Moving member servers without DC

Hi
I have recently been asked to move some server's (running windows server 200 and windows server 2003 r2) to a new site as the old site is being decommisioned, the DC's will be decomm'd, as the legacy data will only be required for reference purposes and
the business is closing down, as the company is being closed down.
The DC's run DNS, DHCP and ADDS.
The servers that will be moved are purely application servers, I was wondering what would happen when the DC's are powered off? Will the member servers still function and communicate, also the time server is one of the DC's, how will this affect the retrieval
of data from the member servers.
Thanks
Gin

The servers that will be moved are purely application servers, I was wondering what would happen
when the DC's are powered off?
If I understand well, the DCs will be decommissioned and the domain will no longer exist. If this is the case then you will need to disjoin these servers from the domain to avoid false positive alerts in the logs and so that you can do the things in the
correct way.
About the impacts on your application servers, you need to know their dependencies and relation with AD. If you have an AD based application then it will no longer work. You need to check each of these applications and do the assessment of the impacts. A
test environment would help and contacting the application developers / support would be helpful too.
Will the member servers still function and communicate, also the time server is one of the DC's,
how will this affect the retrieval of data from the member servers.
About which data are you speaking? You need to check the requirements for your applications.
As for the time sync, you need to think about hosting an internal NTP server that is in sync with external ones or simply make all your servers point to external NTP servers for time sync as you will no longer have DCs.
The servers will hold data and the legacy application, without the DC's will the servers boot up
and be able to talk to each other, also what happens with the time synchronisation when there's no DC available.
They will be able to boot and use the cached credentials for authentication. For the time sync, it will no longer work as your DCs will be no longer available.
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

Similar Messages

SAP Portal changes not reflect in all the servers without reboot?

Dear SDN Members
We have one sap ep 7.0 eh1 main instance and 4 other portal instances.every time we tranport any portal develpment work such as epa packages, we need to restart all the instances to reflect the new changes.can you please suggest me
a solution if exists to avoid bouncing of all instances when a portal development work is transported.
Why does the changes not reflect in all the servers without the reboot??
Thanks
Chandra

Thanks for the quick response kenny, i wonder if we can configure any parameters in UME
to avoid bouncing of all the instances. please let me know if you have any other suggestions.
actually we have a central portal instance and 4 other portal servers connected through a
load balancer.Any tranport we move to central instance should refelect the changes in all
other portal instances.But we need to restart all the instances to see the new changes.
We are trying to find a solution if availbel which prevents server-restarts after each transport.
Thanks
Sekhar

Windows 2008 R2 smtp server Relay only selected servers without authentication

Hello,
Need help in configuring Windows SMTP server.
Windows 2008 R2 Server. SMTP service is installed and configured.
Access TAB -- Authentication TAB -- Anonymous Access is selected..
Relay TAB -- Only the list below is selected and specfic scanners and application servers IPs are mentioned.
Issue: Even though we have specified list of IPs to relay from this server, Anybody can send mails using this server ( open Relay )
-- My requirement is to relay specific IPs of scanners and App servers without any authentication, can anybody help me configure windows smtp server to achieve my requirements.
Any help will be highly appreciated.
Regards,
Ghouse

Hi,
I recommend you refer to the following article to configure the smtp server:
Setup and Configure SMTP Server on Windows Server 2008 R2
In addition, you should ask this in Windows server forum as this is not an exchange problem:
http://social.technet.microsoft.com/Forums/en-US/home?forum=windowsserver2008r2webtechnologies
Thanks.
Niko Cheng
TechNet Community Support

Create Local Group on Member Servers

Guys,
I have put together below script (thanks to everyone for posting great scripts). I have copied some part of the script from the forum examples.
This script will take Input, create Domain group and add that domain group to the number of member servers listed in the text file.
So far so good, my this script works fine.
Question - I need to add functionality in the script to create new local group on member servers using same variable and Add the Domain group (created using same variable) in the newly created local group on member servers.
I also want to have an output file for the failed hosts.
Appreciate your help.
==============================================
# input
$Name = Read-Host "Write Policy Name"
#Create Domain User Group
NEW-ADGroup -Name ${Name}_UserGroup –groupscope Global -path "ou=Test,DC=Lab,DC=Local" -Description "${Name} Domain users Group"
#Read Servers from the Text File
$Servers = Get-Content c:\temp\${Name}_Servers.txt
#Initialize the Domain Group Object
$DomainGroup = [ADSI]"WinNT://Lab.local/${Name}_usergroup,group"
#Add Domain group to the local Remote Desktop Group on member servers
ForEach ($Server in $Servers) #Loop through each server
#Get Local Group object
$LocalGroup = [ADSI]"WinNT://$Server/Remote Desktop Users,group"
#Assign DomainGroup to LocalGroup
$LocalGroup.Add($DomainGroup.Path)
==============================

