1.開啟你的防火牆..
2.將下列指令Copy下來，貼到你的記事本裡，存成.cmd檔，然後用Administrator身份執行該批次命令檔
@echo ========= Active Directory ==============
@echo Enabling W32Time port 123
netsh firewall set portopening UDP 123 "W32Time"
@echo Enabling RPC OF EPMAP port 125
netsh firewall set portopening TCP 123 "RPC OF EPMAP"
@echo Enabling RPC OF EPMAP port 135
netsh firewall set portopening TCP 135 "RPC RPC"
@echo Enabling RPC/NPofRPC/NP 137
netsh firewall set portopening UDP 137 "RPC/NP OF RPC/NP"
@echo Enabling NetBIOS 138
netsh firewall set portopening UDP 138 "NetBIOS Datagram Service NetBIOS"
@echo Enabling NetBIOS 139
netsh firewall set portopening TCP 139 "NetBIOS Session Service NetBIOS"
@echo Enabling LDAP port 389
netsh firewall set portopening TCP 389 "TCP OF LDAP"
@echo Enabling LDAP port 389
netsh firewall set portopening UDP 389 "UDP OF LDAP"
@echo Enabling LDAP OF SSL port 636
netsh firewall set portopening TCP 636 "LDAP OF SSL(TCP)"
@echo Enabling LDAP OF SSL port 636
netsh firewall set portopening UDP 636 "LDAP OF SSL(UDP)"
@echo Enabling LDAP port 3268
netsh firewall set portopening TCP 3268 "LDAP OF Global Catalog Server(3268)"
@echo Enabling LDAP SSL port 3269
netsh firewall set portopening TCP 3269 "LDAP OF Global Catalog Server(3269)"
@echo Enabling Terminal Services port 3389
netsh firewall set portopening TCP 3389 "Terminal Services"
@echo Enabling DNS port 53
netsh firewall set portopening TCP 53 "TCP OF DNS"
@echo Enabling DNS port 53
netsh firewall set portopening UDP 53 "UDP OF DNS"
@echo Enabling Kerberos port 88
netsh firewall set portopening TCP 88 "TCP OF Kerberos"
@echo Enabling Kerberos port 88
netsh firewall set portopening UDP 88 "UDP OF Kerberos"
@echo Enabling Kerberos Password V5 Kerberos port 464
netsh firewall set portopening TCP 464 "Kerberos Password V5 Kerberos(TCP)"
@echo Enabling Kerberos Password V5 Kerberos port 464
netsh firewall set portopening UDP 464 "Kerberos Password V5 Kerberos(UDP)"
@echo Enabling SMB port 445
netsh firewall set portopening TCP 445 "SMB"
@echo Enabling DFS OF RPC port 5722
netsh firewall set portopening TCP 5722 "DFS OF RPC"

小弟個人淺見

1. 我的 2003 AD server firewall是關閉的。想請問這個設定是否恰當/正確做法?
   A:一般會架設SERVER,那應該有實體防火牆,所以我的做法是把防火牆關閉(個人看法)

2. 若那台 2003 AD server (32bit) 是由從前 NT4 pdc migrate 過來的, 請問是否同樣可以將這台 2003 AD server migrate 到另一台新 2008 R2 64-bit AD?
   (可否介紹online 參考的連結?)
   A:參考其他大神
   http://ithelp.ithome.com.tw/question/10062683
   抱歉了這個老實說,轉換域到問題馬上問會比較快,

3. 那一台 2008 R2 AD 的 firewall 是否仍需要關閉?
   A:小弟公司2008 SERVER防火牆都沒開的(無作用狀態),但是防火牆管控要確實

3.(其實應該是4.) 那一台 2008 R2 AD 的 dns 是否仍需要重新建立?
A:AD跟DNS要看耶,基本上我會把AD跟DNS做相關連,還有做同步
例如,我的AD1跟AD2是互相備援的,DNS1跟DNS2也是備援
那
DNS1=AD1(一般稱為DC1)
DNS2=AD2(一般稱為DC2)
小弟個人小小意見,如有錯誤再請指導更正