1

I have a single forest, single domain, and redundant AD controllers. i need to split companies. Move current AD to one server, and establish a new domain/company on the old server. I would need to retain GPO policies the same and edit. Same with AD.

If I remove the role from one server, will the AD info still be there? Basically, what is the proper way to accomplish this?

Improve this question
3
  • So are you making a new domain in the same forest, or starting a whole new forest? – Ryan Ries Mar 9 '12 at 21:16
  • I would just assume separate two companies assets as best possible since I have the extra server. I can VLAN the router if I need. ...so new forest new domain I would gather. – Seth Mar 9 '12 at 21:20
  • just be aware that vlans have nothing to do with Active directory. – tony roth Mar 11 '12 at 1:05
1

Unless one server needs to leave the premises, do not split them. Create a new domain under the current Forest, export the GPOs from the existing domain and import them into the new domain.

Only having a single DC is a recipe for disaster. Two DCs is a minimum.

Improve this answer
3

Demote one of the servers with DCPROMO.

Promote it with DCPROMO again, creating a new forest and domain.

You should be able to backup your GPOs and restore them from backup in the new domain. The exact procedure may differ slightly depending on your version of Windows.

Consider using DNS conditional forwarders or something to allow name resolution between the two forests. There is more than one way to accomplish this.

Create a trust between the two domains, if company policies allow it. These will allow authentication between the two new forests.

They can be on the same network. You don't have to mess with your network/router if you don't want to.

edit: Here's some info that might help you in migrating your GPOs: http://technet.microsoft.com/en-us/library/cc781458%28WS.10%29.aspx

Improve this answer
5
  • 1
    This will work, but it'll leave the OP with two domains, each of which only has a single domain controller, which is very much sub-optimal. – EEAA Mar 9 '12 at 21:42
  • Agreed, but based on how he worded his question, I don't believe he has any more hardware to work with. :) – Ryan Ries Mar 9 '12 at 21:45
  • Sure, I just thought it would be prudent to issue a warning about running with single DCs. – EEAA Mar 9 '12 at 21:47
  • Are you only concerned with the GPO's? What about NTFS ACLs on any of the data? Those are domain specific and could make the split more complex. – Clayton Mar 9 '12 at 22:23
  • :-) I guess more specification would help with that, I have a separate file server for data files. I use Security Groups and OU's/GP for each company to segregate user access, between the two companies now. (pardon my ignorance on ACL's) With interdependent trusts could I not create new groups and edit logon script if needed? company directories are two root folders. – Seth Mar 26 '12 at 19:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.