Sync OUs within Active Directory

Question

I'm setting up two OUs in Active Directory to support a software package we're getting ready to roll out. One OU is for production, the other for training/sandbox. It is required that these be independent OUs in the same domain rather than multiple domains or one OU to support both environments — the software connects to Sql Server and uses the database name in Sql Server to find the correct OU. I want to sync (copy) groups and their users from the production OU over to the sandbox OU from time to time.

The problem is that there are numerous universal groups in the production OU, and Active Directory won't let me create a new group with the same name in the sandbox OU. The good news is that the group names in production all have a two character prefix that I can alter for the sandbox (it will mean some sql server work as well, but I'm more than up for that part). Also, it only contains groups, nothing else, and the groups are just one level deep.

What I'm asking, then, is the following:

1. Can I get active directory to allow me to have groups with duplicate names in 2 different OUs, and if so, how? I expect this isn't possible and I'm prepared for that, but I want to be sure I'm not missing something obvious.
2. Can anyone point me to a product (preferably free) that will handle the sync operation from production to sandbox? And if not...
3. VBScript, Batch script, or PowerShell script to handle copying the production OU to the sandbox? I'm not asking you to write it for me, but at least point me in the right direction.

The domain controllers are still Windows Server 2003, if that changes anything.

Answer 1

You're not missing anything obvious re: the group names. You'll need to take your route of changing the character prefixes like you describe.

re: copying the groups - My script from this answer copies users and group membership from one standalone Windows Server machine to another. You could probably re-tool the group portion of this script (or, at least, mine it for ideas). This script won't handle recursive group memberships (copying groups that have groups as members) but that functionality could be added fairly easily. I'd write something to enumerate all the groups in the "Production" OU then iterate through them altering the suffix, creating the group in the "Sandbox" OU if it doesn't already exist, then populating the destination group with the appropriate members and removing any inappropriate members.

Answer 2

You can't have duplicate names in the same directory. If you can change those first two characters then just do that and pick a two-character code for production and another for test.

Answer 3

This is based on the script provided by Evan Anderson (so he'll get the accepted answer credit), but I wanted to provide the exact code I used (of course with a few redactions):

Option Explicit

Dim colSourceGroups, colDestinationGroups, objSourceGroup, objDestinationGroup, objDestinationGroupName, objSourceUser

' Debugging
Const DEBUGGING = True

' Source and destination OUs
Const SOURCE_OU = "OU=SourceOU,DC=example,DC=local"
Const DESTINATION_OU = "OU=DesintationOU,DC=example,DC=local"

' Source and Destination Prefixes to use
Const OriginalPrefix = "YC"
Const NewPrefix = "SB"

' Get groups in each OU
Set colSourceGroups = GetObject("LDAP://" & SOURCE_OU)
Set colDestinationGroups = GetObject("LDAP://" & DESTINATION_OU)
colSourceGroups.Filter = Array("group")
colDestinationGroups.Filter = Array("group")

' Delete groups in the target to avoid conflict on creation   
For Each objDestinationGroup in colDestinationGroups
    colDestinationGroups.Delete "group", 
    objDestinationGroup.Name
Next 'objDestinationGroup

'Copy source group to destination
For Each objSourceGroup in colSourceGroups

    objDestinationGroupName = "CN=" & NewPrefix & Mid(objSourceGroup.Name,LEN(OriginalPrefix)+4)
    If (DEBUGGING) Then WScript.Echo "Creating Group: " & objDestinationGroupName
    Set objDestinationGroup = colDestinationGroups.Create("group", objDestinationGroupName)
    'objDestinationGroup.Put ("Description", objSourceGroup.Get("Description"))
    objDestinationGroup.SetInfo

    'Add users in the source group to the destination group
    'Non-recursive. Currently only supports flat groups (no nesting allowed at this time)
    For Each objSourceUser In objSourceGroup.Members 
        If (DEBUGGING) Then WScript.Echo "Adding user " & objSourceUser.Name & " to group " & objDestinationGroup.Name      
        objDestinationGroup.Add(objSourceUser.aDSPath)
    Next ' objUser
Next ' objSourceGroup

Note that this only copies group names and their users. The descriptions would not come over, and I'm supposed to use Universal rather than global groups, but so far it seems to work well enough for the sandbox db.