Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Basically the idea is to copy and update 1 OU in the master Domain into slave Domain. The OU will have users and groups in it. If a new user is created in the master domain they will be created in the slave domain. If the user changes there password in the master domain it will update in the slave domain. Note: users don't change their password in the slave domain.

I have currently setup an import MA for the master domain and an export for the slave domain in my dev environment. If I configure the attribute flow I can get update attributes in the slave domain from the master.

I am open to suggestions for other software that will achieve this goal.

share|improve this question

Can't speak for Forefront Identity Manager (although we do have it at my org), but I can vouch for Quest Active Directory Migration Manager. Trial download is available for you to try before you buy.

We migrated 000's of users from one domain/forest to another domain/forest, and we used this tool to keep the accounts synchronised between domains. It also kept their passwords synchronised on an ongoing basis (until we completed the merger and no longer needed the synchronisation)

share|improve this answer
Unfortunately that software will be to costly to justify. To clarify the scale is multiple slave domains with < 20 users each. With less then 100 users total in the master domain. – baz Sep 22 '10 at 5:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.