Have new domain take over for old domain

Question

I'm working on a solution for this question, and I want to float an idea:

Would it be possible to:

1. Create a new domain in the same forest as the old one
2. Set up a trust relation between the two domains so that the new server can handle the jobs of the old domain or migrate all the computer and user accounts over to the new domain
3. Remove the old domain from the forest, but leave the new domain intact and still handling the duties of the old domain
4. Change the name of the new domain to match the old domain, so that users don't know anything changed.

I suspect it won't work, but I thought it was worth asking.

Answer 1

Unfortunately there is no way to remove a forest root from a domain, that is assuming that you want to remove your first and only domain.

Answer 2

There's nothing in the "old domain" that can't be fixed. Further, I'd state that there's nothing that can't be fixed while the "old domain" is still in production and being used for day-to-day business. I'd go even further out on a limb and say that, so long as you have someone with reasonably good Active Directory knowledge helping you out with the cleanup work, there's very little that can't be done to clean up the "old domain" that would require the users to "notice" that something was being done.

Changing out the entire domain is going to be very difficult not decidedly Not Fun^TM, what w/ workstation trust relationships, domain account SIDs being named in user profiles, and re-creating all your group policy objects and filesystem permissions. Don't do it. You can fix what you already have, and even if you have to contract with somebody to help you you're probably not going to spend the money that it would cost, assuming this is a network of any size, to change out the domain.

Edit:

Ohh-- you're the dude with the missing RID 500 BUILTIN\Administrator account in the domain. I didn't see that when I first wrote this. Like I said in the answer to your question about that, get on the phone w/ Microsoft PSS. They can probably get you out of the jam. In fact, I don't imagine that anyone else can help you anyway. To my knowledge it's going to take very low-level access to the AD database to re-create that account.

Answer 3

You can absolutely trust two domains and use the ADMT tool to move user accounts and computer accounts over, terminate the old domain and then use the domain rename tool to rename the new domain name to match the name of the old one.

Bear in mind though, it's a fairly complex undertaking and needs to be planned accordingly. It is absolutely not something you do in an afternoon without proper testing and end user communication.

Look into ADMT and domain rename over at Microsoft's website to get an overview of the processes.

Answer 4

Here are two links about this process. "Active Directory Domain Rename - Not Difficult At All" and "How Domain Rename Works".

You will have to test it to death. And since the end result will be similar to the start condition. I whould advice you to consider why you are considering this process.

Btw, the second step is not needed. Because domain in the same forest already have trust relationship.