Microsoft, Active Directory, 2003, Single Domain Migration

A few thoughts in no particular order:

* "Is this forest unnecessarily complex?"

For my money, a single-domain forest will work for 90-95% of organizations out there.  The only reason to set up a multiple domains within a single forest is if you have a subset of users who require a different password or account lockout policy, as at the moment these 2 things can only be set at the domain level. (However, that statement becomes untrue once Windows Server 2008 ships, as 2008 allows for multiple password policies within a single domain.)  The thing to keep in mind is that it is the forest, not the domain, that provides a true security boundary within Active Directory - if you're creating a separate domain within a forest thinking that this will prevent the administrators of that domain from "messing with" the rest of the directory, what you actually need is a separate forest.  (Because of the transitive nature of trust relationships within a forest, it is trivial for a Domain Admin in a child domain to elevate their privileges to Enterprise Admin.)  If you have multiple sites separated by slow links, you can use sites and site links within AD to control the flow of replication traffic, even within a single domain, so as not to over-burden your WAN links.

* "What do I need to consider before decommissioning a DC?"

To decommission one DC in favour of new hardware:

[1] Perform a clean install of the server OS on the new hardware. Assuming this server provides your DNS/WINS name resolution, install these services onto the new server. If this server provides DHCP, install this service.
[2] If you are introducing a DC with a new OS, run adprep /forestprep and adprep /domainprep from the 2003 media.  (If this is R2, use the version of adprep that's on Disc 2 of the R2 media.) Run dcpromo to add the new server as an additional DC in an existing domain.
[3] Configure the new DC as a Global Catalog.
[4] Transfer all 5 FSMO roles to the new DC: http://support.microsoft.com/kb/324801
[5] Configure the new DC with an authoritative time server: http://support.microsoft.com/kb/816042
[6] Configure your network clients to point to the IP address of the new DC for DNS/WINS, if applicable from #1.
[7] Transfer your DHCP scope(s), leases and reservations from the old DC to the new: http://support.microsoft.com/kb/325473. De-activate the scope(s) on the old DC and confirm continued client connectivity.
[8] Once you're ready to decommission the original hardware, either:
  * run dcpromo on the old server to remove Active Directory from the server (this is the preferred option if possible), or
  * power down the server and perform a metadata cleanup of the old DC from the new DC: http://support.microsoft.com/kb/216498

My other recommendation, based on the size of the deployment you're discussing, would be to investigate some of the third-party migration tools like the one offered by Quest.  Microsoft has the AD Migration Tool (ADMT) that's a free download from their website, but when you're working in large numbers the third-party tools can do some nicer things with reporting and making the process more seamless to your user population.