Preparing to retire / remove a failing 2008 server. Any tips or Guidance appreciated!

purdybread

Active Member
Reaction score
84
TL/DR

I need to remove a failing server, take 6 Windows 7 clients off domain and into a workgroup. I would like to get their desktops the same as much as possible. What is the correct procedure or precautions?

I don’t do a lot of work with servers so I intend to take image based backups of all clients, and server before I start. I have free access to the systems at weekends. Any help greatly appreciated.

--------------------------------------------------------------------------------------------------------------------

As the title says I need to retire a Windows 2008 server on a small network. This isn't something I would normally do (anything involving servers really) so I am slightly nervous and want to make sure I have planned correctly in advance.

A little background.

The company who originally setup the network / server went bust. Since then there appears to have been no real maintenance carried out, just emergency repairs to keep the system up and running. The owners not really knowing any better seemed to have been OK with this. It is only lately, as the whole network begins to become more unreliable that they have sat up and took notice.

The “Server” has one 250GB hard drive, with only 14GB free!!

Server originally had many roles. DNS, DHCP, AD, Web Server, Exchange, File Server etc. Only Exchange, File Server and AD remain, the rest have been disabled (not by me!). Exchange is dying and access to the data share is intermittent at best.

I want to take 6 desktops and a laptop off the domain and into a workgroup. The data share is being replaced with a NAS. Their accounting software is going to the cloud, and of the original 6 or 7 email addresses in exchange only 2 are still being used. They were originally using ISP supplied addresses, but these have mostly been replaced by domain name based email addresses that don’t run through their local Exchange anyway. I believe the ISP now offers hosted exchange which will take care of the remaining 2.

Now the main thing is I have seen before when removing a client from a domain it's like setting up a new user profile (to be expected I suppose) with a clean desktop. However I want each individual desktop settings to remain the same as much as possible for least user resistance / problems. Is there a procedure for this, or maybe its as simple as Fabs Autobackup before and after?

I should point out I have unrestricted access at weekends to complete this, so a bit of down time isn’t a problem, and I intend to take image based backups of server and clients before commencing work.

If I left any important info out I apoligise. I'll be happy to add details where necessary.

What would be your procedure for doing this? Or any helpful tips / advice would be greatly appreciated.
 
I would use Fabs on each of the workstations. Just give it a try- before you remove the server, Fabs a profile, remove the machine from the domain, and restore the profile to a new local account. Before you remove the machines though, make sure you create a local admin account on the machine that you can access. That's really important.
 
I assumed not. It seems that they dont, and users are saving some stuff locally and shared stuff goes to the data share. However I shouldn't assume, I need to check.
 
Easy to check the usual places such as desktop and documents, just right click a file and go to properties. It'll show the real location and you'll see right away if its on the network.
 
I did a transfer of 11 computers from a 2008 SBS with AD / Exchange / DNS / filesharing . The server was in the same situation as the one you are dealing with. All maintenance on the server ended about 3 years or so ago. I had to remove the clients from the AD and preserve their desktops. I also had to install a new server and recreate the shares.

This is what I used to preserve the desktops of the clients and remove them from the AD to just a workgroup:

https://www.forensit.com/domain-migration.html

The free version will move either from AD to AD or From AD to workgroup. It did very good actually. I did do a backup of the workstations before attempting this

Logout of workstation user.
Login as Admin
Backup the users home directory in /Users/~
Run Forensit Profile Wizard

I had probably two that didnt go well out of the 11 but those workstations had issues filesystem wise. I had to do some clean up on them but pretty much everything worked good. I used the free version of Profile Wizard.

Best to practice with it first before doing a migration just to get used to it.

https://www.forensit.com/downloads.html
 
One thing I'd check on the to-be-decommissioned server is whether there are any shared or data files modified within the past month or so.
 
ForensIT free version works great, used it many times.
Really quick as it doesn't copy any data, it modifies the registry to point the local user account to the old domain account folder.
Just remember to create a local admin user, with a known password, before you remove the workstations from the domain, otherwise you won't be able to log in!
 
If I need to move user profiles to new machines, I use FABs.
If they are staying on the same machine? I just ForensIT.
 
Tylers point about making sure you secure the local Administrator account on each workstation before you pull them from the domain is VERY important. Ensure you can log into the workstation with a LOCAL Admin account.

Copying the data off old server to new is the easy part.
I just copy the important user profiles by hand...pretty much just as quick, and I can cherry pick only what I want, leaving unwanted "junk" behind.

I have seen quirks when using those profile relocaters.
 
Last edited:
Yeah... these days I just nuke and pave if admin is lost, it's just not worth the time to hack through it.

Just make local admin accounts before you pull the domain, you should already have them honestly, but make sure they work by logging into that local admin and using that instance to pull the machine from the domain.
 
Not always, I find that GPT based systems have an annoying habit of either not being editable from Linux, or the PE environment, or worse the filesystem gets screwed up in the process.

And how fast is fast? If you spend 20min doing this times how many machines? No... office class stations have all their software licenses ready to go, if they don't they're in violation of a software audit and in big trouble anyway. Push the thing over, run the script to put everything back while you move onto other stations. This gets even more true if it's SSD equipped, I can have a fully functional Windows 10 installation on a proper office station with applications in less than 15min. It's just a script...
 
Of course there are plenty of password resetting tools available to bust the local Admin password. But when you're working on domain migrations..that's usually after hours, or over the weekend. Every minute counts for me. And very often being done remotely. Let some of those points sink in.....
 
Update:

Used the ForensIT tool as suggested, and all went to plan, thanks for the advice.

However there was one small bug common to each machine.

Each machine lost the passwords to all mail accounts in Outlook 2013. Obviously the Exchange account on the domain was unreachable and expected, however all the machines had additional IMAP and/or POP3 accounts, and each needed passwords re-entered.

Not a big problem, just thought I would mention it so people can backup their passwords with Mail PassView beforehand.
 
Back
Top