Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win


Split Active Directory Domain

Posted on 2004-10-26
Medium Priority
Last Modified: 2012-05-05
Scenario: A company splits.  Niether company wants to go trough the trouble of changing the domain name.  All five server roles are running on one AD controller.

Question?  Can we split the domain and have both of the new companies each keep the original domain name.

Let's say new company (A) has the server with all the Roles and new company (B) does not.

We sever the connection beteween (A) & (B).

(A) is fine as it has a Schema master etc... will just need to clean out the AD Controllers using ADSIedit to clean up the controllers that were lost due to the split.

Can company (B) just seize the roles on one of their Global Catalog Servers and continue to run a stable domain?

Theoretically this sounds good but has anyone actually done this?

Thanks for your comments.
Question by:Packerland
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
LVL 20

Accepted Solution

Debsyl99 earned 2000 total points
ID: 12417412

Have I tried this in practise? - well yes - different reasons but same principle I beleive - I have used seizing roles when a full fsmo role holder goes down and it does work - first check that ad replication and dns is fully functional/ok between the two servers.

The only way you can keep the original domain name on two separate networks is as you suggest:

1) A new server is joined to the domain, service packed,  then dcpromo'd upon  which it will get a copy of active directory and yet will be role-less. You then separate the two completely (never to be brought back together) and seize the roles for the domain on the dc that is currently role-less as in article (1). You can keep the roles on dc 1. Then remove the active directory data for the now gone servers from both of them as in article (2) and you could then create two totally separate networks with the same internal domain name, so long as they remain COMPLETELY separate. (you may run into problems if you have the same domain name hosted externally). You'll need to sort out both as global catalogs, dhcp servers, sort out file data transfer etc, you'll also need to sort out which pc's now belong to whom as both will carry identical copies of AD for a short while, but more importantly the SIDS on the workstations attached at the time will remain, so some tweaking for security purposes will be in order. Mat also be tempted to change admin passwords etc etc,

Relevant articles
Using Ntdsutil.exe to seize or transfer FSMO roles to a domain controller

How to remove data in Active Directory after an unsuccessful domain controller demotion (not unsuccessful but principle for suddenly removed dc applies)

I can't see any reason really why it couldn't be done, so long as your companies don't re-merge!

Deb :))


Expert Comment

ID: 12418909

I make this operation sometimes and theoretically and practically it's OK. there will not be any problem if two server has no connection after splitting.
after transfering one of domain controller to new location you just need NTDSUtil tool to remove the DC that is transfer to another site and transfer all roles to existing DC.
first process is to remove the DC that doesn't exist on site A and same process on site B.
http://support.microsoft.com/default.aspx?scid=kb;en-us;216498 to remove DC
http://support.microsoft.com/default.aspx?scid=kb;en-us;255504 to transfer roles.

if you have any problem while using ntdsutil do not hesitate to ask me as I use it often.

LVL 20

Expert Comment

ID: 12419426
Isn't that exactly what I posted Saito1???????? What's the point in duplicating other experts posts? Please don't!
Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.


Expert Comment

ID: 12419811
LVL 20

Expert Comment

ID: 12419837
No worries - had three people in a row in three questions saying exactly what I'd already said so by the time I got round to this one I was a tad miffed - don't worry about it, and have a nice day,
Deb :))
LVL 20

Expert Comment

ID: 14289835
Think I pretty much got this one right, thanks :)

Featured Post

Tech or Treat!

Submit an article about your scariest tech experience—and the solution—and you’ll be automatically entered to win one of 4 fantastic tech gadgets.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Tech spooks aren't just for those who are tech savvy, it also happens to those of us running a business. Check out the top tech spooks for business owners.
How to fix incompatible JVM issue while installing Eclipse While installing Eclipse in windows, got one error like above and unable to proceed with the installation. This video describes how to successfully install Eclipse. How to solve incompa…
Want to learn how to record your desktop screen without having to use an outside camera. Click on this video and learn how to use the cool google extension called "Screencastify"! Step 1: Open a new google tab Step 2: Go to the left hand upper corn…

618 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question