My company was acquired by another company. Both companies have existing AD forests and domains. The company that acquired us ,also has international sites.What would be the best practice/solution to get both AD forest and domains working together?

  • 1
    Define working together. – joeqwerty Jan 15 '15 at 16:59
  • 1
    there are lots of answers here, cross forest trusts, adfs, or merge the forests. You need to choose a specific problem – Jim B Jan 15 '15 at 21:46
  • @JimB I'm not sure I agree. ADFS is for separate organization, and probably doesn't apply here, merging the forests isn't making them work together; it combines them into one... so that really just leaves a cross-forest trust as the only valid answer I see. Of course, this is a very high-level answer to a very high-level question, and a more detailed answer would require a more specific problem, or realistically, a consultant. – HopelessN00b Jan 15 '15 at 23:13
  • Adfs is for claims based authentication (not sure where you got the separate org piece from) and if both orgs have their priority apps set up for claims, its far simpler, faster and more secure than doing a cross forest trust. Cross forest trusts are usually used when you trust the partner org, a dubious position and irresponsible position (potentially) in a merger, and could require infrastructure changes. The Cadillac route is a forest merge with ADFS to make app migration faster as well as have an agreed upon directory set, but like a Cadillac, isn't the cheapest. – Jim B Jan 17 '15 at 16:15

Back up everything! AD is one complex and picky beast. You don't want to be responsible for bringing down a whole domain.

If your using exchange the first step is usually too change the mail domain for all of the users of the company which was purchased to the head companies domain. You will have to set up shared address space SMTP and Mail routing for this to work.

Afterward you will want to create a trust between both forests to allow users to interact between forests. There are a lot of options here to determine how the trust operates and every organization does this a bit differently. I suggest reading up on it a lot before you attempt it.

Technically speaking that's all you have to do to make it work, but it's not very clean. I would probably use a tool like ADMT to actually merge the forests after I had everything working. But keep in mind that there are lots of small things that can break this. Namely SID checking and a few other small bits. This is where a real AD expert would be handy. I understand that's not always possible, the only reason I learned to do this was because I found myself in your same position and the higher ups looked to me to make it happen.


Creating a cross-forest trust.

This can be complex, and I would recommend bringing in an Active Directory expert. Here's some basic reading on Active Directory trusts.

  • This is a really poor answer (ad hominem): "you have to ask, though, indicates you're not the guy to do it" – Konrads Jan 15 '15 at 17:03
  • 2
    @Konrads Right, clearly someone who doesn't even know what a cross forest trust is should be in charge of integrating two companies' forests. – HopelessN00b Jan 15 '15 at 17:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.