If the applications are important enough to be tested, get them into your test environment. There are times other than domain upgrades, etc that they will need to be tested as well.
Running test against production data is insane and asking for problems. If I were a manager of someone who did this, they would be fired. If I was the employee of a manager who said we had to do this, I would fight it tooth and nail. I would liken this to testing a new fix-a-flat mixture. You could put the gunk into a flat tire on the freeway and run it up to 90 and see if it holds or you could do it on a test track. If you did due diligence every step along the way, you probably aren't going to hurt anything. However, if you missed just one thing you could hurl off your side of the road and kill a family of six driving back from seeing grandma. After the fact, people would be asking you questions like, how did you justify that risk in your head? There are test environments for a very specific reason. If you want to test in production, grow a set, sign up for the responsibility and have at it for real, don't think that a complicated set of controls might help alleviate issues because even the set of controls is being tested. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Almeida Pinto, Jorge de Sent: Thursday, November 24, 2005 7:24 PM To: [email protected] Subject: [ActiveDir] Connecting the test environment to the production - what is your opinion? Hi All, I would be interested in your feedback concerning the story below. The full story is also available on my blog (http://blogs.dirteam.com/blogs/jorge/archive/2005/11/24/149.aspx). Any feedback on it would be a appreciated! If you have question feel free to ask! Thanks in advance! Cheers, Jorge ############################################## Now, independent of the reason why you want to do an in-place upgrade of the current NT4 domain to an AD domain, to just test the migration you install a new BDC in the production domain and sync it with the PDC. You move that BDC into a test environment, and promote it to a PDC. For testing purposes you install an additional BDC in the test environment. To prepare for the domain upgrade you install 2 freshly installed W2K3 member servers, install and configure them with DNS/WINS/DHCP and configure them with "NT4Emulator" and "NeutralizeNT4Emulator" registry keys. After that reboot the servers! So it's time upgrade the NT4 PDC...but before doing so also configure it with the "NT4Emulator" and "NeutralizeNT4Emulator" registry keys and reboot the PDC. After the PDC is up again the upgrade is started and after a while the first W2K3 DC has been introduced. That same W2K3 is also the first GC and hosts all FSMO roles. Followed by this is the promotion of the 2 W2K3 member servers to AD DCs. After the promotion these new DCs might be configured as GCs and the FSMo roles might be transfered to one of them. As your environment may consist of legacy clients (you may need to update them first prior installing the first W2K3 DC with latest service packs and/or the DSClient) and W2K/WXP/W2K3 clients and server you may want to test authentication against NT4/W2K3 DCs, only W2K3 DCs and only NT4 DCs. If you are satisfied with the results you could remove the NT4 BDCs and the upgraded W2K3 DC. At this moment you are left with 2 W2K3 DCs and the Forest Functional Level is set to "Windows 2000" (choose if the domain will also contain W2K DCs) or "Windows Server 2003 Interim" (choose if the domain will only contain NT4 and W2K3 DCs). This choice is made during the upgrade of the NT4 PDC to a W2K3 DC. To stop the emulating stuff on the W2K3 DCs the "NT4Emulator" and "NeutralizeNT4Emulator" registry keys are removed and the DCs are rebooted. As soon as W2K/WXP/W2K3 clients and servers detect the W2K3 DCs not emulating anymore these clients and servers will upgrade their secure channel to use Kerberos for authentication instead of using NTLMv2. So at this moment the migration has been tested and the results are satisfying. However, before doing this in production you just may want to test the (core) applications against an AD domain and additionally test the same applications against an AD domain in Forest Functional Level "Windows Server 2003". So how are you going to do this, if it is not possible to introduce those (core) applications on servers/systems into the test environment? Now this is a wild and crazy scenario and I would love to know what you're opinions are? Discription of the wild and crazy scenario... So at this moment you have 2 W2K3 DCs hosting a domain that is practically the same as in production (same name, sids, etc.) These servers also host DNS and WINS. Only the two DCs, their names and IPs are different. As you use a server based computing (SBC) solution in your production environment, you install a WXP client and a SBC server in your test environment. On that SBC server you install the front end applications that must communicate with the (Core) back end applications. All servers and clients in the test environment are setup to use only the DNS/WINS servers in the test environment both DNS and WINS will only return the DCs in the test environment as authenticating DCs! (For DNS nothing needs to be done, but for WINS you need to delete the 1Ch record and rebuild it by issuing NBTSTAT -RR on the 2 DCs in the test environment) DNS and WINS in the production environment and test environment are not connected in any way! A firewall will be placed between the production environment and the test enviroment and the following rules: * No traffic whatsoever is allowed initiated in the production environment to the test environment * The WXP client and the 2 W2K3 DCs are not allowed to communicate with clients/servers in the production environment * The SBC server is allowed to communicate with all servers in the production environment except for the NT4 DCs in the production environment In this scenario the following is true: * User accounts, passwords, computer accounts, groups and memberships are exactly the same in the production environment and in the test environment * The systems and users in the test environment will use the DCs in the test environment * The systems and users in the production environment will use the DCs in the production environment To test the (core) applications, a user logs onto the WXP client, sets up a session to the SBC server and starts on of the front end apps and that app connects through the firewall to the core application server in the production environment. As you may see theoretically everything seems OK and it also seems no issues should occur with this. I'm wondering: * If such scenario will work? * Has anyone done this before? * What could go wrong? (assuming the firewall is well configured and the DCs in both environments cannot communicate with each other!) * If something goes wrong, what are consequences and what is the impact? I would be very interested in your opinon concering this wild and crazy scenario, so feel free to post ANY comments! This e-mail and any attachment is for authorised use by the intended recipient(s) only. It may contain proprietary material, confidential information and/or be subject to legal privilege. It should not be copied, disclosed to, retained or used by, any other party. If you are not an intended recipient then please promptly delete this e-mail and any attachment and all copies and inform the sender. Thank you. List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
