Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My firm currently has two offices. We have a very simple setup - at the head office is the primary Windows Server 2003 R2 domain controller and at the other office is a secondary Windows Server 2003 R2 domain controller.

The second office is being sold off as it's own company so the network needs to be split and email etc hosted elsewhere.

In preparation for this, is it possible to, for lack of a better description, migratethe secondary DC so that it is the primary DC of its own domain and transfer all users and permissions etc to the new domain.

Once that's done is it possible, via trusts, to allow the current level of access to continue until the go-live date of the new company?

Does the AD Migration Tool support this scenario?

Hopefully that makes sense...

Many thanks.

share|improve this question
up vote 1 down vote accepted

Firstly, there is no such thing as primary or secondary domain controller in an Active Directory environment, it is a multi master setup so all DC's are masters. That said, there are a number of roles, called FSMO roles that sit on a particular domain controller. If any of these sit on the DC in your head office (as I assume this is where the current domain will still exist). This is a good article about how to do this.

For your branch office to have a new domain you cannot just migrate it, you will need to demote the domain controller (once an FSMO roles have been moved, as well as an domain services such as DNS< DHCP etc) so that it is removed from the original domain. Once this is done you can then promote this machine to be a domain controller of it's own domain and set your network up accordingly. Once this is done you can set-up trusts between these two domains to allow access between them.

However, setting up AD trusts and allowing access between your two networks is not a simple task, if you knowledge of AD is not up to scratch then I would suggest you need to look at getting some one in to handle this whole process for you, as there are many ways it can go wrong.

share|improve this answer
Thanks for coming back to me so quickly @Sam. Putting aside issues with trusts etc for a moment... When I promote the server at the second office to a DC of it's own domain would I be able to use the ADMT to move user accounts between the domains? – Danny Apr 27 '11 at 10:22
You should be able to do so, you would have 2 separate, unrelated domains which ADMT should allow you to migrate objects between. – Sam Apr 27 '11 at 11:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.