I am currently trying to find the most efficient way to split a single domain into two, distinct, fully functional domains.
We have two sites, and several DCs. The sites, Site A, and Site B, are connected by means of a VPN tunnel. Site A contains 3 DCs, including the DC which holds all of the FSMO roles. Site B simply contains 1 single DC, as well as some client workstations. Exchange is not installed on this domain, as both sites use a cloud-based email service. Due to organizational changes within the business, both sites are now going to be completely separate entities-- controlled and managed by different parties. As such, we need to find a way to implement this change in AD. Obviously, one way to do this would be to simply create a new domain at Site B, and migrate the required data from Site A to Site B using ADMT or some 3rd party tool. However, I understand that we'd need some additional server hardware in order to do this, and an ADMT migration does not look like a simple process.
My current plan is this: simply kill the VPN connection between Site A and Site B. Seize ALL of the FSMO roles onto the DC at Site B. Clean up any remnant issues on the domain controllers. If all goes according to plan, we should end up with two identical, functional domains, and both sites can go on with their lives. On each domain, we'd just remove any traces of the other DCs, as if these machines had simply failed.
I know it's unconventional, but is this a completely terrible idea? Are there any caveats here that I should be aware of which would prevent this from working the way I expect? Has anyone tried anything like this before?
Update: For those interested, we did in fact end up going with this plan. Several weeks in, we have had no issues so far. Obviously there is some risk to this, given the fact that it's unsupported by Microsoft-- so I wouldn't recommend this solution to anyone as a first option. However, for those aware of the risks and short on time / resources as we were, know that it is possible to physically split the network and end up with two identical working domains after cleanup / role seizure. Having reduced a full AD migration to about one hour of work, we are pleased with the decision so far. Only time will tell whether or not this was the right choice.