Windows 2000 DCPROMO Domain Controller Promotion

This article explains the step-by-step internal process used by Microsoft Windows 2000 to transform a standalone or member server into an Active Directory domain controller using the DCPROMO utility. It outlines the preliminary environment checks, Active Directory database configuration, DNS integration, SYSVOL provisioning via the File Replication Service, and the final operating system transition required to activate domain controller roles.

Initiation and Environmental Validation

Executing dcpromo.exe launches the Active Directory Installation Wizard. The utility first inspects the local system to ensure it meets the prerequisites:

  • Operating System Check: Confirms the machine runs Windows 2000 Server or Windows 2000 Advanced Server (Windows 2000 Professional cannot be promoted).
  • Administrative Privileges: Verifies the user possesses local administrator rights (or Domain/Enterprise Admin credentials if joining an existing domain).
  • File System Requirements: Ensures at least one NTFS 5.0 volume is available to host the SYSVOL structure, along with adequate disk space for the database.
  • TCP/IP and DNS Configuration: Verifies network connectivity and checks if an accessible DNS server supports Dynamic Update protocol (RFC 2136) and Service Location (SRV) resource records (RFC 2052).

Deployment Role Selection

The administrator specifies whether to create a new domain or join an existing domain:

  1. New Domain: Can be configured as a new domain tree in a new forest, a child domain within an existing tree, or a new tree within an existing forest.
  2. Additional Domain Controller: Joins an existing domain to provide redundancy, load balancing, and fault tolerance.

During this stage, the wizard also captures the target paths for:

  • Active Directory database (NTDS.dit)
  • Active Directory log files
  • The SYSVOL folder
  • The Directory Services Restore Mode (DSRM) administrator password

DNS Integration and Zone Configuration

Active Directory relies fundamentally on DNS for locator services. If DCPROMO cannot find a DNS server capable of handling Active Directory SRV records, it gives the administrator the option to install and configure the Windows 2000 DNS service locally.

When configured, DCPROMO establishes the forward lookup zone matching the Active Directory fully qualified domain name (FQDN) and configures the zone to allow dynamic updates so Active Directory components can automatically register their SRV records.

Database Initialization and Directory Replication

Once parameters are confirmed, the core installation begins:

  • Engine Invocation: The Extensible Storage Engine (ESE/Jet98) initializes the storage system.
  • Database Creation: DCPROMO creates the NTDS.dit file in the designated directory.
  • Schema and Configuration Loading:
    • New Forest: The tool populates the database using default schema definitions loaded from the schema template file (schema.ini). Default containers, default organizational units, and built-in security principals are generated.
    • Existing Domain: DCPROMO uses Remote Procedure Call (RPC) over IP to contact an existing Domain Controller. It initiates a replication cycle to pull down the Schema directory partition, the Configuration directory partition, and the Domain directory partition.

SYSVOL Provisioning and FRS Configuration

DCPROMO establishes the SYSVOL directory tree on the specified NTFS partition. This structure contains the domain's shared system policies, scripts, and group policy objects (GPOs):

  • Creates junction points and the required folder structure (domain, staging, sysvol, and staging areas).
  • Initializes the File Replication Service (FRS) to manage multi-master replication of the SYSVOL hierarchy among all domain controllers in the domain.
  • Creates the default shared resources: SYSVOL and NETLOGON.

Security Identity and Operating System Reconfiguration

Before finishing, the server alters its fundamental security role:

  • SAM Transition: The local Security Accounts Manager (SAM) database is retired from active service. Local user accounts from the standalone server are either moved into the Active Directory database (for a new domain) or discarded in favor of existing domain accounts. The local Administrator account becomes the Domain Administrator (in a new forest root) or is superseded by domain accounts.
  • Registry Alteration: The ProductType value in the system registry is changed from ServerNT (standalone/member server) to LanmanNT (domain controller).
  • Service Configuration: DCPROMO sets the Kerberos Key Distribution Center (KDC) and Netlogon services to start automatically on system boot.

Finalization and Reboot

DCPROMO signals completion and prompts for a mandatory system reboot. During the reboot sequence, the operating system reads the updated ProductType registry key, boots the Directory Service Agent (DSA), starts the Kerberos KDC, and runs the Netlogon service to register locator SRV records with DNS. Upon restarting, the machine operates as a fully functional Windows 2000 Active Directory Domain Controller.