Upgrading a 2008 Server to 2008r2 including schema

Upgrading a 2008 Domain to 2008r2
This document is presuming current domain level is 2008, with all 2008 Domain Controllers.
Step 1 ? Upgrade the schema
The tools for this are provided on the Server 2008 r2 DVD, in the \support\adprep folder First copy this entire folder onto the C:\ drive of the Forest?s schema master. There are various tools online to locate your infrastructure master (if you don?t know it), but you can easily identify it using AD Users & Computers Console. Just right click on the tree root, select all tasks, and operations masters.
From an elevated command prompt, go into the adprep folder which was previously copied;
Cd c:\adprep
Type in the following command;
Adprep /forestprep

If you plan to implement any read only DCs, also run;
Adprep /rodcprep
Before doing anything else, wait at least 10 minutes. It can take up to 5 minutes for changes to replicate through the forest
Next copy the folder adprep to the infrastructure master, onto the local C:\ drive. Open up an elevated command prompt, and go into the adprep folder;
Cd c:\adprep
Type in the following command;
Adprep /domainprep /gpprep
Keep ad changes to a minimum for at least 10 minutes. The schema is now upgraded to Server 2008 r2, and can support Server 2008 r2 Domain Controllers.
Step 2 ? Upgrade each domain controller
Once the upgraded schema is in place, you can begin to upgrade your DCs.
The most import issue to address is that your DCs cannot be 32 bit. Server 2008r2 is only available in 64 bit. If you do have 32 bit DCs you will need to demote/remove and rebuild them as 64 bit Server 2008r2 DCs.
The good news is that 2008 64bit DCs can be upgraded, without having to be removed from AD. The only thing you must do first is transfer any roles off the DC whilst the upgrade takes place. This is essential, as if the upgrade fails and your server dies, you are safe in the knowledge that AD will still function.
The following article describes which AD tools can be used to identify which server?s are holding roles, and how to move them to other servers;
http://support.microsoft.com/kb/324801
You may currently have certain services running in your environment which point to specific DCs because that DC holds a specific role. As such, I would advise that after upgrading a DC you reinstate the roles onto it which it previously held. This will minimize impact. I?d also suggest doing this out of hours, or during a quiet period, so that AD changes are minimal during the process.
Once you have removed the roles from the first server you want to upgrade, just stick the Server 2008r2 DVD into the drive (or mount the ISO).
Step 3 ? The Install
Firstly, Microsoft suggests running their memory (RAM) checker before performing an upgrade, this can be found here;
http://go.microsoft.com/fwlink/?LinkId=50362
The disc should auto-run, if it doesn?t just run setup.exe from the root.
The only option you have when the flash screen appears is INSTALL. Click on Install.
You will get an option next to go online for the latest updates to the installation. I would always suggest choosing this option. As of 27 Jan 2010, choosing the option to download the latest updates took an extra 1 second, and downloaded around 1Mbs worth of updates.
Next you get a list of versions of 2008r2 server available on the DVD. Changing varieties can be tricky/impossible. For example you can?t go from Data Centre edition to Enterprise Edition. In most cases you will simply be choosing the same version as the server is already running. Eg, your DC is currently running 2008 Enterprise 64 bit Full Install (not core), so choose the 2008 R2 Enterprise Full Installation.
After you click next accept the license terms.
You will then get two options. Upgrade or Custom. Choose upgrade.
You will get a warning about any issues which may exist. The generic one seems to be that you should check that any software installed on the server is supported to run on Server 2008 r2. It would be very unlikely that software which works on 2008 wouldn?t work on 2008r2, but the warning is there. If any windows updates have been performed you may also be told that you need to reboot the server before running the upgrade.
Once you?re ready click next, and Windows will start copying files and upgrading. The warning indicates that this can take several hours, but in practice seems to complete in around 60 minutes, as the upgrade only copies around 2Gb of data. The server will reboot part way through expanding files (around 18%). After the ?installing features and updates? step the server will reboot again, during which the machines registry settings will be updated. One final reboot will take place after ?Transferring Programs & Settings?. The loading screen will state ?Setup Is Preparing Your Computer For First Use?. Don?t worry, it?s still the same DC, just a slightly ambiguous message.
Once the boot up completes the server is ready to use, and you can restore any roles back onto it which you might have transferred away.
Thats it.

W32.Downadup.B Arghhhhhhhh

It's been 6 years since we were last hit by a major virus, but we have just been hit again (along with a few million others) by W32.Downadup.B

What did it do?: It removed ability of users to log-in to the domain. The following entry appeared in droves on domain controller; "The SAM database was unable to lockout the account of Administrator due to a resource error, such as a hard disk write failure (the specific error code is in the error data) . Accounts are locked after a certain number of bad passwords are provided so please consider resetting the password of the account mentioned above." with an event ID of 12294. At the peak we were probably experiencing around 100 per second.

The end result of the above was that due to the sheer number of requests, active directory was unable to authenticate genuine users....who were getting their account locked instead of getting logged in. Ironically this wasnt the main intension of the virus, just a side effect. In actual fact the virus looks to upload any passwords it finds to a remote server. In order to avoid detection the writers made it upload to a few thousand random domain names to avoid detection by the authorities.

Some more info;
http://www.microsoft.com/security/portal/Entry.aspx?Name=Worm%3aWin32%2fConficker.B

How did we get rid of it?: Firstly we had to disable every single account on the domain with local or domain/enterprise security rights. You can imagine the hassle this is going to cause in terms of service run-as issues. We also had to unplug any administrative workstations from the network and run all fixes direct from the servers.

Micrsoft have provided a tool for prevention, also provided in the form of a windows update (should you happen to do those on a weekly basis);

http://support.microsoft.com/kb/891716

They do however suggest that deployment via Group Policy is not suitable for servers, and kindly provide a handy 36!! step manual process. You can however reduce this to around 5 steps by using Symantec Antivirus, a bit of quick registry editing, and the removal tools.....probably 15 minutes per server. I'd also suggest regular password changing of any admin account you are using, just to ensure that it isnt grabbed and used by an infection.

The only method we have found thus far to remove the threat from an infected PC is to perform a full system scan using Symantec AV. Not great for the users given the load it puts on the workstations, but at least its a fix!

I'm sure this wont be the last such threat, and its been our first since moving to Active Directory.... but I'll be looking into how we can deploy windows updates using SCCM2007 on a regular basis!