Join Zentyal to Windows 2012 as additional DC (Workaround)

[maximilianobeltritti]

The following post came from the need to join Zentyal to a Windows 2012 server Domain Controller for an specific client that wanted to migrate their servers to Zentyal for licensing costs. Because Samba does not support this type of DC yet, we use the Threecore laboratories to test a workaround for this issue, we hope this will be useful for all we decide to post it here:

The workaround we found was to lower the functional level and the forest level from Windows 2012 to windows 2008 so that our Zentyal can join the domain, this approach is also very useful, as we mentioned above, to migrate from Windows 2012 DC to Zentyal, we've tested in laboratories internal and works perfect: 

Step 1

Open a PowerShell Active Directory console

Step 2

Run:
get-ADForest

We can see the domain name with the different configurations. For Example:

ApplicationPartitions : {DC=ForestDnsZones,DC=zentyal,DC=it,DC=com,
                        DC=DomainDnsZones,DC=zentyal,DC=it,DC=com}
CrossForestReferences : {}
DomainNamingMaster    : win2k12.zentyal.it.com
Domains               : {zentyal.it.com}
ForestMode            : Windows2012Forest
GlobalCatalogs        : {win2k12.zentyal.it.com}
Name                  : zentyal.it.com
PartitionsContainer   : CN=Partitions,CN=Configuration,DC=zentyal,DC=it,DC=com
RootDomain            : zentyal.it.com
SchemaMaster          : win2k12.zentyal.it.com
Sites                 : {Default-First-Site-Name}
SPNSuffixes           : {}
UPNSuffixes           : {}

Step 3

Run:

Set-ADForestMode -Identity "your.domain.com" -
ForestMode Windows2008Forest

Apply Yes

Step 4

Run:
Set-ADDomainMode -Identity "your.domain.com" -
DomainMode Windows2008Domain


Example for both commands:

PS C:\Users\Administrator.WIN2K12> Set-ADForestMode -Identity "zentyal.it.com" -
ForestMode Windows2008Forest

Confirm
Are you sure you want to perform this action?
Performing operation "Set" on Target
"CN=Partitions,CN=Configuration,DC=zentyal,DC=it,DC=com".
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  (S) Suspend  [?] Help
(default is "Y"):y


PS C:\Users\Administrator.WIN2K12> Set-ADDomainMode -Identity "zentyal.it.com" -
DomainMode Windows2008Domain

Confirm
Are you sure you want to perform this action?
Performing operation "Set" on Target "DC=zentyal,DC=it,DC=com".
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  (S) Suspend  [?] Help
(default is "Y"):y


That is all, now you have a windows 2012 server running with an 2008 functional level and forest level, so we can join Zentyal to the domain as an additional DC, cheers!

[robb]

Can you make a translation in English for this?

[maximilianobeltritti]

Done! Sorry is my first post.

[robb]

No problem and thnx a lot for the translation. I will move it back to tips and tricks since I think it's where it belongs.
Feel free to have a Spanish version in the Spanish section for reference for non English speakers.

+1 Karma for the effort.

[Gilberto Ferreira]

The following post came from the need to join Zentyal to a Windows 2012 server Domain Controller for an specific client that wanted to migrate their servers to Zentyal for licensing costs. Because Samba does not support this type of DC yet, we use the Threecore laboratories to test a workaround for this issue, we hope this will be useful for all we decide to post it here:

The workaround we found was to lower the functional level and the forest level from Windows 2012 to windows 2008 so that our Zentyal can join the domain, this approach is also very useful, as we mentioned above, to migrate from Windows 2012 DC to Zentyal, we've tested in laboratories internal and works perfect: 

Step 1

Open a PowerShell Active Directory console

Step 2

Run:
get-ADForest

We can see the domain name with the different configurations. For Example:

ApplicationPartitions : {DC=ForestDnsZones,DC=zentyal,DC=it,DC=com,
                        DC=DomainDnsZones,DC=zentyal,DC=it,DC=com}
CrossForestReferences : {}
DomainNamingMaster    : win2k12.zentyal.it.com
Domains               : {zentyal.it.com}
ForestMode            : Windows2012Forest
GlobalCatalogs        : {win2k12.zentyal.it.com}
Name                  : zentyal.it.com
PartitionsContainer   : CN=Partitions,CN=Configuration,DC=zentyal,DC=it,DC=com
RootDomain            : zentyal.it.com
SchemaMaster          : win2k12.zentyal.it.com
Sites                 : {Default-First-Site-Name}
SPNSuffixes           : {}
UPNSuffixes           : {}

Step 3

Run:

Set-ADForestMode -Identity "your.domain.com" -
ForestMode Windows2008Forest

Apply Yes

Step 4

Run:
Set-ADDomainMode -Identity "your.domain.com" -
DomainMode Windows2008Domain


Example for both commands:

PS C:\Users\Administrator.WIN2K12> Set-ADForestMode -Identity "zentyal.it.com" -
ForestMode Windows2008Forest

Confirm
Are you sure you want to perform this action?
Performing operation "Set" on Target
"CN=Partitions,CN=Configuration,DC=zentyal,DC=it,DC=com".
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  (S) Suspend  [?] Help
(default is "Y"):y


PS C:\Users\Administrator.WIN2K12> Set-ADDomainMode -Identity "zentyal.it.com" -
DomainMode Windows2008Domain

Confirm
Are you sure you want to perform this action?
Performing operation "Set" on Target "DC=zentyal,DC=it,DC=com".
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  (S) Suspend  [?] Help
(default is "Y"):y


That is all, now you have a windows 2012 server running with an 2008 functional level and forest level, so we can join Zentyal to the domain as an additional DC, cheers!

Hello

I wonder if there's some risk for some application running on Windows Server...
I meant, some legacy application previously installed on Server, don't not work properly after lower functional level..

Did you know something about that??

Thanks...

[nikmik]

I don't think you will have any problem with software. "Functional levels determine the available Active Directory Domain Services (AD DS) domain or forest capabilities. They also determine which Windows Server operating systems you can run on domain controllers in the domain or forest. However, functional levels do not affect which operating systems you can run on workstations and member servers that are joined to the domain or forest. "

You can see this for more information:
http://technet.microsoft.com/library/understanding-active-directory-functional-levels%28v=WS.10%29.aspx