Active Directory migration 2008-2012 with errors.

[Draax]

Hello!
After so many hours of pulling my hair i end up here for some help.
I also want to apologize for my English since its not my native tongue.

We currently have a Windows Server 2008 which we need to migrate to a newer system due to third party software support has been cut.

The guide/checklist I followed:

http://blogs.technet.com/b/canitpro/archive/2014/05/28/step-by-step-active-directory-migration-from-windows-server-2008-r2-to-windows-server-2012.aspx

What I found are that a active directory migration is the best to keep all running clients on the new server.
On a test between two clean virtual machines it works flawless without any errors and i can shut down the old DC once everything is complete letting the new DC handle logins etc etc.

I do the same thing as i did on the virtual machine on the real server environment everything works well until the new DC are restarted and NETLOGIN and SYSVOL isn't shared, the new DC cant handle logins.
I get errors which say once the sync between the servers have been completed SYSVOL will be shared, but it will never be completed.
So i move the FSMO roles to the new DC still SYSVOL aren't shared.
Event viewer errors after promotion:

• Event 1202, DFSR
• Event 13512, NtFrs
• Event 13565, NtFrs

After some hours of sleep I try preforming a "install from media" (IFM) i extract the active directory from the domain into a file I import into the new server active directory promotion, validation are successful.
After 2 min of preparing the file server restarts and leave an error in the event viewer:

NTDS (436) NTDSA: Database 'C:\Windows\NTDS\ntds.dit': The secondary index 'INDEX_00150003' of table 'datatable' may be corrupt. If there is no later event showing the index being rebuilt, then please defragment the database to rebuild the index.

Old DC and the new DC are on the same network without any firewall and there's no clients or anything on this separate network

Roles on old DC:

• AD DS
• DHCP
• DNS
• File Share

New DC are new installed with nothing else than AD DS installed for the migration.

I'm stuck, i cant get active directory migrated to the new server.
Any input are highly appreciated!

-Draax

 

[YeOldeStonecat]

I've seen that a few times when doing 03 to 12 migration or 08 to 12 migrations, I think even back when I was doing 00 to 08 migrations.
Editing the BURFLAGS registry key always solved the situations I had...
http://blog.powerbiz.net.au/general/missing-sysvol-and-netlogon-during-migration/
https://support.microsoft.com/en-us/kb/290762

 

[Draax]

I've seen that a few times when doing 03 to 12 migration or 08 to 12 migrations, I think even back when I was doing 00 to 08 migrations.
Editing the BURFLAGS registry key always solved the situations I had...
http://blog.powerbiz.net.au/general/missing-sysvol-and-netlogon-during-migration/
https://support.microsoft.com/en-us/kb/290762

Hi!
Thanks a lot for you're reply, unfortunately I already tried this without success.

 

[YeOldeStonecat]

Restarted FRS services after that? I've seen this probably over a dozen times..on migrations, and that's been the trick. For some reason it's really common when doing SBS migrations.
Hmmm...hard to say what to try next, there's a ton of things...questions rather.

Is this vanilla server? Or SBS?
If vanilla server, supposed I'd DCPROMO "down" the "new" server...pull it from the domain, remove traces of it from active directory. (of course ensure original old server has all the FSMO roles 'n catalog back...DCPROMO down should shift them but I'd manually check 'n ensure)
And then I'd begin the build again. I'd want to know certain settings are in place first.
For example, TCP/IP settings of both servers.
Say "old" server is 192.168.10.10, and new server is 192.168.10.l11
On the old server, in its TCP/IP properties, for primary DNS server of course it looks at itself..192.168.10.10, so for secondary DNS I'd have it look at the "new" server, 192.168.10.l11
On the new server, for primary DNS, when you join the domain, you have to have it looking at the old DC...192.168.10.10
Once you install the DNS roles and run DCPROMO (via the GUI wizard of course with server 12)...you have to have it look at itself first for primary DNS..192.168.10.11, and then I'd add the old DC as secondary DNS.

Then you can make her a catalog...and start shifting the fizzymoes...and goose the FRS services and manually goose active directory replication a few times...and see how the SYSVOL 'n Netlogon do. Try the burflags again.

 

[onetech4all]

I think you should have done a lateral upgrade. Meaning: you add a 2012 server to a 2008 domain as a domain controller. You let it replicate, move services over, like DHCP, DNS, etc and while you stop one service at a time down in 2008 you turn them on in 2012 one at a time. Eventually when AD has been transferred over, you demote 2008. Simple dude!
I did one 2 months ago from 2003 to 2012! Nice income!

 

[Nerm]

I usually see this sort of thing caused by sysvol corruption or DNS related issues. The burflags stonecat mentioned will a lot of the time solve this issue. Are there any "Journal Wrap Errors" in the event log of the old server? What does a dcdiag /v and repladmin /showrepl look like on old and new server?

 

[Draax]

Restarted FRS services after that? I've seen this probably over a dozen times..on migrations, and that's been the trick. For some reason it's really common when doing SBS migrations.
Hmmm...hard to say what to try next, there's a ton of things...questions rather.

Is this vanilla server? Or SBS?
If vanilla server, supposed I'd DCPROMO "down" the "new" server...pull it from the domain, remove traces of it from active directory. (of course ensure original old server has all the FSMO roles 'n catalog back...DCPROMO down should shift them but I'd manually check 'n ensure)
And then I'd begin the build again. I'd want to know certain settings are in place first.
For example, TCP/IP settings of both servers.
Say "old" server is 192.168.10.10, and new server is 192.168.10.l11
On the old server, in its TCP/IP properties, for primary DNS server of course it looks at itself..192.168.10.10, so for secondary DNS I'd have it look at the "new" server, 192.168.10.l11
On the new server, for primary DNS, when you join the domain, you have to have it looking at the old DC...192.168.10.10
Once you install the DNS roles and run DCPROMO (via the GUI wizard of course with server 12)...you have to have it look at itself first for primary DNS..192.168.10.11, and then I'd add the old DC as secondary DNS.

Then you can make her a catalog...and start shifting the fizzymoes...and goose the FRS services and manually goose active directory replication a few times...and see how the SYSVOL 'n Netlogon do. Try the burflags again.

Hi Thanks for the help!
After third try with the burflags everything worked fine!
Now just some DHCP errors left to fix ..

 

[YeOldeStonecat]

Cool..glad it worked. Was puzzled when you first said it didn't work...always did it for me.