SBS 2003 R2 Premium Migration to 2012 R2 Domain and Exchange 2013

We are beginning our adventure migrating our last SBS 2003 R2 Premium server setup to a completely new setup.

We used the ShadowProtect backup image to restore to our Hyper-V server and utilized the Hardware Independent Restore process to inject the Hyper-V 2012 R2 VM drivers so we did not get any blue screens on the restored VM OS.

Our goal will be to end up with an RWA setup in 2012 Essentials R2 or we will be pitching the new Scorpion Software AuthAnvil Portal setup as an RWA replacement to this firm (and eventually all firms we manage).

Given that most accounting firms need to log into many different sites for their day-to-day routines we believe that new portal service will meet that need along with the partners that would prefer a short PIN to log on. :)

Plus it will give them a huge step up in security.

For now, we have their server up and running on one of our Server 2012 R2 Hyper-V lab setups as we will be running through the migration process a few times to make sure we have everything down.

We set up a Windows 7 Professional SP1 VM to verify that the SBS 2003 was happy:

The SBS Connect Computer wizard was run to successfully connect the Win7 VM to the SBS domain. From there we installed Office 2010 SP1 and reset a couple key user's passwords to hook into their profiles.

We are now ready to begin the migration process in our lab.

1. Install: Windows Server 2012 R2 DC VM
2. Install: Windows Server 2008 R2 OS Temp VM
1. Exchange 2010 with current SP installed
3. Migrate Mailboxes and Public Folders
4. Install: Windows Server 2012 RTM VM
1. Install Exchange 2013 and CU3
5. Migrate Mailboxes and Public Folders
6. Install: Windows Server 2012 R2 VM(s)
1. LoB Migration

Once we have run through the above process we will then move on to migrating their actual production network.

Philip Elder
Microsoft MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business

SBS 2011 Standard: Install Error 0x80300001 - "Windows cannot be installed to Disk 0 Partition 1" OR "Cannot find a System Partition"

There was one other error that came up depending on if we SHFT+F10 to get to the command prompt and try formatting using DiskPart.

Internet searches came up with swapping optical disks between the Windows installer disk and the driver disk but we had everything including the Answer File (this was a migration run attempt in a lab setting) on a bootable USB flash drive.

After fighting with it for an hour we brought in another known good bootable USB flash drive that had the SBS 2011 Standard install files on it and low and behold the process worked!

Meh ... Very frustrating to run through all of that troubleshooting only to find out that the ISO we pulled the files from was bad.

So, the second step in troubleshooting any Windows OS install error in WinPE is to download a new ISO, format a flash drive as bootable using DiskPart, and copy the SBS files over.

• Blog Post: Windows Vista - Using the DiskPart Command to Create a Bootable USB Flash Drive
• Note, for SBS files use NTFS for the file system since the WIM file is over 4GB in size.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen
Find out more at
www.thirdtier.net/enterprise-solutions-for-small-business/

Windows Live Writer

How To Clean Up AD/DNS/Replication Links After A Failed SBS Destination OS Install or DCPromo

UPDATE: We moved the NTDSUtil step to the front of the pack.

Whenever we run into problems with getting the destination server online, for whatever reason, we have the option to do the following:

• Restore the System State.
  • This means running the SourceTool again.
• Restore the Server
  • Restore from ShadowProtect or other backup.
  • Caveat is that any incoming mail since the backup could be lost.
• Clean up the Source Server
  • Clean DNS
  • Clean AD Sites & Services
  • Verify Global Catalogue
  • Seize FSMO Roles

Please keep in mind that these instructions are specific to situations where our destination has not made it far enough to install Exchange and its connectors on the Source SBS 2003 server.

We need to run the NTDSUtil step first:

• Microsoft KB 216498: How to remove data in Active Directory after an unsuccessful domain controller demotion
• Keep that ntdsutil.exe session open from above for this one.
• metadata cleanup
• . . .
• remove selected server

We moved the NTDSUtil step to the fore as there are a few additional underlying bits that the utility removes that may help in the next SBS 2011 Standard OS run.

Our second step is in Active Directory Sites & Services

• Remove the replication links for both servers
• Source Server:
• Delete NTDS Settings
• Delete the Server Container
• NOTE:

In Active Directory Users and Computers

• Remove the Destination SBS 2011 from the Domain Controllers container

In DNS Forward Lookup Zones and Reverse Lookup Zones

• Remove all references to the Destination Server in _msdcs.domain.local
  • DNS A Records
  • DNS N (Name Server tab)
  • IP Address
• Remove all references to the Destination Server in Domain.Local
  • DNS A Records
  • DNS N (Name Server tab)
  • IP Address
• Remove all references to the Destination Server in 192.168.99.x Subnet
  • DNS A
  • DNS N (Name Server tab)
  • IP Address

Once all references in AD and DNS have been removed we need to verify that our source is still a Global Catalogue server. This is done in AD Sites & Services.

Then, we reverse the FSMO Role transfer that happens early in the SBS 2011 OS install and configuration process.

• Microsoft KB 255504: Using Ntdsutil.exe to transfer or seize FSMO roles to a domain controller
  • Schema Master
  • Domain naming master
    • Naming Master on 2008 R2
  • RID master
  • PDC emulator
  • Infrastructure master

We can verify the FSMO Role locations at the command prompt:

• netdom query fsmo [Enter]

Once we have completed our clean-up steps we are ready to make our SBS 2011 Standard OS install run attempt.