You don't need scripts to manage local groups.
Group Policy can do this for you.
-- Bill Stewart [Bill_Stewart]

Enable the UAC settings for Domain Controller / Member servers and for end user systems

Hi
We are working on hardening the security for all Domain Controllers / Member Servers and end users systems. As part of it we would like to know the best practice for UAC settings for each of these servers. There are 8 settings related to UAC and as of now
we configured just "User Account Control: Behavior of the elevation prompt for standard users" as disabled for the servers OU. Also not sure about other settings and how it affect the normal operations like installing Windows updates / applications
through SCCM or manually on servers or end user systems and other stuffs.
We are looking for experts opinion on this. Thanks in advance
LMS

Hi LMS,
Would you please let us know the current situation? Just check if Martin’s suggestion was helpful for you.
If any updates, please feel free to let us know.
Just additional. Please refer to the
User Account Control Grouping in the following article. It will provide some links about those different UAC settings. Please click those links and read related articles. In these articles, will provide
Security considerations that may help you to configure those settings.
Security Options
http://technet.microsoft.com/en-us/library/jj852268.aspx
Hope this helps.
Best regards,
Justin Gu

Time sync monitor for all windows member servers

How to monitor time sync issue on all the member servers and domain controllers. Can we monitor through scom 2007 r2. Specially we need an alert when all the member servers are not in time sync.
B John

There is no monitor for exactly your ask.
The AD management pack includes a Time Service Health monitor for DCs that makes sure the time service is running:
http://social.technet.microsoft.com/Forums/en-US/0c921fa7-45ed-4bee-8f53-c92c750f6cbf/scom-module-for-monitoring-time-sync-issues?forum=operationsmanagergeneral
Here is my "domain time tip:"
Select your preferred time server from this list
http://tycho.usno.navy.mil/NTP/. For example 'tick.usno.navy.mil'.
Then run these commands on your PDC emulator of the domain:
W32tm /config /syncfromflags:manual /manualpeerlist:"<DNS-name-of-time-server>"
W32tm /config /reliable:yes
W32tm /config /update
W32tm /resync
Net stop w32time
Net start w32time
If you execute these commands, AD defaults will cause all your member servers to discover the domain time standard and update to it.
Good luck,
John Joyner MVP-SC-CDM

Is Windows 2003 member servers still able to authenticate against Windows Server 2012 R2 AD after mirgation?

Hi,
We are planning to migrate Windows Server 2008 R2 AD to Windows Server 2012 R2 AD. But we have some Windows 2003 member servers (Running RADIUS for VPN user to authenticate their AD accounts). Does anyone know that existing Windows 2003 member
servers still able to authenticate on Windows Server 2012 R2 AD after migration and function properly? Just wanted to make sure Windows Server 2012 AD support Windows 2003 member server.
Thanks.
M

Hi,
Thanks for your post.
Is there any Windows server 2003 domain controller in your domian?
If yes, i think you could refer to this article:
http://blogs.technet.com/b/askds/archive/2014/07/23/it-turns-out-that-weird-things-can-happen-when-you-mix-windows-server-2003-and-windows-server-2012-r2-domain-controllers.aspx
Regards.
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Updating Member Server Without Restarting It

Hi,
I was working on creating Gpo's programatically. My goal was to allow users to RDP on Member servers. For that I added user groups under Restricted group sections in Gpo.
Now in order to update the changes I used " gpupdate /force " command but its not working. . . user is not able to RDP on Member Server unless we restart the
Member Server through administrator's account.
I have also switched my Firewall off.
I am looking for the solution where I will not need to restart Member server for updating the userGroups under Computer management section of member server.
Thanks,
Anand Kothekar

A restart should not be required. Please make sure that changes are taking place when you force the update: Mainly check the membership of local
Remote Desktop Users group. If it is not updating then you need to troubleshoot that: https://social.technet.microsoft.com/Forums/windowsserver/en-US/6e6821a5-1568-4ced-9302-0b0d0070bda8/how-to-troubleshoot-why-a-particular-gpo-does-not-work
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

