Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

(This is a question about Active Directory domains)


We have merged with another company and are taking over their IT duties.

Our current domain "" is going to remain, as is their domain "".

Our company has an Exchange 07 server...they currently just use POP3 hosting.

My question:

  • Can I create a trust relationship and other settings between the two domains that will accomplish the following?

a) Allow for shortname DNS name resolution (I'm thinking this could be accomplished by having search suffixes, but not sure how the DNS replicates between domains

b) Have NTFS security be allowed that users in 1 domain can access resources in another with their logins. This would also be the case for Sharepoint.

c) Host their email on our Exchange 2007 server using their current email addresses ( while still hosting our own email as well and allow for calendar sharing, etc.

Pretty lengthy question but I'm hoping it can be accomplished.


share|improve this question
up vote 2 down vote accepted

You should create a 2 way trust relationship to begin with.

Then set up DNS replication of DNS zone between domains.

a)You should add the other company domain to the other dns suffix search list.

b)You will need to use universal groups, so they can be used on the other domain. This Technet article explains groups scope

c)You will have many task for that:

  • kerberos task. Sharepoint server will need to be able to reach DC of the other domain
  • You will need to use groups and co that include users from both domain
  • Internet explorer: need to set the sharepoint site as intranet zone, through GPO for example. So users will do integrated authentication
  • People picker tuff
share|improve this answer

Active Directory Migration Tool will do what you need.

Be sure to thoroughly read the documentation before you even download it.

I'd recommend brining up an additional test DC for each domain, take them offline and perform a test run first.

You can migrate computers as well as users, so cross domain authentication shouldn't be a problem, and ADMT uses a facility called SID history to allow a user's logon to continue to work on the old domain.

Edit: Sorry misread your question first time, so ignore my answer, unless you want to merge the domains.

share|improve this answer
He stated that both domain stay on their own, you propose to migrate users and computers from one domain to the other, which doesn't respect his constraint – Mathieu Chateau Feb 15 '10 at 7:32
Yep, sorry, just edited my answer as I realised this after submitting my answer. (I'm still drinking my first coffee of the day). – Bryan Feb 15 '10 at 7:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.