If errors were due to a Schema Mismatch error then we check the AD version here:

• Registry: HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters\<Schema Version>
  • Windows 2000 RTM with all Service packs = Schema version 13
  • Windows Server 2003 RTM with all Service packs = Schema version 30
  • Windows Server 2003 R2 RTM with all Service packs = Schema version 31
  • Windows Server 2008 RTM with all Service packs = Schema version 44
  • Windows Server 2008 R2 RTM with all Service packs = Schema version 47
  • Windows Server 2012 RC = Schema version 56

Our particular Schema version when working with SBS 2011 Standard after the SourcePrep Tool is run successfully is 47.

NOTE: The above steps are destructive! Please have a backup and make sure to verify what is being deleted _before_ the object is deleted!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

 Subscribe in a reader

SBS 2003: Wants to ChkDsk on Reboot So Disable Disk Check

The SBS 2003 R2 Premium server we are migrating way from this weekend is not well. It is well enough to boot okay but it wants to ChkDsk the backup drive every time it boots.

fsutil dirty query D: [Enter]

When we query the status of the backup drive as above it comes up NOT Dirty. Yet, the server insists on checking it on a boot.

So, we disable the auto check for that volume:

chkntfs /x d: [Enter}

We can then move on with this box without having to try and catch the ChkDsk process before it starts or waiting and waiting and waiting until it finishes – if it ever does.

• Microsoft KB 160963: CHKNTFS.EXE: What You Can Use It For

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

SBS Migration Guide and SBS Setup Guide Updated

We have added quite a few steps to both our Migration Guide and our Setup Guide.

• Guide - SBS 2011 Setup
• Guide - SBS 2003 to SBS 2011 Migration

Please do use these guides for your own SBS 2011 Standard setup and migration processes!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

SBS 2003 to SBS 2011 Migration Guide – v1.4.0

It is important to note that this Migration Guide is closely tied into our SBS 2011 Setup Guide which can be found here:

• MPECS Inc. Blog: SBS 2011 Setup Guide

The official Microsoft migration document can be found here:

• Microsoft Downloads- Migrate to Windows Small Business Server 2011 Standard from Windows Small Business Server 2003
• MPECS Inc. Blog: SBS 2003 to SBS 2011 Microsoft Migration White Paper on TechNet
• The Official SBS Blog: SBS 2011 Standard Migrations – Keys to Success

Microsoft now has an official migration Web site for SBS!

• Microsoft: Windows Small Business Server Micro Site

If installing SBS 2011 into a VM setup then keeping that VM’s time accurate is important.

• MPECS Inc. Blog: Hyper-V- Preparing A High Load VM For Time Skew
  • Note: Configure time on standalone host to poll pool.ntp.org and set a firewall exception for UDP NTP port 123. Set all DC guests to poll the host for time.
• MPECS Inc. Blog: SBS 2011 – Installing The OS Into A VM – Time

SBS 2003 to SBS 2011 Migration Steps

These preparatory steps still apply:

• SBSDiva (Susan Bradley): Making sure you have a clean AD.
• David Overton: Active Directory Health Check - Make sure your AD is healthy before you migrate SBS 2003 to SBS 2008.

A couple of very important things to note:

• Have a backup of the SBS 2003 box and System State BEFORE beginning the migration process!
• You will need the SBS install disk 2 with the Exchange65 folder for the Exchange uninstall step!

We use both NTBackup to create a system state backup as well as ShadowProtect to create a full server image before initiating any changes on the production network.

In the case of ShadowProtect, we will have it on the SBS 2003 box at least a couple of days before the migration process starts to get a base full backup and set an incremental schedule as well. Then, when it comes time to begin the migration we can run incremental backups during the process which are very short in duration.

Preparation for Migration

It is important to be prepared for the coming migration. One of the steps we need to be prepared is to have all of the up to date drivers and firmware downloaded before running the migration process. It is important to make sure that the server hardware’s firmware is up to date before putting the server into production.

Updates

• Server Hardware
  • RAID Controller firmware.
  • Server Board firmware.
  • RAID and server board drivers.
  • Hardware management software.
• Server OS and Server Apps
  • Download the most recent service packs for OS, Exchange, SharePoint, etc.
• Printers and Copiers
  • X86 (32-bit) and x64 (64-bit) Printer Drivers
    • WHQL certified drivers are preferred if possible.
    • Used to deliver the printers to the workstations via Group Policy.
    • If XP is still around have the PushPrinterConnections.exe utility handy.
• LoB Applications
  • Updates for the LoBs and their MySQL, SQL, or other database backend are good to run at this time.
  • Have Simply or QuickBooks downloaded as they are large.

DHCP

Itemize the DHCP reservations on the source server if they are not already documented somewhere. If the reservations are going to be restructured then make sure to have the MAC addresses on hand for each device.

• Device MAC: ____________________ Description: ____________________
• Device MAC: ____________________ Description: ____________________
• Device MAC: ____________________ Description: ____________________
• Device MAC: ____________________ Description: ____________________

SSL

Run a full export of the third party trusted certificate (SSL) that is being used and password protect it. Have it handy to import into the destination server when the time comes.