Deploying member servers using DirectAccess

I'm putting together a relatively small Server 2012 R2 network, using Direct Access and an external member server running SharePoint.
The pictorial below best shows what the plans is:
To clarify, four servers at Head Office with 2x DC's, Exchange server and an Application server (not important). One server running SharePoint at the external branch office, with clients connecting remotely to both offices. There
also internal clients at both premises. These servers are to deliver mail and SharePoint access for
all clients both internal and external.
What I am trying to understand is how to best have the member server communicate with the DC's for GPO updates, remote management and SharePoint permission structures, which is governed by active directory users and groups. It appears that Server
2012 member servers cannot act as clients in the way that Windows 8 does with Direct Access. I guess I'm looking for the best advice on how to set this up.
Many thanks in advance
MIS5000

Yes, that sounds like quite a fun project :)
You can definitely utilize your SBS as the Domain Controller, I have installed Server 2012 and Server 2012 R2 DirectAccess into environments that are SBS2003, and it works just fine. There are no schema requirements for DirectAccess itself, I actually have
it running in a Server 2003, Active Directory 2000 Mixed Mode environment just to show that it works.
Since DirectAccess does rely on domain connectivity and those GPOs to distribute settings, you will probably hit some bumps in the road when you cut over to your new DCs. However, it's quite quick and easy to setup DirectAccess in the first place, once you
have the server prepped accordingly, and so even in a worst-case scenario, if your current DirectAccess server isn't happy after the DC switch, you could just wipe off the Remote Access role, reinstall the role, and walk back through the configuration wizards
to setup the environment again.
If you're ever interested in learning a bit more about DA itself, there are a couple of books out on the subject (not trying to self-promote, but questions on the forums are the primary reason why I put together this book in the first place):
https://www.packtpub.com/virtualization-and-cloud/microsoft-directaccess-best-practices-and-troubleshooting
https://www.packtpub.com/networking-and-servers/windows-server-2012-unified-remote-access-planning-and-deployment

Moving printers to consolidate servers without interrupting users [Windows 2003 to 2003]

Greetings!
How do I go about moving network printers served from ServerA to ServerB, decommission/shutdown ServerA, and be completely transparent to users without causing them the need to remap printers?
My company is still at Active Directory level Windows 2003 SP2, and has all of our printers on several Windows 2003 SP2 servers. I am in the midst to decommission several old servers and consolidate print servers and then upgrade the domain to Server 2012
levels.
Right now, a user may have a network printer setup so that it is listed as "Printer1 on ServerA"
I want it so that when I move the printers to ServerB, users can still use their already setup "Printer1 on ServerA", instead of having to map them with "Printer1 on ServerB". Although, any new printers added from the consolidation point
forward to a users PC would be "Printer1 on ServerB".
My plan is to use my Windows 7 PC to:
Use Print Management to migrate/export ServerA printers to a file.
Use Print Management to migrate/import that ServerA printers file into ServerB. Using "Keep existing printers" in Import mode and "List All Printers" for List in the directory. [That would add ServerA's printers to
ServerB while keeping ServerB's printers. But I'm a little unclear which option to use for List in the directory.]
Shut down ServerA.
In our AD DNS, delete ServerA's A record and then either (a) add an A record for ServerA using ServerB's IP address, or (b) add a CN record for ServerA to point to ServerB's FQDN. [I think (a) is the better option, right?]
And then after the DNS refresh, the jobs should just come out of Printer1 on ServerA (as already listed/setup on my workstation) even though Printer1 now resides on ServerB.
I tried that plan last night, and things just didn't quite work out. My workstation said Printer1 on ServerA was Offline and I couldn't print to Printer1 on ServerA (which was imported onto ServerB) even though my DNS had ServerA with ServerB's IP.
For now I brought ServerA back online and people are working.
What am I missing or should be doing differently? Any issue with local security that would prevent one server to not accept commands directed to another servername? Thanks for your input!
Visual nutshell:
Printer1/ServerA ---> shutdown ServerA ---> Printer1/ServerB while those with Printer1/ServerA definitions on their workstations would still print.

When I last went from 2003 to 2008 R2, I did things a bit different. I brought up the new server and migrated all printers. I then had both servers running at the same time with the same configuration but all the clients
were pointing to the old server. To move the clients I deployed this vbs script to all users using group policy as a logon script:
http://gallery.technet.microsoft.com/scriptcenter/20428e3a-12c6-4354-bddf-d748367fca72#content. I left both servers running for some
time until all users were redirected. I frequently then checked the old servers event logs for any print jobs until I no longer saw any and then shutdown the old server. Hope that makes sense.
+1, I kinda do it that way too. (except I didnt know that script, as I used GPP to erase all printer connected & I was re-doing the printer connection after with GPP too)
Regards, Philippe
Don't forget to mark as answer or vote as helpful to help identify good information. ( linkedin endorsement never hurt too :o) )
Answer an interesting question ? Create a
wiki article about it!

