Migrating enterprise root CA from 2003 to 2008R2 - specific situation


so have following setup:

windows 2003r2 sp2 - owning fsmo roles, root ca

windows 2003r2 sp2 - dc

i want upgrade domain windows 2008 r2 , migrate root ca. since ca migration essential preserve same name high level order of actions?

1) move fsmo roles 2nd win2k3 dc

2) backup ca 

3) depromo , remove server domain

4) join win2k8r2 domain under same name

5) restore ca on it

6) prepare forest/domain

7) dc promo

8) transfer fsmo roles

9) depromo , remove old servers

or

1) move fsmo roles 2nd win2k3 dc

2) join win2k8r2 domain 

3) backup root ca

4) prepare forest/domain

5) depromo , remove ex win2k3 server domain

6) rename win2k8 matches removed server

7) restore ca on it

8) dc promo

9) transfer fsmo roles

10) depromo , remove old servers

biggest question should dc promo 1st , restore ca or other way around?


you may want check out ad cs migration guide - http://technet.microsoft.com/en-us/library/ee126170(v=ws.10).aspx

here also, excellent blog post on subject might provide easier path: http://blogs.technet.com/b/askds/archive/2010/08/23/moving-your-organization-from-a-single-microsoft-ca-to-a-microsoft-recommended-pki.aspx  method might let without forcing demote/restore/cutover downtime scenario.

additionally, best practices separate ad ds , ad cs roles.  microsoft advocates creating offline root ca (a vm do) , an enterprise issuing ca.  best practices below (2003 still applicable).  having read doc. know it's ton of info it's nice have point of reference when there questions.  

http://technet.microsoft.com/library/cc772670.aspx

not straightforward answer you were looking for, couple of approaches that may decrease risk/impact of hard cutover.  



Windows Server  >  Directory Services



Comments

Popular posts from this blog

Edit Group Policy

Hyper-V VM not reaching OS 'Logon' screen

DNS question...