PHASE 1: SBS 2003 Preparation Steps

1. SBS 2003 with 2 NICS and/or ISA.
   • Uninstall ISA and run CEICW
   • Install firewall appliance or gateway.
   • Set NIC1 Gateway to the new device.
     • IP: 192.168.40.254
     • Subnet: 255.255.255.0
     • Gateway: 192.168.40.1 (gateway device)
     • DNS1: 192.168.40.254 (self)
     • DNS2: Blank
   • Disable NIC2 and run CEICW.
   • Verify that the DNS Server service is working as expected. A reboot may be required.
2. If SBS 2011 will be using an existing RWW URL that is protected by a third party certificate, make sure to export that certificate from SBS 2003 with the key and import it using the wizard on SBS 2011 at the appropriate time.
   • OPTION: Have the certificate issuer’s site logon information on hand to use for a rekey of the certificate using the SBS 2011 Third Party Trusted Certificate wizard.
3. Make sure that the up to date Windows Server 2003 Resource Kit Tools (download) and Service Pack 2 Support Tools (download) are installed on SBS 2003.
4. Verify Active Directory Forest and Domain levels are set to Windows Server 2003 native.
5. Reset the Active Directory Restore Mode password (MS KB322672).
   • 
6. Verify that Exchange 2003 is running in Native Mode (Step 17 on the SBS 2003 Setup Checklist).
   • Also make sure the Exchange Management Console is showing the routing groups in step 16 of the above list.
7. Verify that Exchange 2003 has Service Pack 2 installed and functioning as expected.
   • Verify the tabs for the Intelligent Message Filter and the UCEArchive post SP2 fix (previous blog post).
8. Verify that the default SBS SMTP Connector is installed.
   • Also check for any additional connectors installed as they will interfere with the replication of Public Folders.
9. Remove any SmallBusiness SMTP Connector Forwarding.
   • 
10. Verify and record any custom Send As setups for Exchange users. They will need to be manually set up on the new SBS 2011 server.
11. Verify Windows Server 2003 Service Pack 2 is installed.
    • The SBS 2003 BPA will help with the post SP2 fixes if any were missed.
12. Verify that SBS 2003 has Small Business Server 2003 Service Pack 1.
    • 
    • HKLM\Software\Microsoft\SmallBusinessServer\ServicePackNumber
13. The following are run from the command prompt to test Active Directory health:
    1. DCDiag
    • DCDiag [Enter]
    • DCDiag /test:DNS
    • DCDiag /? (List of switches)
    1. NetDiag
    2. RepAdmin
    • RepAdmin /viewlist *
    • RepAdmin /SyncAll
    • RepAdmin /KCC
    1. NetDom /query FSMO
14. Verify that the SBS 2003 CA is clean before starting.
1. Microsoft KB 889250: How to decommission a Windows enterprise certification authority and how to remove all related objects from Windows Server 2003 and from Windows Server 2000
1. Step 6 (We had to empty all folders before our last migration ran successfully on 2012-0723).
2. Bad on left (our source) good on right (client product SBS 2003):
3. 
4. All folders on the right were actually empty. This is a server we set up about three years ago. The server on the right was a contract job.
15. The following can be done to test the health of the Exchange databases at the command prompt and with the stores dismounted (remember to backup):
    • MS KB192185: How to defragment with the Eseutil utility (Eseutil.exe)
    • TechNet: Eseutil /G Integrity Mode.
    • TechNet: Eseutil /P Repair Mode.
    • MS KB301460: Exchange Command-Line Parameters for Isinteg.exe Tool
16. Exchange mailbox prep.
    1. Possible Error: SBS Migration Error- Exchange – The token supplied to the function is invalid 80090308
       • 
    2. Have everyone empty their Deleted Items folder.
    3. Get everyone to run an Archive process in their Outlook to remove older and not necessarily needed content.
    4. Verify the Replication Message Priority setting for all Public Folders: Urgent 
       • 
    5. Verify the Replication interval setting for the root Public Folder Store: Always run
       • 
17. Download and run the Microsoft IT Environment Health Scanner (download page).
    • If the wizard complains about Subnets in Active Directory Sites and Services it is safe to ignore the error.
    • What to do if the scanner has a DNS WMI error (previous blog post).
18. Run the server time setup step.
    1. w32tm /config /syncfromflags:domhier /reliable:no /update [Enter]
    2. net stop w32time && net start w32time [Enter]
       • Standalone Hyper-V or VMware: Configure the host to poll pool.ntp.org and allow the guests to poll the host through the firewall for time.
19. Verify that the default Administrator (500 Account) has the Primary Group set to Domain Users.
20. Run the SBS 2003 Best Practices Analyzer and follow its recommended steps.
21. Backup SBS 2003 completely.
    • TIME:________
22. Backup the SBS 2003 system state with NTBackup.
    • TIME:________
    • 
    • Note that the System State backup in the above image was run from within NTBackup on the source server.
23. Run the VPN Wizard to disable VPN PPTP services on the source server.
24. Download and install the Microsoft Baseline Configuration Analyzer 2.0
    • Microsoft Baseline Configuration Analyzer 2.0
    • This is required before installing and running the Source Prep Too.
25. Run the Source Prep Tool
    • Insert the SBS 2011 DVD and run SourceTool.exe from the Tools folder.
    • A copy of this folder can be placed on the source server if using a USB flash drive to install the SBS 2011 OS.
    • Note that a reboot is required.
    • TIME:________
26. Disable the Update Services (WSUS) on SBS 2003 before installing SBS 2011 in Migration Mode.
    • An alternative is to disable Windows Update and Update Services on the SBS 2008 box during the install process (previous blog post).

