Manage Learn to apply best practices and optimize your operations.

How will our parent domain upgrade affect the Win2k child domain and AD forest structure?

We have five NT4 DCs (domain controllers) and are planning an upgrade to Active Directory. That is our network for about 200 employees. We also have a child domain newly installed using Windows 2000 from the start for about 45,000 users. My question is: How will our upgrade of the parent domain from NT4 to Win2k AD affect the Win2k child domain and the AD forest structure? What is the best course of action?
Yes. The upgrade will affect the "child" domain in this case. The NT 4.0 isn't really the parent domain in the Windows 2000 sense, because the NT 4.0 systems are completely unaware of the concept. In Active Directory the parent domain establishes the root of the domain structure. The first domain created is the forest root. The issue here is that the child domain was created first.

But we must be clear here on terminology. Let's say that your NT 4.0 domain is MyCompany.com in DNS. Since it is an NT 4.0 domain, it is known simply by its NetBIOS name of MyCompany. You have created in your environment a Windows 2000 domain called SF.MyCompany.com, which is the name that this domain goes by, since it is an Active Directory domain.

So, you are proposing that you upgrade the Windows NT 4.0 to be a Windows 2000 domain called MyCompany.com. If this is the case, then you have a bit of an issue. Generally the parent domain gets created first and becomes the forest root domain. In this case the child was created first and believes that it is forest root as someone must have indicated during the installation. This means that the creation of trusts will be manual, as opposed to automatic.

If this is the case, I would suggest dissolving any trusts to the NT 4.0 domain prior to upgrade. Then upgrade the Windows NT 4.0 domain. Once you are happy that it is stable, convert to native mode. Then create the transitive trust between the pre-existing child domain and the parent domain. You will also need to adjust DNS, as well, since I am sure that the child domain has a DNS with a zone called SF.MyCompany.com, which really should be a sub-domain to MyCompany.com, but might not be, depending how the original parent domain was built.

Dig Deeper on Microsoft Active Directory Migration

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.