Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have attempted to figure this out with only my google-fu, however I am not familiar enough with active directory to confidently use guides not about my specific situation without at least asking. Any guides or recommendations you can throw my way would be much appreciated, also what are the big problems I should be on the lookout for?


We have a new server (2008 R2 standard) we are setting up as a domain controller for a new domain "CompanyA". We currently have a domain controller for the domain "project1", but we need to change servers and domains for various reasons.

Short term goal

We would like to setup the new domain so that "project1" is trusted, so all of our current accounts work on it. Then, as we setup/upgrade services/accounts move them to the new domain (e.g. new SharePoint server, new users, new file server,etc..)

Long term

Eventually (1-2 years) we will remove the "project1" server and domain and migrate the remaining users and computers over to the new domain.

To recap, I'm looking for: * Will this work? * How should I go about it? * Potential Problems

Update - Implemented

OK, it worked with some hiccups. Yes you do need to add them to each others DNS; I used conditional forwarders. Our big problem is permissions, external accounts can't be added to certian groups so I can't allow them to access Hyper-V :( I'm ok with having two accounts for administration (Can't add them to Domain Admin) but I wish I wasn't limited to remote desktop to manage the server/Hyper-V, the RSAT is useless because it pulls your credentials from your windows session.

If your DNS or network is having issues the trust will break / not establish, evidently these are "usual suspects" and proved to be where my problems originated from.

share|improve this question
up vote 3 down vote accepted

I will gve you the same answer I gave to a very similar situation this morning:

In the short term, clearly a trust is the way to go. In the long term, you will probably do it using the Active Directory Migration Tool and the Password Export Server.

I suggest that you read this document Microsoft on how to use the ADMT and restructuring domains.

share|improve this answer
+1. Trusts are the way to go. – Hyppy May 27 '11 at 14:43
Will I need to do anything special to get the DNS working correctly between the two? – Chance May 27 '11 at 14:55
You will probably have to add the domain of the other domain to each DNS server, but I am not sure if there is more you have to do. I will see if I can find out more later, but I have to go physically move a company this morning. Check back later. – KCotreau May 28 '11 at 10:00
We have tested this on virtual machines and it works, I'll update back when we implement it. Thanks! – Chance May 30 '11 at 13:50

Is it a must that you must change the domain?

because you can affectively just add new 2008 servers and promote them to DC's instead. Once replication has happened you can move all the FSMO roles acorss to the 2008 servers then decommision your old servers. You now have the same domain but with new hardware. You can then upgrade the domain to be 2008 compliant once old servers are gone.

Basically this achieve all your goals above except the domain name will be the same.

share|improve this answer
Unfortunately we do need to change the name :/ – Chance May 27 '11 at 14:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.