Upgrade Windows NT 4.0 to Windows 2000 Active Directory

Upgrading a Windows NT 4.0 domain to Microsoft Windows 2000 Active Directory involves preparing your existing network, establishing a compatible DNS architecture, and performing an in-place upgrade of the Primary Domain Controller (PDC). This guide outlines the essential pre-upgrade steps, the upgrade sequence from mixed mode to native mode, and the strategies needed to ensure zero data loss and uninterrupted network authentication.

1. Pre-Upgrade Preparation

  • Establish a Rollback Strategy: Synchronize all Backup Domain Controllers (BDCs) with the Primary Domain Controller (PDC). Take one fully synchronized BDC offline and disconnect it from the network. If the upgrade fails catastrophically, this offline BDC can be promoted to a PDC to restore the NT 4.0 domain instantly.
  • Apply Latest Service Packs: Ensure the Windows NT 4.0 PDC and all BDCs are running at least Windows NT 4.0 Service Pack 6a (SP6a).
  • Verify Hardware and Software Compatibility: Confirm that the target server meets the minimum hardware requirements for Windows 2000 Server and that installed services or third-party drivers are compatible.
  • Prepare DNS Infrastructure: Active Directory relies fundamentally on the Domain Name System (DNS). Install and configure a dynamic DNS (DDNS) server that supports SRV resource records (such as the Windows 2000 DNS service) or plan to install DNS directly during the Active Directory setup process.

2. Upgrade the Primary Domain Controller (PDC)

Windows NT 4.0 domain architecture requires that the PDC be upgraded before any other domain controllers.

  1. Run the Windows 2000 Setup: Insert the Windows 2000 Server installation media on the PDC and choose to upgrade the existing operating system (in-place upgrade).
  2. Execute the Active Directory Installation Wizard (dcpromo):
    • During setup, the Active Directory Installation Wizard will launch automatically.
    • Select Domain controller for a new domain, then choose Create a new domain tree.
    • Provide the Fully Qualified Domain Name (FQDN) for the new Active Directory domain (e.g., corp.example.com).
    • Designate the NetBIOS domain name (usually the existing NT 4.0 domain name for backward compatibility).
    • Designate or install the DNS server to host the Active Directory zone.
    • Specify locations for the Active Directory database (ntds.dit), transaction logs, and the SYSVOL folder.
  3. Restart the Server: Complete the wizard and reboot the machine to initialize the newly created Active Directory root domain controller.

3. Verify the Mixed-Mode Environment

After upgrading the PDC, the domain operates automatically in Mixed Mode.

  • In Mixed Mode, the new Windows 2000 domain controller impersonates an NT 4.0 PDC to remaining NT 4.0 BDCs.
  • Existing NT 4.0 BDCs continue to replicate user account and security information from the Windows 2000 DC using legacy replication protocols.
  • Windows NT, 95, and 98 clients can authenticate without configuration changes.
  • Verify replication, network resource access, and client logon functionality before proceeding.

4. Upgrade Remaining Backup Domain Controllers (BDCs)

Once the primary domain controller is stable, address the remaining BDCs:

  • In-Place Upgrade: Upgrade each NT 4.0 BDC to Windows 2000 Server using the installation media, which automatically converts them into Windows 2000 domain controllers.
  • Decommission and Replace: Alternatively, decommission the NT 4.0 BDCs and introduce fresh installations of Windows 2000 Server, promoting them to domain controllers using the dcpromo command.

5. Switch to Native Mode

Once all Windows NT 4.0 BDCs have been upgraded or retired:

  1. Open the Active Directory Domains and Trusts console.
  2. Right-click the domain and select Properties.
  3. On the General tab, select Change Mode to switch from Mixed Mode to Native Mode.
  4. Confirm the prompt.

Note: Switching to Native Mode is permanent and cannot be reversed. Native Mode stops NT 4.0 replication protocols and unlocks advanced Active Directory features, such as universal groups, nested group memberships, and enhanced directory performance.