PHASE 2: SBS 2011 Migration Mode OS Install

1. Multi-NIC servers: Disable all NICs in the BIOS except #1.
2. We set up an 8GB or 16GB USB flash drive to be bootable using the NTFS file system (previous blog post).
   • The SBS OS image file is well over 6GB in size.
   • We also drop the necessary drivers and server management tools in a folder called Drivers on the flash drive.
3. Set up the Answer File in Migration Mode with the requisite information.
   • SBSAfg.exe is in its own folder under the TOOLS folder on the SBS 2011 DVD.
   • We make two copies of the XML file:
     • 11-06-17-ClientName-SBSAnswerFile.XML
     • SBSAnswerFile.XML (goes on the flash drive)
   • We also create a PDF from within the Answer File Generator.
   • The SBSAnswerFile.XML can be saved to a small VHD if running the migration virtually for a lab test or going into a virtual production environment.
4. Begin the SBS 2011 install in Migration Mode (SBS 2011 Setup Guide).
   • Note that the migration project will jump in and out of the SBS 2011 Guide’s various setup steps.
   • Setup the SBS 2011 RAID 10 array and configure the OS partition.
     • Five or more 15K spindle option: RAID 5 on hardware RAID plus battery backup.
     • A small 5 or so seat firm with low I/O requirements will run fine on RAID 5 with four 15K SAS spindles.
   • Plug the USB flash drive into the server.
   • Note that on some Tier 1 servers the USB flash drive will need to be plugged in once past the SBS 2011 EULA stage.
   • Use the Load Driver dialogue to verify that the server hardware is reading the USB Flash drive with the Answer File.
   • Depending on the hardware manufacturer, make sure to have the latest RAID controller on hand to install. We put it into a folder on the Answer File USB flash drive to keep things simple.
5. Verify the time during the SBS 2011 OS setup process especially if installing in a VM (previous blog post).
6. SBS 2011 Migration Mode status will show on SBS 2003:
   1. ADUC: SBS 2011 will show up in the Domain Controllers OU.
   2. DNS:
      • SBS 2011 will show up in _msdcs.SBSDomain.local with its new GUID.
      • SBS 2011 will show up as a Name Server in SBSDomain.local and 192.168.40.0/24 Subnet (whatever subnet being used).
   3. DSSite.msc: SBS 2011 will show up after the above DCPromo reboot.
      • Note that the replication links can take anywhere up to 15-20 minutes to show up in DSSite.msc.
7. SBS 2011 should eventually come up with the Green Check of a successful install.

 

Before clicking the Migrate to Windows SBS link in the Getting Started Tasks we need to work on our SBS 2011 server to bring its configuration up to production quality. Things like finishing off the disk configuration, driver installs, and more are covered in our SBS 2011 Setup Guide.

PHASE 3: Preliminary SBS 2011 OS And Services Checks

1. Verify that the Exchange services are up and running (an ongoing thing).
   • MPECS Inc. Blog: SBS 2011 – Exchange Services Do Not Start
2. Set up the SBS Backup and take a backup of the freshly installed SBS 2011 OS.
   • Make sure to have all disks for the backup rotation handy so that they can be done at the same time due to a bug in the destination wizard.
3. Work through the SBS 2011 Setup Guide up to the Getting Started Tasks – Out of Order.
   • Set any DHCP Reservations in place once the SBS Native Tools Console has been configured.
   • Keep taking backups on both servers after each portion of the migration is completed.
4. Back up both servers.
   • SBS 2003 Time: _____
   • SBS 2011 Time: _____

PHASE 4: SBS 2003 to SBS 2011 Migration Wizard Steps

1. On the source server edit the SBS 2003 Folder Redirection Policy to point to the destination server.
   • \\NewSBS\RedirectedFolders
     • 
   • IMPORTANT:
     • SBS 2003 while a DC will maintain the 21 day period before SBCore starts shutting the server down.
     • SBS 2003 DCPromod to a domain member server will only have 7 days to complete the redirected data move.
     • Folder redirection caveat and settings suggestion: SBS 2003 to SBS 2008 Migrations – Folder Redirection Caveat (previous blog post)

2. Log onto SBS 2011 with the existing 500 Admin account and create the new SBS 2011 account using the SBS 2011 Console.

   • We like famous or not so famous generals for the necessary admin accounts created on our SBS domains.
   • Note the absence of the UAC while logged in with the old 500 Admin account.
   • What happens when the SBS Migration Wizard is opened while logged on with the original SBS 2003 domain admin account:
   • 
3. Log off SBS 2011 and log back on with the new SBS 2011 Domain Admin account.
4. Note that the GUI customization steps in our SBS 2011 Setup Guide will need to be run for this new account. 
5. Make sure to change the DHCP service’s credentials to the new Domain Admin account and password.
6. Update the Serial Number for the Domain.Local SOA in the DNS Forward Lookup Zone.
   • 
   • We use the full year plus month: 2011050000 (May 2011) to tell us when DNS was modified in any way. Note that the serial has already been bumped up a number of times since this particular DNS SOA was changed.