Moving SQL servers from one Protection group to another

We are using DPM 2012 R2 Update Rollup 4. We have started to move some SQL servers from a Protection group with 90 days of retention to a Protection group with 15 days of retention. The recovery data is co-located on the backup device and we are using
disk based backup. A couple days after moving a couple of the servers, I have noticed that the number of recovery points has stayed the same and not decreased. It would seem that when moving to a different protection group, that the SQL server
would inherit the new retention settings instead of retaining the ones from the old protection group. When I moved them, I stop protection of the databases and then added them to the new group. Why is this occurring and how do I get the new retention
settings in the new protection group to take affect?

Thanks for the information. DPM is really a pain when trying to move co-located data sources to different protection groups. I do hope in future versions that this is simplified and corrected. I am now stuck for 90 days with data that I
don't want and I can't get rid of without getting rid of every recovery point for that group. That is bad news when my LDM DB is almost full.
An important note for those who are trying to see how many extents certain data sources have when following this article
http://blogs.technet.com/b/dpm/archive/2010/03/30/what-volume-to-migrate-first.aspx
If your DPM DB has changed from "DPMDB" to DPMDB with bunch of random characters, you will need to this line in the script for it to work.
$db = $srvr.Databases["DPMDB"]
<-- change this to your server’s DPMDB name
Also, you will need to greatly increase the width of your command window to see the "NumberOfExtents" column which is the most important column.

Starting Managed Servers without admin Server

dear All
i have a Weblogic Server contains the following
Admin Server
LoadBalancer Server
Cluster Contains Server1 & Server2
and every thing is fine, but i have the following problem : while starting any Node from Cluster or LoadBalancer Server using startManagedWebLogic.cmd without starting up admin server, i am getting the following error in my log
Caused By: oracle.security.jps.service.idstore.IdentityStoreException: JPS-00056: Failed to create identity store service instance idstore.ldap.provider:idstore.ldap. Reason: weblogic.security.service.SecurityServiceRuntimeException: Invalid host or port for admin server..     at oracle.security.jps.internal.idstore.ldap.LdapIdentityStoreProvider.getIdStoreConfig(LdapIdentityStoreProvider.java:195)
     at oracle.security.jps.internal.idstore.ldap.LdapIdentityStoreProvider.access$300(LdapIdentityStoreProvider.java:70)
     at oracle.security.jps.internal.idstore.ldap.LdapIdentityStoreProvider$NoLibOvd.getInstance(LdapIdentityStoreProvider.java:242)
     at oracle.security.jps.internal.idstore.ldap.LdapIdentityStoreProvider.getInstance(LdapIdentityStoreProvider.java:114)
     at oracle.security.jps.internal.idstore.ldap.LdapIdentityStoreProvider.getInstance(LdapIdentityStoreProvider.java:70)
     at oracle.security.jps.internal.core.runtime.ContextFactoryImpl.findServiceInstance(ContextFactoryImpl.java:139)
     at oracle.security.jps.internal.core.runtime.ContextFactoryImpl.getContext(ContextFactoryImpl.java:170)
     at oracle.security.jps.internal.core.runtime.ContextFactoryImpl.getContext(ContextFactoryImpl.java:191)
     at oracle.security.jps.internal.core.runtime.JpsContextFactoryImpl.getContext(JpsContextFactoryImpl.java:132)
     at oracle.security.jps.internal.core.runtime.JpsContextFactoryImpl.getContext(JpsContextFactoryImpl.java:127)
     at oracle.security.jps.internal.policystore.PolicyUtil$1.run(PolicyUtil.java:798)
     at oracle.security.jps.internal.policystore.PolicyUtil$1.run(PolicyUtil.java:792)
     at oracle.security.jps.internal.policystore.PolicyUtil.getDefaultPolicyStore(PolicyUtil.java:792)
     at oracle.security.jps.internal.policystore.PolicyDelegationController.<init>(PolicyDelegationController.java:289)
     at oracle.security.jps.internal.policystore.PolicyDelegationController.<init>(PolicyDelegationController.java:283)
     at oracle.security.jps.internal.policystore.JavaPolicyProvider.<init>(JavaPolicyProvider.java:261)
     at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
     at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:39)
     at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:27)
     at java.lang.reflect.Constructor.newInstance(Constructor.java:513)
     at java.lang.Class.newInstance0(Class.java:355)
     at java.lang.Class.newInstance(Class.java:308)
     at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.loadOPSSPolicy(CommonSecurityServiceManagerDelegateImpl.java:1339)
     at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.initialize(CommonSecurityServiceManagerDelegateImpl.java:1020)
     at weblogic.security.service.SecurityServiceManager.initialize(SecurityServiceManager.java:879)
     at weblogic.security.SecurityService.start(SecurityService.java:142)
     at weblogic.t3.srvr.SubsystemRequest.run(SubsystemRequest.java:64)
     at weblogic.work.ExecuteThread.execute(ExecuteThread.java:207)
     at weblogic.work.ExecuteThread.run(ExecuteThread.java:176)

