An update for the Windows Small Business Server 2011 Standard Migration Preparation Tool is available

Update information

How to obtain this update

To obtain the update, run the Windows Small Business Server 2011 Standard Migration Preparation Tool.

Prerequisites

To apply this update, you must have the Windows Small Business Server 2011 Standard Migration Preparation Tool installed on the migration source server.

Registry information

To use the update in this package, you do not have to make any changes to the registry.

Restart requirement

You do not have to restart the computer after you apply this update.

Update replacement information

This update does not replace a previously released update.

For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:

824684 Description of the standard terminology that is used to describe Microsoft software updates

Issues that are fixed by this update

Issue 1

The Windows Small Business Server 2011 Standard Migration Preparation Tool only detects journal wrap errors that occurred within the past 24 hours. After you install this update, the Windows Small Business Server 2011 Standard Migration Preparation Tool checks for the most recent journal wrap errors.

Issue 2

The SourceTool.log file includes the following incorrect statement that a line should not exist in the release version of the Windows Small Business Server 2011 Standard Migration Preparation Tool:

Issue 3

You receive a warning from The Windows Small Business Server 2011 Standard Migration Preparation Tool if the DNS server service is not started on the migration source server. After you install this update, the tool raises an error instead of a warning if the DNS server service is not started.

Rules that are added by this update

Rule 1

This update adds the following rule to check whether the _msdcs DNS zone exists on the migration source server:

Rule 2

This update adds the following rule to check whether the Allow inheritable permissions option is enabled for the mailbox store and for the public folder in Active Directory:


Note This rule only applies to migration source servers that are running Windows Small Business Server 2003 or Windows Small Business Server 2008.

Rule 3

This update adds the following rule to check whether the MyBusiness organization unit (OU) structure is present on the migration source server.


Note This rule only applies to migration source servers that are running Windows Small Business Server 2003 or Windows Small Business Server 2008.

Actions to take if this rule is violated

To resolve this rule violation, re-create the MyBusiness OU manually. To do this, follow these steps:

1. Open Active Directory Users and Computers.
2. Right-click the domain name object. In the shortcut menu, point to New…, and then click Organizational Unit. Type MyBusiness to name the new object.
   
   Note Type MyBusiness as one word.
3. In the MyBusiness OU that you created in step 2, create the following OUs:
   • Computers
   • Distribution Groups
   • Security Groups
   • Users
4. In the Computers OU that you created in step 3, create the following OUs:
   • SBSComputers
   • SBSServers
5. In the Users OU that you created in step 3, create the following OU:
   • SBSUsers

After you finish these steps, you should have a structure that resembles the following:

Rule 4

This update adds the following rule to check whether the Enable Distributed COM on this computer option is enabled:

Rule 5

This update adds the following rule to check whether the "abuse@domain.local" email address is present on the migration source server:

Rule 6

This update adds the following rule to check whether the File Replication Service is stopped or disabled on the migration source server.

Rule 7

This update adds the following rule to check whether the "'enable computer and user accounts to be trusted for delegation" user right in the Default Domain Controllers Group Policy object (GPO) applies to the Administrators group on the migration source server:


Actions to take if this rule is violated

To resolve this rule violation, edit the Default Domain Controllers GPO. To do this, follow these steps:

1. Start the Group Policy Management Console (Gpmc.msc).
2. Expand the Group Policy Objects container.
3. Right-click Default Domain Controllers Policy, and then click Edit.
4. Expand Computer Configuration, expand Windows Settings, expand Security Settings, expand Local Policies, and then expand User Right Assignment.
5. Under User Rights Assignment, locate and double-click Enable Computer and user accounts to be trusted for delegation.
6. Make sure that the Define these policy settings check box is selected.
7. Click Add User or Group, add the Administrators group, and then click OK.
8. Refresh Group Policy on the server. To do this, open a command prompt, type the following command, and then press Enter:
   gpupdate /force

After you finish these steps, you should have Group Policy settings that resemble the following:

Rule 8

This update adds the following rule to check whether the "Log on as a batch job" user right in the Default Domain Controllers GPO applies to the Administrators group on the migration source server:


Actions to take if this rule is violated

To resolve this rule violation, edit the Default Domain Controllers GPO. To do this, follow these steps:

1. Start the Group Policy Management Console (Gpmc.msc).
2. Expand the Group Policy Objects container.
3. Right-click Default Domain Controllers Policy, and then click Edit.
4. Expand Computer Configuration, expand Windows Settings, expand Security Settings, expand Local Policies, and then expand User Right Assignment.
5. Under User Rights Assignment, locate and double-click Log on as a batch job.
6. Make sure that the Define these policy settings check box is selected.
7. Click Add User or Group and make sure that the following groups are in the list:
   • Administrators
   • PerformanceLogUser
   
   
   If any of these groups are not in the list, add them by clicking Add User or Group…. Then, click OK.
8. Refresh Group Policy on the server. To do this, open a command prompt, type the following command, and then press Enter:
   gpupdate /force

Rule 9

This update adds the following rule to check whether KB 939820 is installed on the migration source server:


Note This rule only applies to migration source servers that are running Windows Small Business Server 2003 Windows Server 2003.

For more information about KB 939820, see Events 1925, 1006, 1645, 1055, 40961 on a Windows Server 2008-based domain controller or authentication errors

Rule 10

This update adds the following sub-rules to Active Directory Health Check:

Sub-rule 1

The following sub-rule checks whether subdomains exist in Active Directory:


Actions to take if this sub-rule is violated

To resolve this sub-rule violation,remove Active Directory from the domain controllers in the subdomain, and then enable the This is the last domain controller in this domain option. The subdomain is removed as soon as you perform this operation on the last domain controller.

Note Windows Small Business Server does not support trusts. This includes trusts that are created by child domains. Therefore, Windows Small Business Server does not support scenarios that include subdomains.

Sub-rule 2

The following sub-rule checks whether all the operations master roles (also known as flexible single master operations or FSMO) are present on the migration source server:


Note This rule only applies to migration source servers that are running Windows Small Business Server 2003 or Windows Small Business Server 2008.

Actions to take if this sub-rule is violated

To resolve this sub-rule violation, transfer any FSMO roles that are not owned by the Windows Small Business Server server back to the Windows Small Business Server server. To do this, follow these steps.

Note Windows Small Business Server is required to hold all the FSMO roles.

1. Verify which FSMO Roles are held by Windows Small Business Server. To do this, open a command prompt, type the following command, and then press Enter:
   NETDOM QUERY FSMO
2. At an administrative command prompt, type NTDSUTIL, and then press Enter.
3. Type activate instance NTDS, and then press Enter.
   
   Note This command is only required in Windows Small Business Server 2008.
4. Type roles, and then press Enter.
5. Type connections, and then press Enter.
6. Type connect to server servername, and then press Enter.
   
   Note In this command, servername is a placeholder for the name of the Windows Small Business Server server.
7. At the server connections prompt, type q, and then press Enter.
8. Type seize PDC, press Enter, and then click Yes in the Role Seizure Confirmation dialog box.
9. Type seize infrastructure master, press Enter, and then click Yes on the Role Seizure Confirmation dialog box.
10. Type seize naming master, press Enter, and then click Yes on the Role Seizure Confirmation dialog box.
11. Type seize RID master, press Enter, and then click Yes on the Role Seizure Confirmation dialog box.
12. Type seize schema master, press Enter, and then click Yes on the Role Seizure Confirmation dialog box.
13. Type q, and then press Enter until you return to the command prompt.

Note You only have to transfer the roles that are not held by Windows Small Business Server. Therefore, you may not have to run all the commands in these steps.

Sub-rule 3

The following sub-rule checks whether Active Directory replication is disabled on the migration source server:


Actions to take if this sub-rule is violated

Active Directory replication is most frequently disabled because an unsupported restore operation was performed in Active Directory. This operation puts the server into a "USN rollback" state. To resolve the USN rollback issue, view KB 875495. For more information about KB 875945, click the following article number to view the article in the Microsoft Knowledge Base:
There are other potential causes of this issue. Therefore, you must review the Directory Services log to determine the cause, and resolve the issue appropriately. To manually re-enable Active Directory replication, open a command prompt, type the following command, and then press Enter:Note Before you run this command, make sure that the initial replication issue is resolved. If you do not do this, you will only have a single domain controller remaining after you run the command.

Sub-rule 4

The following sub-rule checks whether offline domain controllers are present in Active Directory:

Sub rule 5

The following sub-rule checks whether the DNS zone name exists on the migration source server:


Actions to take if this sub-rule is violated

To resolve this sub-rule violation, re-create the DNS zone. To do this, follow these steps:

1. Open DNS Management Console.
2. Right-click Forward Lookup Zones, and then click New Zone….
3. Click Next on the Welcome page of the New Zone Wizard.
4. Click Primary Zone and make sure that the Store the zone in Active Directory check box is selected.
5. Set the replication scope to include all domain controllers in the Active Directory domain.
6. In Zone name, enter the Active Directory domain name (for example, contoso.local).
7. Set the dynamic update option to Allow only secure dynamic updates.
8. Click Finish to create the zone.

Sub rule 6

The following sub-rule checks whether the DNS zone is integrated with Active Directory on the migration source server:


Actions to take if this sub-rule is violated

To resolve this sub-rule violation, integrate the DNS zone with Active Directory. To do this, follow these steps:

1. Open DNS Management Console.
2. Expand Forward Lookup Zones.
3. Right-click the zone that corresponds to your Active Directory domain name, and then click Properties.
4. On the General tab, make sure that the Type setting is set to Active Directory-Integrated and the Dynamic updates setting is set to Secure only, as shown in the following screen shot:
   
5. On the Name Servers tab, make sure that the source server IP address is listed and that the list contains only the IP addresses of valid working internal DNS servers. Remove any IP addresses that are not valid.

Sub-rule 7

The following sub-rule checks whether the server records in the msdcs subdomain of the DNS zone point to a domain controller on the migration source server:


Actions to take if this sub-rule is violated

To resolve this sub-rule violation, point all name server records to a domain controller. To do this, follow these steps:

1. Verify the DNS zone configuration. To do this, follow these steps:
   1. Open DNS Management Console.
   2. Expand Forward Lookup Zones.
   3. Expand the zone that corresponds to your Active Directory domain name.
      
   4. Right-click the _msdcs subdomain, and then click Properties.
      
   5. On the Name Servers tab, make sure that the list contains only the domain controllers in the domain. Remove any records that are not valid.
2. Check the DNS Namespace in WMI. To do this, follow these steps:
   1. Start Windows Management Instrumentation (WMI) Tester (Wbemtest).
   2. Click Connect .
   3. Type root\microsoftdns in the Namespace text box.
   4. Click Connect .
   If it connects, the issue is probably caused by the configuration in the DNS zones or delegation. If you receive an error dialog box as shown in the following screen shot, make a backup of the WMI repository, and then repeat step 2A through 2D. If it connects successfully, press the Scan again button in the Migration Preparation Tool.
   
   To make a backup of the WMI repository, follow these steps:
   1. Start wmimgmt.msc.
   2. Right-click WMI Control (Local), and then click Properties .
   3. Click the Backup/Restore tab, click Back Up Now .
   4. Enter a file name, and then click Save.
   5. At an elevated command prompt, execute the following commands:

      cd %systemroot%\system32\wbem
      mofcomp dnsprov.mof

      The following screen shot shows a successful output of the commands:
      

Sub-rule 8

The following sub-rule checks whether the local server is in the name server records on the migration source server:


Actions to take if this sub-rule is violated

To resolve this sub-rule violation, integrate the DNS zone with Active Directory. To do this, follow these steps:

1. Open DNS Management Console.
2. Expand Forward Lookup Zones.
3. Expand the zone that corresponds to your Active Directory domain name.
   
4. Right-click the _msdcs subdomain, and then click Properties.
   
5. On the Name Servers tab, make sure that the source server is listed.