7. Export the Public Folders to PST via an Outlook client connected to the existing SBS 2003 as a precautionary measure.

   • Official SBS Blog: Cannot Reply To Old Emails Or Modify Old Calendar Items After PST Mail Migration.
   • Once the Exchange connectors are gone, there will be no more access to the SBS 2003 Exchange. SBS 2011 Exchange will be the go-to from there on in.

8. Run the Migration Wizard from the SBS Console.

1. Move the Data folders.
   1. SharePoint Foundation Data.
   2. Users’ Shared Folders.
   3. Users’ Redirected Folders Data.
   4. WSUS Update Repository Data.
      • Enable Access-based Enumeration on the Users Shared Folders and Users Redirected Folders after moving them.
2. Connect to the Internet.
   • Check off the appropriate step in the Getting Started Tasks section in the SBS 2011 Setup Checklist.
3. Configure the Internet Address.
   • Check off the appropriate step in the Getting Started Tasks section in the SBS 2011 Setup Checklist.
4. Migrate Network Settings
   1. Migrate DNS Forwarders.
   2. Migrate the Mobile Users Group.
   3. Using the SBS Native Tools Management Console import the SSL certificate PFX exported from the source server earlier in this guide.
      • Note the Caveat for installing a GoDaddy certificate found in our SBS 2011 Setup Guide.
5. Migrate Exchange mailboxes and settings
   1. Remove the SmallBusiness SMTP Connector
      • If the SBS Console was open during the SBS 2011 Migration Mode install the ESM node may not show the new Connectors. Click on DOMAIN (Exchange) then click the Refresh button to bring up all of the new settings.
        • 
      • SmallBusiness SMTP Connector on the Source Server.
        • 
   2. POP3 Connectors
      • This is a manual process. A screenshot of the existing list can be used as a checklist.
      • Account removal is done now on the source SBS 2003 server.
      • Adding the mail accounts to the SBS 2011 POP3 Connector is indicated later in this guide.
   3. Migrate the Exchange Server public folders (TechNet).
      • Right click on Public Folder Store (Source-SBS) and Move All Replicas.
        • 
      • On the Destination Server in an elevated Exchange PowerShell:
        • Get-PublicFolderStatistics –Server DestinationSBS [Enter]
      • If the Public Folder Store is quite large, change the limits on the destination server.
        • 
        • Hat Tip: Susan Bradley - Step 26 - moving those public folders
      • Note that this process may take some time and caution should be taken so as to not move on before the folders have replicated.
      • Run the above PS command a few times and the number of items on each PF should increase.
      • On the Source server: Public Folder Instances in ESM will eventually be empty.
   4. OPTION: Public Folder Migration Extra Steps
      1. If replication happens but then looks to be stuck:
         1. Right click on the Public Folder Store (Source) and Resend Changes…
            • 
         2. Change the logging level for Public Folders:
            • 
   5. Move the Offline Address Book.
      1. Move OAB to SBS 2011.
         1. On Destination: ESM –> Org Config –> Mailbox –> OAB Tab.
         2. Click Move near the bottom of he Actions list.
            • 
         3. Select the destination server under the Browse button and click Move.
      2. Enable Web-based Distribution in Exchange 2010.
         • 
      3. Set the Offline Address Book for the Mailbox Database
         1. Destination: ESM –> Org Config –> Mailbox –> Database Management.
         2. Right click the Mailbox Database and Properties.
            • 
   6. Move the mailboxes to SBS 2011.
      • Done from the Exchange 2010 Console on SBS 2011.
      • NOTE: Verify the largest mailbox size on SBS 2003 and set Standard User Role mailbox size and defaults in Exchange 2010 accordingly!
      • LARGEST MAILBOX: ______________
      1. ESM –> Recip Config –> Mailbox –> Click Recipient Type Details header to sort.
         • 
      2. SHFT + Click to highlight all Legacy Mailboxes.
      3. Click New Local Move Request under Actions.
         • 
         • We use 10 messages as the default setting for corrupt messages.
      4. MOVE STATUS: ESM –> Recip Config –> Move Request.
      5. Post Move: ESM –> Recip Config –> Move Request.
      6. ESM –> Recip Config –> Move Request.
      7. Highlight all Completed moves and right click and Clear Move Request.
         • 
      8. OPTION: Enable Circular Logging on the destination server.
         • Have a look at the mailboxes on the Source SBS 2003 server. The new SBS 2011 created domain admin account starts logging into each one. The move progresses from there.
         • It can take a long time before anything seemingly happens. Please be patient.
6. Some important considerations for this point in the migration:
   1. Port forwarding can be changed for SMTP to the new SBS server once the mailboxes are moved.
   2. Obtaining a third party trusted certificate before this stage would be a good idea so that remote users do not deal with the need to import the self-issued SBS 2011 certificate. Use the SBS 2011 wizard to generate the CSR if required, or to import the certificate exported from the source server previously.
   3. Official SBS Blog: How to Configure SBS 2011 Standard to Accept E-mail for Multiple Authoritative Domains.
      • We will try and publish a blog post covering our own methodology for this process.
7. Remove legacy Group Policy objects and logon settings.
   1. Remove old logon scripts including the SBS_Login_Script.bat file.
      • %windir%\sysvol\sysvol\SBSDomain.local\Scripts
   2. Remove the batch file from all users in ADUC.
      1. Select all domain Users and right click on any highlighted user account and click on Properties.
         • 
      2. Profile Tab
      3. Check Logon Script and leave blank.
      4. Apply and OK. All users will no longer have the batch file associated with them.
   3. Remove old GPOs from SBS 2003:
      • Click the Details tab to see the Created/Modified date for the GPOs before deleting.
        • 
        • Delete can be done in bulk by CTRL+Click on the following GPOs listed under the Contents tab in the Group Policy Objects folder.
      • Small Business Server – Windows Vista Policy (RipCurl Policy)
      • Small Business Server Auditing Policy
      • Small Business Server Client Computer
      • Small Business Server Domain Password Policy ***
