I'm setting up two OUs in Active Directory to support a software package we're getting ready to roll out. One OU is for production, the other for training/sandbox. It is required that these be independent OUs in the same domain rather than multiple domains or one OU to support both environments — the software connects to Sql Server and uses the database name in Sql Server to find the correct OU. I want to sync (copy) groups and their users from the production OU over to the sandbox OU from time to time.
The problem is that there are numerous universal groups in the production OU, and Active Directory won't let me create a new group with the same name in the sandbox OU. The good news is that the group names in production all have a two character prefix that I can alter for the sandbox (it will mean some sql server work as well, but I'm more than up for that part). Also, it only contains groups, nothing else, and the groups are just one level deep.
What I'm asking, then, is the following:
- Can I get active directory to allow me to have groups with duplicate names in 2 different OUs, and if so, how? I expect this isn't possible and I'm prepared for that, but I want to be sure I'm not missing something obvious.
- Can anyone point me to a product (preferably free) that will handle the sync operation from production to sandbox? And if not...
- VBScript, Batch script, or PowerShell script to handle copying the production OU to the sandbox? I'm not asking you to write it for me, but at least point me in the right direction.
The domain controllers are still Windows Server 2003, if that changes anything.