  
  
• A server that runs the full installation of Windows Server 2008 R2 cannot be upgraded to be a server that runs a Server Core installation of Windows Server 2008 R2. The reverse is also true.
  
  
• For more information about supported and unsupported upgrades, see Windows Server 2008 R2 Upgrade Paths (http://go.microsoft.com/fwlink/?LinkID=154894).
  
  
• Windows Server 2008 and Windows Server 2008 R2 both auto-install Internet Protocol version 6 (IPv6). Do not arbitrarily disable or remove IPv6.
  
  
• To promote RODCs:
  
  
  • The adprep[32] /rodcprep command must have completed successfully.
    
    
  • The forest functional level must be Windows Server 2003 or higher.
    
    
  • A writable (or “full”) domain controller that runs Windows Server 2008 or Windows Server 2008 R2 must exist in the target domain.
    
    

Complete the following steps if you are performing either of these in-place upgrades:

• Upgrading to Windows Server 2008 or Windows Server 2008 R2 from Windows Server 2003 domain controllers
  
  
• Upgrading to Windows Server 2008 R2 from Windows Server 2008 or Windows Server 2003 or domain controllers
  
  

1. If you have the Japanese language locale installed on Windows Server 2003 domain controllers that are being upgraded in place to Windows Server 2008, read and comply with article 949189 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkID=164588).
   
   
2. If the Active Directory Migration Tool (ADMT) version 3.1 is installed on a Windows Server 2003 or Windows Server 2008 domain controller that is being upgraded to Windows Server 2008 R2, uninstall ADMT 3.1 before the upgrade.
   
   
3. When promoting new domain controllers, make sure that object information about the newly promoted domain controllers (the computer account in the domain partition and the NTDS Settings object in the configuration partition) has outbound replicated to a sufficient number of domain controllers that are remaining in the forest before you retire the only domain controller in the forest that has that object information. For example, if you promote DC2 and use DC1 as the helper domain controller, then make sure that DC1 has outbound replicated object information about DC2 to other domain controllers before you retire DC1. This is particularly an issue where the helper domain controllers used by newly promoted domain controllers are rapidly demoted before outbound reapplication takes place.
   
   
4. Run <dvd or network path>:\setup.exe.
   
   
5. Read article 942564 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkID=164558) and consider the right setting for the AllowNT4Cryto policy for your environment.
   
   
6. If dcpromo.exe fails, see Dcpromo errors.
   
   
7. If you have remotely encrypted Encrypting File System (EFS) files on Windows Server 2003 computers that are being upgraded in place to Windows Server 2008, read and comply with article 948690 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkID=106115). This problem does not apply to domain controllers that are upgraded to Windows Server 2008 R2.
   
   
8. Consider installing the following fixes after the in-place upgrade unless they are integrated into your installation media:
   
   
   • If you are installing Windows Server 2008, install Service Pack 2 (SP2). Windows Server 2008 R2 includes Windows Server 2008 SP2 fixes.
     
     
   • If you are using Group Policy Preferences on Windows Vista or Windows Server 2008 computers, download the July 2009 update to article 943729 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkID=164591).
     
     
   • Download the fix for a GPMC filter bug in article 949360 in the Microsoft Knowledge Base.
     
     
   • If you use devolution (as opposed to suffix search lists) to resolve DNS queries for single-label and non-fully-qualified DNS names, download the DNS devolution fix. See article 957579 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkId=166140).
     
     

Complete the following steps if you are performing an in-place upgrade of Windows Server 2008 or Windows Server 2008 R2 writable domain controllers into existing Windows 2000 Server, Windows Server 2003 or Windows Server 2008 domains:

1. Verify that the target domain is at the Windows 2000 native domain functional level or higher.
   
   
2. If you are promoting Windows Server 2008 domain controllers that are configured to use the Japanese language, read and comply with article 949189 in the Microsoft Knowledge base (http://go.microsoft.com/fwlink/?LinkID=164588). The hotfix should be installed immediately after promotion and before the first boot into normal mode.
   
   
3. From the Windows Start menu, run Dcpromo.exe (or install the Active Directory Domain Services Role in Server Manager, and then run Dcpromo).
   
   
4. When the AllowNT4Crytpo page appears, read article 942564 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkID=164558) consider the right setting for AllowNT4Cryto for your environment.
   
