Architecture question - Migrating primary DNS to AD Integrated DNS

[JimMatelski]

Our company is currently undergoing a project to upgrade all Windows 2000
domain controllers and upgrade them to Windows 2003 domain controllers.
When this is done the domain functional mode will be changed to Windows 2003
native. Currently all new domain controllers have been added, and services
and FSMO roles are being removed from the Windows 2000 boxes and placed onto
the Windows 2003 boxes. The goal is to eventually decommission the old
Windows 2000 boxes.

One problem being encountered is how to migrate the forest root domain
controllers, one of which homes the primary DNS zone. One thought was to
upgrade away from using primary/secondary zones to Active Directory
Integrated DNS, which uses multimaster replication. An application
directory partition will be created to store the DNS zone information. To
best explain the situation an example is in order:

Using Microsoft's favorite company the root of the AD domain (an internal
DNS) is contoso.com. The organization has two subdomains underneath the
forest root called ny.contoso.com and ca.contso.com. Each of the three
domains has three domain controllers installed. DNS is installed on domain
controller #1 in each of the three domains. Domain controller #1 in the
contoso.com domain is the primary DNS server, and a full zone transfer is
sent to the secondary DNS servers in the ny.contso.com and ca.contso.com
domains.

If the root primary DNS server is switched to Active Directory Intergrated
mode with an application directory partion, I believe a partition is created
for both the forest and for each domain. Since the primary DNS server holds
all DNS records for contso.com and the child subdomains (ny.contso.com and
ca.contso.com), will all DNS entries be placed in the contso.com directory
partition (root)? Is the migration process smart enough to take the DNS
entries for ny.contso.com subdomain and place them in the application
directory partition for ny?

Unfortunately the conversion process from a primary DNS zone to an Active
Directory Integrated DNS zone is very poorly documented, and most of it
outlines the process only for one domain. Any advice or pointers for
additional articles would be greatly appreciated.

 

[Mark Renoden [MSFT]]

Hi Jim

I think what you're saying is that the Primary DNS Server in the forest root
domain handles records for the zones that correspond to all domains? Just
need clarification here.

You're not going to be able to use Application partitions successfully until
all of the Windows 2000 DC's are removed.

I guess I'd suggest:

1. Removing the secondary zones from the DNS servers in the child domains.

2. Changing the zone for the forest root domain to AD Integrated and have it
replicate to all DC's in the Domain (Windows 2000 style).

3. Create a delegation in the forest root zone for each of the child domains
that points to the DNS servers in their respective child domains.

4. Create an AD integrated zone on the child DNS servers for their
respective domain.

5. Create forwarders on the child DNS servers that point to the DNS
server(s) in the forest root domain.

6. Remove the _msdcs "folder" from the forest root domain and create a
delegation that points back to the forest root DNS server.

7. Create an _msdcs.contoso.com zone on the forest root DNS server that
replicates to all DC's in the domain.

8. Restart the netlogon service on all DC's.

9. ipconfig /registerdns on all DC's.

10. Pull a secondary of the _msdcs.contoso.com zone to the DNS servers in
the child domains.

After all DC's are at Windows Server 2003 you can change the replication
scope of the zones:

11. Change _msdcs.contoso.com so that it replicates to all DNS servers in
the forest.

12. Change the other zones to replicate to all DNS servers in the domain.

I'm pretty sure that'll get you where you want to go. Best thing I can tell
you is that testing where possible will save you in the end.

HTH
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: (e-mail address removed)

Please note you'll need to strip ".online" from my email address to email
me; I'll post a response back to the group.

This posting is provided "AS IS" with no warranties, and confers no rights.