Slashdot Mirror
Active Directory on Win2k or 2k3?
lordbry asks: "I am a Windows admin for a major university in a business computing area (if we have problems, people might not get paid). We have a Windows NT Domain, and are planning to migrate to Active Directory. One of my co-workers is pushing for doing this under Windows 2003. I, however, feel that (as with any M$ product) we should not even consider using 2003 for production anything until there is an SP 2 or 3, and that we should go with AD under Windows 2000. Does anyone have any advice, arguments, or horror stories that could help me make my case to the rest of my group, all of whom are somewhere in the middle? Does anyone think that 2003 is the way to go?"
Windows 2003 is 1000 times better than 2000. It's signficantly more stable, it's got the fantastic volume shadow copy (kinda like CVS...kinda), it's got DFS, and it's extremely well supported.
Don't think of it like a new Windows - it's actually Windows NT 5.2, which is heavily built upon 2000.
I've been through this twice now. Once recently and once about 8 months ago. The first one was an upgrade from NT -> 2003 and the second was an upgrade from a 2000 AD -> 2003 AD. Both times, I ended up MORE than happy that I went to 2003. The tools for 2003 beat the hell out of the tools for 2000. If you decide to add Exchange to the mix, Ex 2003 is more stable and has better features over 2000. All in all, if you're going new, there's no reason to wait for the .2 or .3.
I find W2K3 to be quicker and have more nifty options and features. It also depends on your client population, with XP being more easily manages under W2K3 with the stock GPO, copies, and templates provided.
At the same time I've had problems with W2K3 as a DNS/WINS server. And a DFS server. It took a long time and lots of digging to resolve those issues and it looked like it was the first time MS had come across a lot of the issues we had when we got in touch with them. Eventually worked out but it's never fun to be the first to find a bug in a critical service.
The other annoyance we've had with W2K3 is it's control over W2K clients. Things like IE settings that'd be pushed from our old domain controller or from IEAK stuff stopped working or worked oddly in W2K3. It would store security settings in two files, push only one, confuse clients, etc.
If I had to do it all over again ~today~ I'd go W2K3 because I've found the past few months worth of documentaiton and support to be much better than a year ago.
I should note that the first network I deployed W2K3 in was ~80 nodes. It was critical, 24 hour operation, Engineering intense, lots of storage, license servers, etc. So it wasn't trivial but it's not a University sized environment, not that many thousands of clients.
In conclusion.. I don't have a conclusion. I think I'd have to hear what services besides AD you'd want to run off of it. Do you run DNS, DFS, SFU, Licenses, TS, etc. off of the same servers?
Oh, if you do go W2K3, install the Resource Kit bundle right away, it's priceless for administration and scripting.
Anyhow, good luck, Cheers, -Pk
Wow, a question that ultimately implies sending money over to Redmond, and not a single post yet claiming Mandrake 6 on old Pentium 2 would server the purpose just right and he should contribute money to GNU foundation instead?
Windows 2000 is almost EOL'd. Windows 2000 Support Cycle. Non-security updates end 3/31/05 (8 months from now) and security updates end on 3/31/07 - eight months from now. I'd go with 2003 since by the time you are done with the migration, 2000 will probably be at the end of its useful life and you'll be looking at going to 2003 anyways.
Use 2003, it is the same as 2000 with added admin features. There are a few issues that we have had, but they have all been patched by now.
If you are worried about stability, we have found 2003 is much more stable than 2000. 2003 is just 2000 with extra features, I don't think much in the core has been changed.
Additionally you if you go with 2000, you have 3 years less support on the product. I assume you are using licencing, so upgrades are free, but the labour in changing over is huge.
Remember work out how much time it is going to take you and triple it. You WILL run into problems. Always have a fall back position for when the shit hits the fan.