Isn't this exactly what the admin service is used for?
I think you need to start the admin server before starting the other servers.
Timo

Moving a file without using Cmd+Drag option

Is there any third party software or command such as Cmd+X to move folders on a finder window other than Cmd+Drag. I find Cmd+Drag annoying and very difficult to use in OSX as you have to keep pressed the mouse button till u have reached to the destination folder. what happens if u mistakenly release the mouse somewhere else..
I still don't understand what harm such a command could do. OSX protagonists tell that this is called cutting a file and is dangerous to the filesystem but I say I am not cutting any file/folder here.. file still stays at the same place till I have pressed something like Cmd+V which is what Cmd+Drag does...at least gives my finger a rest and time to think... Anyone else agrees with me?
Besides if unix command "mv" allows it then why not graphic UI.

ziaulhasan,
You can also use your Mac's Automator program to move Finder items from one place to another.
Open Automator. Highlight "Finder" inside the Library frame to reveal all of the Finder's Actions. Drag the following two Finder Actions to the right-hand side Workflow pane, in this order:
1) *Get Selected Finder Items*
2) *Move Finder Items* -- under Options check "Show Action When Run" so that a dialog appears, allowing you to choose a destination folder. Otherwise the action would run without user interaction, resulting in the item being moved to whatever your default location may be. Select the "Show Selected Items" radio button, and check the "To" box. Consider carefully whether to check "Replacing existing files." If this box is checked and you were to move a folder from one location to another containing an existing folder of the same name, you would overwrite the files in the folder not being moved. To keep this from happening, leave "Replacing existing files" unchecked.
From the File menu select "Save As Plug-in..." Give your plug-in a name ("Move Item" e.g.) and save it as a Plug-in for: Finder. Thereafter, you'll find the newly named action on your Finder's contextual menu, in a submenu under Automator. Your new action is now ready to be put to use when you Control-click on a file or folder in the Finder.
Note: Be careful when working inside a Finder window in Column view that you have selected the +item itself+, and not merely Control-clicked on the item while its +enclosing folder+ is highlighted. Otherwise you might find that, for example, you've moved your entire User Library folder into your Utilities folder, leaving you to wonder later how that could have happened...
Good luck!
Regards, Andrew99

Moving Member in Entity Hierarchy

Hi Guys,
I have just been given the task of moving a member in our entity hierarchy.
I know how to move the member, but do I have to re-consolidate the data after the move, and how far back do I re-consolidate?
Thanks

Thanks for that, Just a Q on the journal entries.
What "Special" way do they have to be treated?
I dont think there are any journlas processed on this entity but I will check.
Any other advice/considerations to take into account when moving an entity?

Service Manager "Error communicating with component" after moving SQL servers

We just moved our SCCM database to a new SQL server and ever since, I've been getting stumped as to why I'm getting the following error each time I try to query the status of anything under the SQL server:
Error communicating with component
Admittedly, I'm a total novice when it comes to SCCM and I was doing this under the loose supervision of my predecessor (this is his last week). I appreciate anyone offering any advice as to where I should start, and I apologize I'm not knowledgeable
enough yet to know exactly what info to provide you with initially!
Thanks!

Thanks for the quick replies!
@Peter: Currently using SCCM 2012 R2 running on a 2008 server, with the database having moved from SQL 2010 to 2012. We have a single primary site with 5 additional distribution points supporting around 260 users.
We did only change our SQL server and the guide you posted is the exact one we used. Everything seemed to look exactly like the guide. Afterwards, when checking the Configuration Manager Server Manager, under Servers, it had my SCCM server and
new SQL server both listed. The components listed under my SQL server were as follows:
SMS_COMPONENT_MONITOR
SMS_EXECUTIVE
SMS_MP_FILE_DISPATCH_MANAGER
SMS_OUTBOX_MONITOR
SMS_SITE_SQL_BACKUP_SCCM01
SMS-SRS_REPORTING_POINT
However, when we query those components, we get "Error communicating with component" on all of them except SMS_SITE_SQL_BACKUP_SCCM01. I'm slightly suspicious of our certificates but I'm not well-versed enough with them to troubleshoot effectively
on my own.

Moving member servers without DC

Similar Messages

Maybe you are looking for