Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I work for a company that hosts desktops for a number of different companies. At the moment, all the clients access a single domain controller called HOSTING. Under that are groups for each company.

Each of the hosting servers exist on the same network and so are therefore potentially browseable by other terminal servers. This has raised some security issues and I've found it a little tricky to manage the security. As well, it's possible to see who the other hosted companies are even though other users cannot see their data.

What I'd like to do is isolate each clients terminal server/s into their own VLAN. In addition, I'm thinking that each TS would have it's own DC which could just run on the TS for that company. Overhead for a DC is fairly minimal. This would isolate users on that TS from seeing the other companies completely.

Firstly, does this sound like a sensible plan?

Second... if it is sensible, how would I go about pulling the accounts from the HOSTING domain to a new domain? ideally, without the need for users to change their passwords?

share|improve this question

ADMT is good for migrating accounts to a new forest for sure. But...should you really build a dedicated AD forest for each customer? That could get difficult rather quickly. If your business is such that you only have a handful of customers it probably isn't a big deal. But if you have many customers and if you hope to grow, things will get much more difficult.

I'd encourage you to read up on Microsoft's HMC (Hosted Messaging and Collaboration) platform here. It isn't directly applicable to your environment because it has mostly been used by companies that are hosting Exchange/Sharepoint/OCS/web sites but the platform specifies an AD infrastructure that allows hosted companies to run a multitenant configuration with thousands of customers in the same AD forest. It doesn't negate the ability for them to have dedicated servers either. It isn't rocket science but it might give you some ideas about how to lock down your AD better if indeed that is among your problems. Note that HMC is going away with the next generation of Microsoft back office applications (Exchange 2010, Sharepoint 2010, etc) so you probably don't want to actually USE HMC but you might glean some useful info from it.

Separate from the Windows stuff, I can see how your dedicated VLAN config might work well.

share|improve this answer
One advantage with building an AD for each customer is that for certain customers I can now let them manage their own systems. We host, do the backups etc and they can create and manage their own users. With a central AD like we have right now we can't do that – Matt Mar 24 '10 at 3:54
What he means Matt, is to keep your current domain as a Forest root, and to create child domains in that forest for each customer. – Izzy Mar 24 '10 at 6:07
@Izzy: ooooooh ok. I've seen hosting companies go down the multi-forest route and immediately assumed that is what he meant. Thanks. – icky3000 Mar 24 '10 at 6:34
The domains only contain about 5 - 10 users each... so a separate DC doesn't take much management. I understand what you're saying though. – Matt Mar 24 '10 at 19:50

This seems like a very sensible plan. Check out Microsoft's ADMT. I've used it before for AD Migrations, and it worked quite well.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.