      • Small Business Server Internet Connection Firewall
      • Small Business Server Lockout Policy
      • Small Business Server Remote Assistance Policy
      • Small Business Server Update Services Client Computer Policy
      • Small Business Server Update Services Common Settings Policy
      • Small Business Server Update Services Server Computer Policy
      • Small Business Server Windows Firewall
   4. NOTE: Password Policies are set in the SBS Console later on in our SBS 2011 Setup Guide. When set, _all_ user accounts will receive a request to change their password.
   5. Remove the SBS 2003 WMI Filters:
      • PostSP2
      • PreSP2
      • Vista (RipCurl Filter)
8. Migrate users’ shared data
   • We use the Company shared folder created in the SBS 2011 Setup Guide to store all user data. Access-based Enumeration is set up to maintain control over which users can see what folders in that share.
   • We use BeyondCompare for our data migration purposes. RoboCopy is another option.
9. Migrate the Companyweb internal Web site.
   1. Option 1 (Microsoft method):
      • Run the Prescan tool.
      • Migrate the entire Companyweb site by detaching the databases on SBS 2003 and reattaching them on SBS 2011 .
      • This method is pretty straightforward in that it preserves all of the existing data structures.
      • Create a DNS CNAME for OldCompanyweb that points to SBS 2011 FQDN.
      • Update the existing Companyweb CNAME to point to the new SBS 2011 .
      • Remember to edit the DNS CNAME record for Companyweb to point to SBS 2011 .
   2. Option 2 (direct data copy):
      • SharePoint list data that is Outlook integrated can be moved into new SharePoint libraries.
      • If versioning is not required, then opening the existing document libraries in Explorer View enables us to copy the data straight across.
10. Migrate fax data.
11. Migrate users and groups.
    1. Migrate Security Groups and Distribution Lists.
       • C:\Program Files\Windows Small Business Server\bin\GroupConverter.exe
       • 
    2. Run the Change User Role Wizard.
       • Map to Standard User.
       • Note: To view the user accounts that were migrated from the Source Server, in the Users list view, click the Display all the user accounts in the Active Directory check box.
    3. Delete the following legacy AD accounts:
       • STS Worker
       • SBSBackup
       • IUSR_SBS
       • IWAM_SBS
    4. Map appropriate RWW RDP user permissions to domain workstations.
    5. OPTION: POP3 Connector setup the user account’s POP3 e-mail to their mailbox.
12. Enable Folder Redirection and Quotas in the SBS 2011 Console.
    • Select all users for the policy.
    • We redirect Documents and Desktop by default.
    • We will disable exclusivity for the user and set it to move back to the local system. This causes FR to appear off in the SBS Console though.
    • GPUpdate /force on both source and destination.
    • Verify GPO settings on source before DCPromoing the source server. Manually initiating AD replication would be a good idea too.
13. Migrate SQL Server Data.
    • TechNet: Move SQL Server data for Windows SBS 2008 migration.
14. Migrate Terminal Services Licensing.
    • TechNet: Move Terminal Service licensing server for Windows SBS 2008 migration.
15. Finish the Migration.
1. Update the Recipient Update Services on SBS 2003.
   1. Recipient Update Service (SBSDOMAIN)
      1. Click the Browse button, put SBS 2011’s name for the Exchange field and click the Check Names button before clicking OK.
   2. Recipient Update Service (Enterprise Configuration)
      1. Exchange: SBS 2011
2. Delete the Routing Group Connectors
   1. Delete: SBSNew-SBSOLD
   2. Delete: SBSOld-SBSNew
      • 
3. Uninstall Exchange 2003 (previous blog post) from the source server.
• Add/Remove Programs –> Small Business Server –> Change/Remove.
• Remove: Exchange Server
• SBS CD 2 will be required for this uninstall.
4. Manually Remove Exchange if the above blows up. (Previous blog post)
16. Use ADSI Edit to clean up the CN=Servers container.
1. Official SBS Blog: Empty ‘CN=Servers’ Container Causing Issues with Public Folders on Small Business Server 2011
17. Change the edge device’s publishing rules:
    1. SMTP to destination.
    2. HTTPS to destination.
    3. Create and publish HTTPS port 987 and point it to the destination server.
    4. PPTP 1723 is an option for VPN if needed.
    5. Delete inbound RDP proxy port 4125 and SharePoint 444.
18. DCPromo SBS 2003 to remove the DC role.
    • REMINDER: SBS 2003 will start to reboot 7 days from the introduction of the SBS 2011 box when a domain member server only!
    • If Certificate Services has been installed on the source SBS 2003 box previously it will need to be uninstalled before the DCPromo process will run.
    • NOTE: If the DCPromo fails due to NETLOGON time-out, BACK UP in the wizard and start it again. It will run successfully the second time.
    • A reboot will be required.
19. Run a final image of the source SBS 2003 box.
20. Disjoin SBS 2003 from the SBS 2011 domain.
    • The generic WORKGROUP works here.
21. Delete the original SBS 2003 Folder Redirection Policy.
    • If it is seemingly missing, click on Refresh in the GPMC to bring it up.
    • For comparison (in our case since we enabled both above):
      • Old policy will refer only to the Documents folder.
      • New policy will refer to Documents and Desktop.
      • We can check the time stamp for each GPO for clarification as well.
22. Give the built-in Administrator group the right to logon as batch.
    • 
23. Clean up any references to the old SBS 2003 server on the SBS 2011 server:
    • ADUC: Delete from SBSComputers OU.
      • Yes to the “…other objects” message.
    • DNS: Remove ALL references to SBSOld NS and DNS A in all zones.
    • DNS: Remove ALL references to SBSOld’s IP Addresses in all zones.
    • Active Directory Sites and Services: Remove the old SBS 2003 server reference.
    • Remove SBSOld from All Computers in WSUS Console.
    • Remove SBSOld from the Security Filtering under the Scope tab of the Update Services Server Computers Policy GPO.
      • 
24. Download, install, and run the Windows Small Business Server 2011 Best Practices Analyzer.
25. Verify user quotas for the Standard User Role.
    • Exchange Mailbox
    • Redirected Folders
    • NOTE: Any changes made to the Standard User Role will affect any user that has that role.