   
5. If you encounter an error, see the list of Dcpromo errors at the end of this topic.
   
   

Do the following if you are performing an in-place upgrade of Windows Server 2008 RODCs into existing Windows Server 2003 domains, Windows Server 2008 domains, or domains that have a mix of those operating systems:

1. If the option to install RODC is not available in Dcpromo, verify that the forest functional level is Windows Server 2003 or higher.
   
   
2. If the option to install RODC is not available and the error message indicates that there is no Windows Server 2008 in the domain, verify that a Windows Server 2008 domain controller exists in the domain and that it is accessible on the network to the RODC that you are promoting.
   
   
3. If an error message indicates that access is denied, see the Microsoft Knowledge Base.
   
   

For all domain controllers:

• Configure the forest root PDC with an external time source. For more information, see Configure the forest root PDC with an external time source (http://go.microsoft.com/fwlink/?LinkId=91969).
  
  
• Enable delete protection on organizational units (OUs) and other strategic containers to prevent accidental deletions.
  
  
• Use only Active Directory–aware backup applications to restore domain controllers or roll back the contents of AD DS. Restoring snapshots that were created by imaging software is not supported on domain controllers.
  
  

After installation of AD DS, install the following hotfixes.

Note
It is impossible to provide an exhaustive list of hotfixes. The following is a list of fixes that are available in October 2009.

For RODCs:

• If you are deploying RODCs, install the hotfix in article 953392 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkID=150337) on all Windows Server 2008 writable domain controllers. This fix is not required on Windows Server 2008 R2 writable domain controllers.
  
  
• Read article 944043 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkID=122974), and install the corrective fixes on the Windows client and server computers that are affected by the scenarios that are listed in the Knowledge Base article.
  
  

These sections describe errors for the forestprep, domainprep, and rodcprep commands.

Forestprep errors

Domainprep errors

Rodcprep errors

1. If the upgrade rolls back without any onscreen error or recorded error in a debug log, verify that you have sufficient free disk space on the volumes that are hosting %systemdrive, Ntds.dit, and SYSVOL.
   
   
2. If an error message says "To install a domain controller into this Active Directory forest, you must first prepare the forest using ""adprep /forestprep""… ", verify that /forestprep has been run and that the helper domain controller has inbound-replicated /forestprep changes. For more information, see Running adprep.exe (http://go.microsoft.com/fwlink/?LinkID=142597).
   
   
3. If an error message says "To install a domain controller into this Active Directory domain, you must first prepare the forest using ""adprep /domainprep""…” and verify that /domainprep has been run and that the helper domain controller has inbound-replicated /domainprep changes. For more information, see Running adprep.exe (http://go.microsoft.com/fwlink/?LinkID=142597).
   
   
4. If an error message says “the specified user already exists,” delete the stale machine account and verify that the helper domain controller has inbound-replicated that deletion. As an alternative, try another helper domain controller.
   
   
5. If an error message says “You cannot install an additional domain controller at this time because the RID master <domain controller name> is offline.” or “You will not be able to install a writable domain controller at this time because the RID master <domain controller name> is offline. Do you want to continue?”, see the Microsoft Knowledge Base.
   
   
6. If a warning indicates that there is no static IP address configured for an IPv6 address on a Windows Server 2008 domain controller, click Yes and complete the wizard.
   
   
7. If the check box for installing the DNS Server role is unavailable, either the Active Directory domain has a single-label DNS name or Dcpromo.exe cannot discover another Microsoft DNS server in the domain.
   
   
8. If you see the error message “A delegation for this DNS Server cannot be created because the authoritative parent zone cannot be found…,” see Known Issues for Installing and Removing AD DS (http://go.microsoft.com/fwlink/?LinkId=164418).
   
   
9. If you see the error message “The DNS zone could not be created...," see the Microsoft Knowledge Base.
   
   
10. If you see the logging event <unable to obtain local RID pool>, see the Microsoft Knowledge Base.
    
    
11. If the system is unable to share SYSVOL, see the Microsoft Knowledge Base.
    
    
12. If Dcpromo fails with an error message that says “Failed to modify the necessary properties for the machine account. Access is denied”, make sure that administrators are granted the Enable computer and user accounts to be trusted for delegation permission in Default Domain Controllers Policy and that the policy has been linked to the Domain Controllers OU. Also make sure that the helper domain controller’s machine account resides in the Domain Controllers OU and that it has successfully applied policy. For more information, see article 232070 in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkId=166198).