2

I have attempted to figure this out with only my google-fu, however I am not familiar enough with active directory to confidently use guides not about my specific situation without at least asking. Any guides or recommendations you can throw my way would be much appreciated, also what are the big problems I should be on the lookout for?

Currently

We have a new server (2008 R2 standard) we are setting up as a domain controller for a new domain "CompanyA". We currently have a domain controller for the domain "project1", but we need to change servers and domains for various reasons.

Short term goal

We would like to setup the new domain so that "project1" is trusted, so all of our current accounts work on it. Then, as we setup/upgrade services/accounts move them to the new domain (e.g. new SharePoint server, new users, new file server,etc..)

Long term

Eventually (1-2 years) we will remove the "project1" server and domain and migrate the remaining users and computers over to the new domain.

To recap, I'm looking for: * Will this work? * How should I go about it? * Potential Problems

Update - Implemented

OK, it worked with some hiccups. Yes you do need to add them to each others DNS; I used conditional forwarders. Our big problem is permissions, external accounts can't be added to certian groups so I can't allow them to access Hyper-V :( I'm ok with having two accounts for administration (Can't add them to Domain Admin) but I wish I wasn't limited to remote desktop to manage the server/Hyper-V, the RSAT is useless because it pulls your credentials from your windows session.

If your DNS or network is having issues the trust will break / not establish, evidently these are "usual suspects" and proved to be where my problems originated from.

Improve this question

2 Answers 2

Reset to default
3

I will gve you the same answer I gave to a very similar situation this morning:

In the short term, clearly a trust is the way to go. In the long term, you will probably do it using the Active Directory Migration Tool and the Password Export Server.

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=20c0db45-db16-4d10-99f2-539b7277ccdb http://www.microsoft.com/downloads/en/details.aspx?familyid=F0D03C3C-4757-40FD-8306-68079BA9C773&displaylang=en

I suggest that you read this document Microsoft on how to use the ADMT and restructuring domains.

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=6D710919-1BA5-41CA-B2F3-C11BCB4857AF

Improve this answer
4
  • +1. Trusts are the way to go.
    – Hyppy
    May 27, 2011 at 14:43
  • Will I need to do anything special to get the DNS working correctly between the two?
    – Chance
    May 27, 2011 at 14:55
  • You will probably have to add the domain of the other domain to each DNS server, but I am not sure if there is more you have to do. I will see if I can find out more later, but I have to go physically move a company this morning. Check back later.
    – KCotreau
    May 28, 2011 at 10:00
  • We have tested this on virtual machines and it works, I'll update back when we implement it. Thanks!
    – Chance
    May 30, 2011 at 13:50
1

Is it a must that you must change the domain?

because you can affectively just add new 2008 servers and promote them to DC's instead. Once replication has happened you can move all the FSMO roles acorss to the 2008 servers then decommision your old servers. You now have the same domain but with new hardware. You can then upgrade the domain to be 2008 compliant once old servers are gone.

Basically this achieve all your goals above except the domain name will be the same.

Improve this answer
1
  • Unfortunately we do need to change the name :/
    – Chance
    May 27, 2011 at 14:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .