6

We have a forest root domain of legacy_domain.loc, and another domain modern_domain.loc which exists in a structure similar to:

legacy_domain.loc ----- modern_domain.loc 
       |                       |          \
       |                       |           \
[DC1 & DC2 only]        [DC's, Users,       \
                          Servers,           \ 
                      Workstations, etc.]     \
                                        dev.modern_domain.loc
                                                 \
                                                sub.dev.modern_domain.loc

The only resources in the legacy_domain domain, are the domain controllers themselves. It is also the forest root domain.

Is it possible to make modern_domain the forest root, and then collapse/eliminate the legacy_domain domain?

Basically, when AD was first introduced to the company many years ago, the overall architecture was extremely complex. Over the years, as technology has improved and needs have changed, the superfluous domains were all consolidated/collapsed into what remains today. With everything being in modern_domain, we'd like to finally shed legacy_domain.

Any suggestions/thoughts would be appreciated!

1

The best solution is to migrate to a greenfield environment. While possible to migrate all modern objects to legacy, the amount of effort required to move the objects in modern is roughly the same as moving to greenfield forest, but the greenfield effort has the benefit of also cleaning up any leftover objects or potentially compromised accounts.

1

Short answer: No you cannot.

Long answer: The first domain create in an forest is used to identify the forest in self. This document explain in a simple but clear the AD Forest Architecture.

The only way to move out of this scenario is migrate the other two domain in brand new forest.

This other document is a good starting point to find procedure, best practices and tools.

An advice: it is not a simple or fast process and require a lot of planning, in my humble opinion it is useful only if you have to remove a lot of junk in your domains.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.