Failure is a great teacher

2021-06-20 21:19:00

A few weeks ago I noticed that my Win2012 trial licenses are no longer tennable: a big change to my homelab is needed! Since then I've worked dilligently on a few projects, all happening in parallel.

• Migrate the Root CA, from Win2012 with ADCS to Ubuntu 20 with XCA.
• Migrate the existing Issuing CA, from Win2012 with ADCS to Win2019 with ADCS.
  • I'd considered building a replacement CA, but migration seemed quicker.
• Sign the Issuing CA's cert with the new G2 Root CA.
• Add two new ADDS controllers, on Win2019, to the server and workstation subnets.
• Demote the two existing ADDS controllers, removing the Win2012 DCs.
• Migrate the Validation Authority from Win2012 with IIS to Win2019.
• Migrate PasswordState on Win2012, to Win2019.
• Add incoming VPN to the lab environment, via my Unifi gear.
• Revamp my pfSense firewall rules with aliases for hosts, IPs and port ranges.

That's a lot of stuff going on!

As the title of this post says: failure is a great teacher and boy did I have a lot of failures! 😂

For now there's too much to sum up in great detail, so I'll get back to the deets later. For now, some stuff I ran into:

• Don't try to outsmart the process of demoting and promoting ADDS DCs. You can't just add new DCs and then shutdown the old ones.
• You'll only make things worse if you start manually deleting SRV records for the old DCs from DNS.
• You'll make things even worse if you demote one of the old DCs but then shut it down before the whole domain is stable again. 
• It's darn hard to restore GPOs if you've never backed them up. 

After a weekend with lots of hard work, my AD domain is stable and usable again. All GPOs work again, the syncing between DCs works, the DFSR for SYSVOL works again. And the migration of the issuing CA to 2019 has also completed, with hosts being able to auto-enroll and validate certs again. 

There's so much more to do though! Thank ${Deity} for my Jira boards!

kilala.nl tags: work, studies, homelab,

View or add comments (curr. 0)