PHASE 5: Continue the SBS 2011 Setup.

1. Complete setup from the Getting Started Tasks – Out of Order – Backup Now step and up from the SBS 2011 Setup Guide.

Troubleshooting

Some of the various problems we can run into running a migration from SBS 2003 to SBS 2011.

• SBS OS and Feature Related
  • The Official SBS Blog: The Ultimate Guide to SBS 2008 Setup Failures
  • MPECS Inc. Blog: SBS 2011 Standard Setup Crashes Unexpectedly: Error: Cannot commit configuration changes because the file has changed on disk
  • MPECS Inc. Blog: SBS 2011 Migration – Destination Server Countdown Timer
• Exchange Related
  • MPECS Inc. Blog: SBS Migration Error- Exchange – The token supplied to the function is invalid 80090308
  • MPECS Inc. Blog: SBS 2011 – Exchange Services Do Not Start
  • MPECS Inc. Blog: SBS 2011 Migration OS Install – Microsoft Exchange Search ExSearch CPU at 100%
  • MPECS Inc. Blog: SBS 2011 Migration – Moving Mailboxes But No “New Local Move Request” Option Available?
  • MPECS Inc. Blog: SBS 2003 to SBS 2011 Migration Prep Tool Error – Managed Recipient Policies Mailbox Manager Enabled
• SharePoint Related
  • MPECS Inc. Blog: Resource – Migrating SBS 2003 v2 SharePoint to SBS 2011 SharePoint Foundation
  • MPECS Inc. Blog: SBS 2011 SharePoint Foundation Default Job Definitions Settings

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

SBS 2003 to SBS 2011 Migration Guide Update to v1.3.0

We discovered and made a very important change to our Migration Guide.

When it comes time to move the mailboxes in Phase 4 Step 6 we need to verify the size of the largest mailbox on the source server.

Exchange 2010 is set to 2GB out of the box so any mailbox move command run on a mailbox that is over that size will fail.

So, we change the Standard User Role and the actual defaults in Exchange 2010 to accommodate the largest mailbox.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

SBS 2011 Setup Guide and SBS 2003 to SBS 2011 Migration Guide QR Codes

There are so many times where we need to answer a quick question that is found or linked to in our SBS 2011 Setup and Migration Guides.

Mobile is sometimes the only way to get what we need since we prefer not to browse from the server, our laptop may not be readily available, or any other number of Murphy type situations that interfere with quick access.

The following QR Codes will make mobile access that much quicker:

• SBS 2011 Setup Guide

• SBS 2003 to SBS 2011 Migration Guide

Thanks again to everyone that has commented or commended us on our guides!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

SBS 2003 Exchange Error: The mail proxy for this folder cannot be found. ID no: c1038a21

We have an error that we have not seen before on the source server for the migration we are running this weekend:

Exchange System Manager

The mail proxy for this folder can not be found. This may be due to replication delays. The mail enabled pages will not be shown.

ID no: c1038a21
Exchange System Manager

A Bing search turned up the following Microsoft KB:

• Microsoft KB 328740: You may receive a c1038a21 error message when you try to use Exchange System Manager to look at the properties of a public folder

There are two methods for correcting this particular problem. Now, since the error is happening on the default Archive and Contacts Public Folders we looked to see if we could run with Method 2 which is a lot _less_ complicated.

Method 2:

In some Exchange organizations, you can resolve this problem by using Exchange System Manager to mail-enable the folders again. You can use method 2 if the following conditions are true:

• The Exchange organization contains only computers that run Exchange 2000 Server or later versions.
• There is no longer an ADC in the Exchange organization.

