Migrating from Microsoft Windows NT Server 4.0 to Windows Server 2003

Completing Post-Upgrade Tasks

After you upgrade all domain controllers in the domain to Windows Server 2003, complete the following post-upgrade tasks:

• Eliminate anonymous connections to domain controllers.

• Raise domain and forest functional levels.

• Redirect the Users and Computers containers.

• Complete the upgrade.

Eliminate Anonymous Connections to Domain Controllers

After you upgrade all the servers in the domain hosting services that run as Local System and use Anonymous or null credentials when accessing a domain controller, such as Windows NT 4.0 RAS servers, remove the Everyone and Anonymous Logon groups from the Pre-Windows 2000 Compatible Access built-in group . This task increases the security of your domain by preventing anonymous connections to domain controllers.

To remove groups from the Pre-Windows 2000 Compatible Access Group by using the command line

• At the command line, type:

  net localgroup "Pre-Windows 2000 Compatible Access" GroupName /delete

When using the net localgroup command to add or delete any group or group member name that includes spaces, such as the Anonymous Logon group, you must enclose the group name in quotation marks.

Raise Domain and Forest Functional Levels

Although the Windows Server 2003 domain functional level provides a number of features and advantages, enable this functional level only when you have upgraded all your Windows NT 4.0 BDCs and you are certain that your environment is ready.

After you determine that your environment is ready, use Active Directory Domains and Trusts to enable the Windows Server 2003 domain functional level.

After you upgrade all domain controllers to Windows Server 2003, raise the forest functional level to Windows Server 2003 to take advantage of all Windows Server 2003 forest-level features.

For more information about enabling functional levels and the features available at the Windows Server 2003 domain and forest functional levels , see Enabling Advanced Windows Server 2003 Active Directory Features in Designing and Deploying Directory and Security Services in the Microsoft Windows Server 2003 Deployment Kit (or see Enabling Advanced Windows Server 2003 Active Directory Features on the Web at http://www.microsoft.com/reskit).

Complete the Upgrade

Complete the following tasks to finalize the upgrade process:

• Review, update, and document the domain architecture to reflect any changes that you made during the upgrade process.

• Review your operating procedures and administrative tasks to determine whether new Windows Server 2003 features, such as Group Policy objects or distributed administration, affect the operations environment. Be sure to document any changes that you identify.

• After you ensure that your Windows Server 2003 Active Directory environment is operating successfully for a period of time, you can redeploy the rollback server that you reserved for the recovery process. If you do not need the Windows NT 4.0 BDC to achieve the required load balance among your domain controllers, maintain the rollback server for one week. Maintain the backup of the rollback server for a longer period of time for additional security. For information about developing a recovery plan, see Planning the Migration in this book.

• Some Windows NT 4.0 applications, such as Microsoft Systems Management Server (SMS), can have an unpredictable effect on the domain when installed after the domain has been upgraded to Active Directory. Ensure that you are running SMS 2.0 and have installed Service Pack 4. For more information about SMS, see the SMS Downloads link on the Web Resources page at http://www.microsoft.com/windows/reskits/webresources.

After you complete the above tasks successfully, the upgrade process is complete.