- fewer security patches (== longer uptime)
- way more flexible schema updates, especially in a large AD environment
- way more secure than Microsoft's pervious iterations right out of the box and in general operation
- generally faster (but that will depend on what else you've got running on it - hopefully just AD)
- much better command line administration (can do most everything from a command window)
Do yourself a favor and also grab ActiveState's perl distribution and, since you're already running a ludicrously expensive OS, buy their PerlNET disdtribution (part of the Perl Dev Kit - http://activestate.com/Products/Perl_Dev_Kit/pricAlso make sure you install the resource kit.
Mind the gap...
You *absolutely* want to user Server 2003 over 2000. If you *must* use 2000, make sure you use the very latest service pack and appropriate hot-fixes. As others have mentioned, 2003 is really a *minor* update to 2000, despite the name change.
:-)
I have deployed an extensive AD (60+ domain controllers and 80,000 users) on early (SP2-era) Windows 2000. AD had major bugs and scalability issues in versions before Windows 2000 SP4.
Whatever you do, make sure to do good research, home-work, and design *before* you start deploying the infrastructure, creating organization units, and policies. Good design will pay off as the infrastructure grows. Bad design will create increasingly complex problems as your infrastructure grows. It's no fun to re-design and re-deploy over a large and broken first attempt
Good luck!
Oh, and one other thing? If you go with a Windows 2000 AD structure, then wish to bring in 2003 Domain Controllers, you'll get to extend your AD schema. While it wasn't a problem for us, I really don't think you want to have to go through such a process. After all, at it's core AD is a big-ass database. Do you really want to extend a DB schema if you don't have to?
Just go with 2003 to begin with and be set with the new schema, finer grained GPOs, better management tools, etc.
I just migrated my workplace form NT4 to 2k3 Active Directory.
The process went without a hitch.
first we ghosted our pdc, that way we could return things to normal quickly, if the upgrade didnt work. we poped in the 2k3 cd, and went through like a normal install.
AD is tied to dns. chose your dns name now, its best if you control your own dns servers if you want to use your web domain, otherwise its a bit of a pain (but it works)
after the install completed dc promo ran and imported all our user and computer accounts. it might be best to do the housekeeping of unused users, groups etc. before migrating.
Adding additional controlers is easy, just install 2k3 and run dcpromo, and select add an aditional controler to domain. it will automaticly replicate for you.
Design your directory structure prior to migration.
and like all windows systems - when in doubt reboot. 2k3 is rock solid, but i had an issue where dns would not replicate properly, untill i reboted the first DC.
Also i might add that Microsofts Software update services (SUS) works amazingly well. it can be inforced with Group policy, and all your approved updates can be forced to your clients when you want them to be. Patch management is much simpler now.
Replacing the "S" in something one finds expensive with a "$" isn't just used in "Micro$oft". I've seen it used in context that wasn't even computer related (in discussion of cars, for example)...It's been around longer than MS has. It's not a comment about the quality, it's a comment about the price (though when it's combined with "windoze", "winblows", etc, I agree that it seems childish).
"I know many people will point out that LDAP could almost certainly handle the job"
Ok, this has been getting to me throughout the commentary, but people keep on making the same mistake.
LDAP is a prototol. It's not a product. Any product that implements RFC2251 is LDAP.
The Active Directory implements LDAP, as does eDirectory and many other directory services.
Which LDAP did you mean?
Some time ago, out IT department and an external IT consulting company (recommended by MS) tried to migrate our NT4 Domains (one per office plus some for special purposes) into a single W2k Active Directory. It took more than week full of night shifts and a second IT consulting company to limit the damage caused by scripts of the first IT consulting company. World readable "top secret" documents, completely locked transfer folders, and locked-out users were only the tip of the iceberg.
So here is my advice: Have a verified backup of all working systems, run a lot of tests, and try the migration in a *good* lab environment first (a 1:1 copy of your production systems would be ideal). Repeat several times until everything works smoothly. Run the last tests with recent copies of the production system. DO NOT TRUST SCRIPTS! Verify the result of each script, and make all scripts abort if they find data they can not handle.
Tux2000
Denken hilft.