Migrating enterprise root CA from 2003 to 2008R2 - specific situation
so have following setup:
windows 2003r2 sp2 - owning fsmo roles, root ca
windows 2003r2 sp2 - dc
i want upgrade domain windows 2008 r2 , migrate root ca. since ca migration essential preserve same name high level order of actions?
1) move fsmo roles 2nd win2k3 dc
2) backup ca
3) depromo , remove server domain
4) join win2k8r2 domain under same name
5) restore ca on it
6) prepare forest/domain
7) dc promo
8) transfer fsmo roles
9) depromo , remove old servers
or
1) move fsmo roles 2nd win2k3 dc
2) join win2k8r2 domain
3) backup root ca
4) prepare forest/domain
5) depromo , remove ex win2k3 server domain
6) rename win2k8 matches removed server
7) restore ca on it
8) dc promo
9) transfer fsmo roles
10) depromo , remove old servers
biggest question should dc promo 1st , restore ca or other way around?
you may want check out ad cs migration guide - http://technet.microsoft.com/en-us/library/ee126170(v=ws.10).aspx
here also, excellent blog post on subject might provide easier path: http://blogs.technet.com/b/askds/archive/2010/08/23/moving-your-organization-from-a-single-microsoft-ca-to-a-microsoft-recommended-pki.aspx method might let without forcing demote/restore/cutover downtime scenario.
additionally, best practices separate ad ds , ad cs roles. microsoft advocates creating offline root ca (a vm do) , an enterprise issuing ca. best practices below (2003 still applicable). having read doc. know it's ton of info it's nice have point of reference when there questions.
http://technet.microsoft.com/library/cc772670.aspx
not straightforward answer you were looking for, couple of approaches that may decrease risk/impact of hard cutover.
Windows Server > Directory Services
Comments
Post a Comment