A new directory object is created, and the new GUID is stamped in the PR_PF_PROXY property. If the old directory object still exists, you must delete it manually. If Exchange 5.5 Server computers still exist anywhere in the Exchange organization, do not mail-enable public folders by use Exchange System Manager.

The catch was that these Public Folders were already mail enabled though with no addresses assigned. So, we went through and ran the Mail Disable command on both:

It took a few minutes for the change to take. Once complete we ran through and ran the Mail Enable command on both. We were then able to open the Public Folder’s properties with no error.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

SBS 2008 and 2011 Active Directory Password Complexity

To manage the password setup in SBS 2008 and SBS 2011 Active Directory we use the SBS Console:

1. Open the SBS Console.
2. Click on the Users and Groups tab.
3. If not already selected, click on the Users tab.
4. Under Tasks click on Change password policies.
• 
5. Set the password policy settings accordingly.
• 
6. Click Apply and OK.
1. NOTE: All users will be required to change their passwords on their next log on if any changes are made to these settings!

This wizard is normally used during the set up process only.

If this wizard is used somewhere in the middle of an SBS Migration or SBS Swing Migration the consequences may be dire. It is best left as the final step _after_ at least one week of the post-migrated server being in production.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

SBS 2003 to SBS 2011 Migration Exchange 2003 Uninstall Fail – Manual Removal Required

We were in the final stages of the SBS 2003 to SBS 2011 migration when the Exchange 2003 setup routine failed to complete.

The very last line in the “Exchange Server Setup Progress.log” file found in C:\ was:

[17:08:51]  Deleting the public store

When we looked in the Exchange System Manager we saw the following on the source server:

Nothing. No routing connectors, no Public Folders, no databases, nothing at all.

We were not able to run the uninstall process again.

So, to see if we were even remotely close to having our source server’s Exchange 2003 uninstalled we ran the Exchange 2010 BPA on the destination server leaving out the source server and admin group in the scan:

The only flag that came up was the following:

Write DACL inherit (group)

The Write DACL inherit (group) right for the Exchange Enterprise Servers group should be removed from the root of the domain.

The Tell Me More link takes us to:

• Microsoft TechNet: The Write DACL for the Exchange Enterprise Servers group should be removed from the root of the domain

It is indicated that we need to run a PowerShell script:

• Remove-ADPermission "dc=<Domain>" -user "<RootDomain>\Exchange Enterprise Servers" -AccessRights WriteDACL -InheritedObjectType Group

Now, deciphering how the above command was actually supposed to be entered was another story.

After a number of different searches we came up with the right combination of keywords that brought us here:

• Microsoft Exchange Server Forums: Error when trying to remove last legacy Exchange server

Thanks to LuccianoDuckman we have:

The proper syntax for the command:

• Remove-ADPermission "dc=DOMAIN,dc=Local" -user "DOMAIN.Local\Exchange Enterprise Servers" -AccessRights WriteDACL -InheritedObjectType Group

When we punched the above into the Exchange Admin PowerShell console we saw the following:

[PS] C:\Windows\system32>Remove-ADPermission "dc=DOMAIN,dc=Local" -user "DOMAIN.Local\Exchange Enterprise Servers" -AccessRights WriteDACL -InheritedObjectType Group

Confirm
Are you sure you want to perform this action?
Removing Active Directory permission "DOMAIN.Local" for user "DOMAIN.Local\Exchange Enterprise Servers" with access rights "'WriteDacl'".
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [?] Help (default is "Y"): A
[PS] C:\Windows\system32>

We then re-ran the Exchange 2010 BPA to make sure that there were no other lingering issues and it came up clean.

We were good to remove the last remnants of Exchange 2003 from the source server. Note that the ESM on the source no longer functioned so we were not able to delete the source object there.

• Microsoft KB 833396: How to remove Exchange Server 2003 from your computer
• Specifically: The How to Manually Remove.
1. Services stop and Disable.
2. Registry entry removal.
• Many keys were missing already.
3. Rename the Microsoft Exchange folder under C:\Program Files \Microsoft Integration\Microsoft Exchange
• This folder was gone.
4. Left the IIS component alone.
5. Remove the Exchange Server object from AD using ADSIEdit.msc.
• 
6. Reboot.
7. Re-run the Exchange 2010 BPA on the destination to confirm that there are no problems.
8. Proceed to DCPromo the source out of the domain.

In the end, the choke may have been caused by two e-mails destined for the Public Folder store on the source server caught in the destination server’s queue! So, prior to uninstalling Exchange 2003 on the source server we will verify the queue on the destination server _first_.

We deleted those to e-mails.

With a little help from Susan:

• SBS Diva Blog: SBS 2011 Migration Keys to Success

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer

SBS 2003 to SBS 2011 Migration Error – You must be logged on using the built-in administrator account.

We have a number of SBS 2003 sites where we created a new domain administrator account with identical permissions to the built-in 500 account.

Microsoft Windows Small Business Server Setup

Setup has detected the following requirements have not been met: You must be logged on using the built-in administrator account.

The above error message came up when we were running the Add/Remove Programs process to uninstall Exchange 2003 on the source server.

So, we enabled the built-in 500 domain admin account, reset the password, logged off, logged on, and re-ran the Add/Remove process.

We were then able to move on with removing Exchange 2003.

NOTE: It is important to have the Exchange 2003 install directory (exchsrvr65) or CD 2 from the SBS 2003 setup disks handy!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer