3

Background: I'm one of two IT people managing five libraries (all part of the same library system), and each library has been set up with their own AD DC.

I'd like to centralize this. I'm assuming I can somehow add the current DCs to our Main library's AD server, but my Google-Fu is failing me. I expect the answer is out there, and I'm just not phrasing it correctly for Google.

Setup: Each branch library is on their own network with their own firewall and Staff stations only connect to our main library via VPN. Servers do not talk to our Main library at all. Main AD DC is running Server 2012. Branch Servers are running 2008.

In case this helps, or in case I'm barking up the wrong tree: I'd like to do this because

  1. I'd be able to easily sync GPOs across every server.
  2. I'd like to set up a DFS Rep service to sync a few important files across every server.

Not to mention easier management.

Question: So, Am I even able to do this with our current configuration? If not, what would we need to change? Any other recommendations? Just about any information at all would be swell.

Improve this question
4
  • Each location has its own AD forest?
    – Greg Askew
    Commented Apr 20, 2015 at 14:19
  • Yes. Each branch is a self-contained environment outside of our Main library's network.
    – zomgdavidbowie
    Commented Apr 20, 2015 at 14:22
  • Depending on how many users/machines you have at each site it might just be easier to migrate everyone to your domain. I don't know of a way to merge AD forests.
    – Linuxx
    Commented Apr 20, 2015 at 14:43
  • Funnily enough, the users at the remote sites are the very same users we have at our Main branch. I think the real issue for us is going to be setting up a reliable connection between the Main DC and Branch DCs. We're trying to move away from VPNs, so I'd rather not set up a permanent VPN connection between the Branch servers.
    – zomgdavidbowie
    Commented Apr 20, 2015 at 14:52

1 Answer 1

Reset to default
3

You aren't going to be able to synchronize GPO's across forests, although you can copy GPO's across forests if a suitable trust exists.

I don't think DFS replication works across forests.

DFS Replication: Frequently Asked Questions (FAQ)
https://technet.microsoft.com/library/cc773238(WS.10).aspx

Must members of a replication group reside in the same domain?

No. Replication groups can span across domains within a single forest but not across different forests.

Improve this answer
5
  • Curses. I was afraid you'd say that. I'm not sure if migrating their forests over to ours would be worth the time, and honestly I'm not sure how that'd work with those servers working in remote sites on different networks. Is it even possible / recommended to do that? Have a forest on our Main AD DC that controls a remote AD server?
    – zomgdavidbowie
    Commented Apr 20, 2015 at 14:44
  • Consolidating forests is non-trivial, and there could be conflicting technical or non-technical requirements that would make it a very long, detailed process. At the very least there would need to be one-way forest trusts (branches trust the main location). If that isn't feasible, a consolidation may be more difficult (depending on the number of accounts/resource servers and politics).
    – Greg Askew
    Commented Apr 20, 2015 at 14:54
  • Considering what I want to do with it, do you personally think it'd be worth the effort of consolidating forests? It's something I haven't done before, and honestly I'd like to sink my teeth into something like that, but if it's extremely time-consuming I'll leave it as-is and pursue other options.
    – zomgdavidbowie
    Commented Apr 20, 2015 at 14:57
  • Difficult to say without knowing more about the environment. If there are more than small number of user accounts/applications/data, it most likely be a long process with a lot of planning/coordination across multiple teams/locations.
    – Greg Askew
    Commented Apr 20, 2015 at 15:00
  • In that case, I think I might be in an ideal environment for this sort of thing. Branches are fairly small, and aren't likely to grow any time soon. Apart from the build-in accounts, we have three or four user accounts & averaging about 10 PCs per branch (plus the DC).
    – zomgdavidbowie
    Commented Apr 20, 2015 at 15:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .