Question: Upgrading 10.3.9 PDC to 10.4

Question

OK, so here's my situation:
Running a Dual G5 Xserve with 10.3.9 as the Open Directory Master and the Primary Domain Controller for my Windows clients (around 150 Win PCs).
I also have an old G4 Tower running 10.3.9 as an OD Replica.
What is the best way to upgrade these machines to 10.4 while still maintaining my Windows domain? I attempted this upgrade a few months back, with disastrous results. I tried to upgrade 10.3 to 10.4, and the XServe was unbootable. So I did a clean install of 10.4, which worked, but screwed my Windows clients, as the new installation of 10.4 as a PDC gave the domain a new SID, and the Win clients refused to see it as the same domain.
I found some hints on the web about resetting the SID to the original setting, but this did not work. Eventually, I rolled my XServe back to 10.3.9 and gave up on the whole thing. I'm about ready to try again, but would welcome any advice from people who have upgraded an OS X PDC. How did you do it?
I know that in general, a clean install of 10.4 is recommended over an upgrade from 10.3. But it seems the only reliable way to keep the domain identification stable is by upgrading.
Of course, if I were able to have a Backup Domain Controller (BDC), it would maintain the domain identification through this process. But 10.3 doesn't permit a BDC role, and a 10.4 server can't be a BDC for a 10.3 PDC. It's a Catch-22!!
One strategy I've considered is just to build a temporary Windows NT box and use it as the BDC through this process, allowing it to maintain the domain consistency while the Macs are being upgraded. An inelegant solution, but if it works and saves me some headaches, I'm all for it. Has anyone done this? I'm imagining I would build the NT box, set its role to BDC, then take the XServe offline, promote the NT box to PDC, rebuild the XServe with Tiger, promote it to PDC and demote the NT box back to BDC.
Eventually, I would then rebuild the G4 Tower or another Mac with Tiger server and use it as the OD Replica and BDC, and take the NT box out of the loop. Would this work? Would I still have to export/import my OD and password database? Or would it replicate to the NT BDC?
Any suggestions from anyone who's already fought this battle would be greatly appreciated.

Answer 1

Hey, let's revive this thread for a bit. I am going through some test simulations of our server setup, but I have a twist to it. First off, my primary server is similar to the situation described here, but I was successful doing a straight upgrade. It's phase 2 I am having issues with, and I'm wondering if anyone has experience with that. Specifically, setting up a BDC on a separate subnet and having it actually do what it's supposed to...
So my saga so far:
1) Set up an isolated network with it's own gateway router. Do the same for a second subnet. Connect the two with a cheap Linksys router set to router mode. This represents my Local LAN and my Remote LAN, connected by VPN tunnel.
2) Clone my primary G5 running 10.3.9 as OD Master/PDC to a spare box. (SuperDuper Rules!) Boot it up on the test Local LAN. Immediately set a static route to the pseudo-VPN tunnel IP.
3) Install brand new 10.4.6 on a different box on the second subnet in prep for the BDC test. Set the reverse static route. Make sure everybody pings happily. (For those that want to say don't set static routes in the host, set them in the gateway router, I tried that, but my crappy Linksys routers couldn't handle it.)
4) Uninstall various 3rd party stuff like Norton Antivirus and retrospect from the clone. Clean up as best I can in prep for upgrade.
5) Upgrade. (This didn't work at first using an external firewire drive, so I got a 250GB IDE drive for the simulation Mac, a Quicksilver 2002.) After upgrade, let it commune with Apple for a while to get to 10.4.6.
6) For whatever reason, after the upgrade I had to go into Directory Access and set the LDAP path up again. That's not even Samba specific, so I'm surprised it's not covered by upgrades. Another issue unresolved is a corruption of my DNS config. In the GUI for DNS I would see zones active on the Overview tab, but nothing on the Configure Zones tab. I was resolving, but I wasn't able to modify the zone! After adding the same zone, deleting it again, and adding it again, (and maybe one more cycle, with odd behaviour all the time with fields blanking themselves out magically) it finally stabilized.
At this point, I am able to log in from my Windows machines. Whew! But my task is half over.
7) I go to my Remote box and set it up as OD replica, per the BDC tech note. Some glitches here, mostly having to do with static routes. (best way in 10.4 to make 'em persistant?) Eventually I can use Workgroup manager on either box and the changes are instantly mirrored. Yay!
8) Modify the DNS on both to have the other as seconday zone. Set WINS on the replica to refer to the master. A question here: I would expect that to set WINS Proxy in the smb.conf file, but it doesn't?
9) Make it a BDC!
10) DHCP is set by the gateway router, not the Mac, so I make sure that DNS and WINS are set properly.
11) Copy the login batch file from the primary to the replica NETLOGON directory.
12) Add explicit Profile directories to the test user under the Windows tab. (\\server1\users\profiles\testuser)
13) Move a test PC to the second subnet, boot up, add the correct persistent route, don't forget to remove the incorrect one! And yes, it logs in just fine, I get my profile shipped to me over the pseudoVPN, get my drives mapped by the batch file, Yay!
For those of you that have stuck with me this far, Thanks! This is where I was late yesterday, and I did one final test. I shut down the Master, leaving the BDC system up. I rebooted the Windows PC. Tried to logon. Didn't work. Basically a domain controller failure. What do I do next? I went home.
I will be working out a better documented pattern of behaviour later this week, but I'm fairly disappointed by early results. I need to test a Mac in the same model, to see if the OD replica is working or not, since Samba is pulling from it. Any sage advice from those of you with WAN links, trying to get a PDC/BDC model working reliably?
TIA!
jth
Xserver G5 2GHz/1.0GB   Mac OS X (10.3.9)