Raise the functional level of the Active Directory domain and forest to prepare for Windows SBS 2008 migration

  • Article

Updated: January 22, 2009

Applies To: Windows SBS 2008

When Windows SBS 2003 is installed on a server, the functional level of the AD DS domain and forest is set to Microsoft Windows 2000. In order to finish the migration successfully, you must raise the level of the domain and forest to Windows Server 2003.

Important

If you have domain controllers that are running the Windows NT® 4.0 operating system or earlier, or Windows 2000 Server, you must demote them before you can raise the domain functional level to Windows Server 2003. Also, after you raise the domain functional level to Windows Server 2003, you cannot change it back to Windows 2000 mixed mode or to Windows 2000 native mode

Important

You must be a member of either the Domain Admins group in the domain for which you want to raise functionality or the Enterprise Admins group in Active Directory Domain Services (AD DS), or you must be delegated the appropriate authority. As a security best practice, you should use Run as to perform this procedure.

To raise the functional level of the domain

  1. On the Source Server, click Start, point to Administrative Tools, and then click Active Directory Domains and Trust.

  2. In the console pane, right-click the domain for which you want to raise the functional level, and then click Raise Domain Functional Level.

Note

The current domain functional level is displayed in Current domain functional level, in the Raise Domain Functional Level dialog box.

  1. In Select an available domain functional level, click Windows Server 2003, click Raise, and then click OK in the warning dialog box.

To raise the functional level of the forest

  1. On the Source Server, click Start, point to Administrative Tools, and then click Active Directory Domains and Trust.

  2. In the console pane, right-click Active Directory Domains and Trusts, and then click Raise Forest Functional Level.

Note

The current forest functional level is displayed in Current forest functional level, in the Raise Forest Functional Level dialog box.

  1. In Select an available forest functional level, click Windows Server 2003, click Raise, and then click OK in the warning dialog box.

If you receive a warning about having a Windows 2000 Server domain controller and you want to continue with the migration, you should demote the server that is running Windows 2000 Server to avoid problems during migration.

To demote a domain controller

  1. On the server that you want to demote, click Start, click Run, type dcpromo, and then click OK.

  2. Click Next twice. Do not select This server is the last domain controller in the domain.

  3. In the Summary dialog box, you are informed that Active Directory will be removed from the computer and that the server will become a member of the domain. Click Next.

  4. Click Finish.

If you cannot demote a domain controller that is running Windows 2000 Server, you can still migrate to Windows SBS 2008 without raising the domain and forest functional level. However, Group Policy settings are not applied correctly. Later, when you can demote the domain controller that is running Windows 2000 Server, you must restore Windows SBS 2008 to its proper state, by redirecting the CN=Users and the CN=Computers containers to an administrator-specified organizational unit.

To redirect the CN=Users container to an administrator-specified organizational unit

  1. Log on to Windows SBS 2008 as a domain administrator in the domain where the "CN=Users" container is redirected.

  2. Follow the instructions in the "To raise the functional level of the domain" procedure to raise the functional level of the domain to Windows Server 2003.

  3. Open a Command Window, and then change the directory to %SystemRoot%\Windows\System32.

  4. Run Redirusr.exe, using the following syntax and replacing Domain and DomainExtension with your domain name and extension:

    redirusr OU=SBSUsers,OU=Users,OU=MyBusiness,DC=Domain,DC=DomainExtension

    For example:

    redirusr OU=SBSUsers,OU=Users,OU=MyBusiness,DC=contoso,DC=local

To redirect CN=Computers container to an administrator-specified organizational unit

  1. Log on to Windows SBS 2008 as a domain administrator in the domain where the "CN=computers" container is redirected.

  2. Follow the instructions in the "To raise the functional level of the domain" procedure to raise the functional level of the domain to Windows Server 2003.

  3. Open a Command Window, and then change the directory to %SystemRoot%\Windows\System32.

  4. Run Redircmp.exe, using the following syntax and replacing Domain and DomainExtension with your domain name and extension:

    redircmp OU=SBSComputers,OU=Computers,OU=MyBusiness,DC=Domain,DC=DomainExtension

    For example:

    redircmp OU=SBSComputers,OU=Computers,OU=MyBusiness,DC=contoso,DC=local

For more information about raising the functional level of the AD DS domain and forest, search for article 322692, “How to raise domain and forest functional levels in Windows Server 2003,” at the Microsoft Web site (https://go.microsoft.com/fwlink/?LinkId=119928).