How to Install a Replica DC in an Existing AD Domain on Windows 2000

How do I install a second Domain Controller in my Active Directory domain on my Windows 2000 Server?
First make sure you read and understand Active Directory Installation Requirements. If you dont comply with all the requirements of that article you will not be able to set up your AD (for example: you dont have a NIC or youre using a computer thats not connected to a LAN).

Note: This article is only good for understanding how to install the SECOND DC in an EXISTING DOMAIN in and EXISTING AD FOREST.
Note: For the installation of the FIRST DC in the AD Domain read How to Install Active Directory on Windows 2000.
Lamer Note: For the installation of the FIRST DC in the AD Domain read How to Install Active Directory on Windows 2000 (for idiots).
Here is a quick list of what you must have:

  • An NTFS partition with enough free space
  • The Domain Admins username and password
  • The correct operating system version
  • A NIC
  • Properly configured TCP/IP (IP address, subnet mask and – optional – default gateway)
  • A network connection (to a hub or to another computer via a crossover cable)
  • A persistent and un-interrupted connection with the domains existing DC
  • An operational DNS server which holds the relevant SRV Record information for the AD domain and forest
  • The Domain name for the domain that you want to join
  • The Windows 2000 CD media (or at least the i386 folder)
  • Brains (recommended, not required…)

This article assumes that all of the above requirements are fulfilled.
For a Windows 2000 version of this article please read How to Install a Replica DC in an Existing AD Domain on Windows Server 2003.

Step 1: Configuring the computers TCP/IP settings

You must configure the would-be Domain Controller to use the IP address of the DNS server, so it will point to it when registering SRV records and when querying the DNS database.

Configure TCP/IP

  1. Click Start, point to Settings and then click Control Panel.
  2. Double-click Network and Dial-up Connections.
  3. Right-click Local Area Connection, and then click Properties.

w2k netconfig small

  1. Click Internet Protocol (TCP/IP), and then click Properties.

w2k netconfig1 small

  1. Assign this server a static IP address, subnet mask, and gateway address (optional). Enter the DNS servers IP address in the Preferred DNS server box.

Note: You MUST have an operational DNS server that already serves as the DNS server of the domain/forest.
w2k netconfig6 small

  1. Click Advanced.
  2. Click the DNS Tab.
  3. Select “Append primary and connection specific DNS suffixes”
  4. Check “Append parent suffixes of the primary DNS suffix”
  5. Check “Register this connections addresses in DNS”. If this Windows 2000-based DNS server is on an intranet, it should only point to its own IP address for DNS; do not enter IP addresses for other DNS servers here. If this server needs to resolve names on the Internet, it should have a forwarder configured.
  6. Click OK to close the Advanced TCP/IP Settings properties.
  7. Click OK to accept the changes to your TCP/IP configuration.
  8. Click OK to close the Local Area Connections properties.

Step 2: Running DCPROMO

After completing all the previous steps and after double checking your requirements you should now run Dcpromo.exe from the Run command.
Note: In Windows Server 2003, unlike Windows 2000, you can choose to install the Replica DC from a backed-up media thus saving considerable amounts of time and bandwidth. Read Install DC from Media in Windows Server 2003 for more info.

  1. Click Start, point to Run and type “dcpromo”.
  1. The wizard windows will appear. Click Next.

w2k dcpromo small

  1. Choose Additional Domain Controller for an existing domain and click Next.

w2k dcpromo26 small

  1. In the Network Credentials window enter the username and password for a Domain Admin in the domain youre trying to join. also enter the full DNS domain name. Click Next.

w2k dcpromo27 small
This step might take some time because the computer is searching for the DNS server.
Note: Although the wizard will let you get to the last window and begin to attempt to join the domain, if you enter the wrong username and/or password, because of the wrong credentials youll get an error message like this one:
w2k dcpromo31 small
If you get the domain name wrong youll get this warning:
w2k dcpromo29 small

The wizard will not be able to continue past the domain name window.
If you have wrong DNS settings, i.e. the computer “thinks” that it should be “talking” to one DNS server, while in fact it should be using another DNS server, youll get an error message like this one:
w2k dcpromo30 small

  1. Accept the Database and Log file location dialog box (unless you want to change them of course). The location of the files is by default %systemroot%\NTDS, and you should not change it unless you have performance issues in mind. Click Next.

w2k dcpromo6 small

  1. Accept the Sysvol folder location dialog box (unless you want to change it of course). The location of the files is by default %systemroot%\SYSVOL, and you should not change it unless you have performance issues in mind. This folder must be on an NTFS v5.0 partition. This folder will hold all the GPO and scripts youll create, and will be replicated to all other Domain Controllers. Click Next.

w2k dcpromo7 small

  1. Enter the Restore Mode administrators password. You can leave it blank but whatever you do – remember it! Without it youll have a hard time restoring the AD if you ever need to do so. Click Next.

w2k dcpromo9 small

  1. Review your settings and if you like what you see – Click Next.

w2k dcpromo32 small

  1. See the wizard going through the various stages of installing AD. Whatever you do – NEVER click Cancel!!! Youll wreck your computer if you do. If you see you made a mistake and want to undo it, youd better let the wizard finish and then run it again to undo the AD.

w2k dcpromo33 small w2k dcpromo34 small

  1. If all went well youll see the final confirmation window. Click Finish.
  1. You must reboot in order for the AD to function properly. Click Restart now.

w2k dcpromo14 small

Step 3: Checking the AD installation

You should now check to see if the AD installation went well.

  1. First, see that the Administrative Tools folder has all the AD management tools installed.

w2k dcpromo17 small

  1. Run Active Directory Users and Computers (or type “dsa.msc” from the Run command). See that all OUs and Containers are there. See that your DC is listed in the Domain Controllers Container.
  1. Run Active Directory Sites and Services. See that you have a site named Default-First-Site-Name, and that in it your server is listed along with the other DC in the domain/forest.
  1. Open the DNS console. See that your new DC has registered itself in the 4 SRV Record folders.

One reason for the lack of registration of SRV records is the fact the net NETLOGON service has somehow failed to register the SRV Records in the DNS zone.
You should try to restart the NETLOGON service to force the SRV registration.
From the command prompt type “net stop netlogon“, and after it finishes, type “net start netlogon“.
w2k dcpromo22 small
Let it finish, go back to the DNS console, click your zone and refresh it (F5). If all is ok youll now see the 4 SRV record folders.

  1. Check the NTDS folder for the presence of the required files.

w2k dcpromo23 small

  1. Check the SYSVOL folder for the presence of the required subfolders.

w2k dcpromo24 small

  1. Check to see if you have the SYSVOL and NETLOGON shares, and their location.

w2k dcpromo25 small
If all of the above is ok, I think its safe to say that your AD is properly installed.
If not, read Troubleshooting Dcpromo Errors.

Links

Windows 2000 Deployment Planning Guidelink out ico
Download the Deployment Planning Guide (Complete, 3.91mb)link out ico
Troubleshooting Common Active Directory Setup Issues in Windows 2000 – 260371link out ico
Setting Up the Domain Name System for Active Directory – 237675link out ico
Information About Configuring Windows 2000 for Domains with Single-Label DNS Names – 300684link out ico