[Last Call] Learn how to a build a cloud-first strategyRegister Now


Creating Active Directory Test Network

Posted on 2007-10-08
Medium Priority
Last Modified: 2012-05-05
I would like to promote a member server in my production 2003 AD environent and then take it off the production domain and make it the domain controller for a test environment. I would like to avoid having any reference to this server in my production AD after it is removed. I'm concerned about messing up the current FSMO roles. Also can I capture these roles on the test server after it is off the production domain so that it would function on it's own as single domain controller in my test environment.

Since I do not have spare servers that match my current production hardware, I believe that doing restore of the system state (AD) on my test hardware is out of the question. From what I have read it is a messy process. I thought that this might be an easier way to get my AD in a development environment.

Any help is much apprecieated.
Question by:jmarenghi
LVL 30

Accepted Solution

LauraEHunterMVP earned 700 total points
ID: 20034773
Your biggest concern is that the test network and the production network need to be completely physically disconnected - if you start making changes in test and test can still talk to production, production can get really unhappy, really quickly.  Additionally, once you remove this DC and place it in TEST, it must -never- be returned to the production environment without first being refomatted and re-installed.

As long as you can be assured of that physical disconnect, what you've described is a very common way to set up a test AD:

[1] DCPROMO the new "test" DC, configure it as a global catalog server, and move it into the physically disconnected network.  Re-IP as needed.  We will now call this the TEST domain.

[2] In the PRODUCTION domain, perform a metadata cleanup of the DC you just placed in TEST to remove references to it: http://support.microsoft.com/kb/216498

[3] In the TEST domain, perform a metadata cleanup of all DCs in production, using the same steps as in #2.  Then seize all 5 FSMO roles to this TEST DC: http://support.microsoft.com/kb/255504, and configure the TEST DC to obtain its time from an authoritative time server: http://support.microsoft.com/kb/816042
LVL 70

Assisted Solution

KCTS earned 300 total points
ID: 20035065
Depending on your needs you could perphaps do what you want with virtual machines using VMWare, Virtual PC or Virtual server will allows you to  realistically dulpicate a production environment without the need to have vast amounts of hardware while keeping the system completely seperate from your production domain

See http://www.microsoft.com/downloads/details.aspx?familyid=64db845d-f7a3-4209-8ed2-e261a117fc6b&displaylang=en

Author Comment

ID: 20035368
Thank you very much.

I will move forward with Laura's solution.

KCTS I am currently looking to get a decent server appliance and start the process of learning some of the popular virtializtion systems out there.

I'm bumping points and splitting.


Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A hard and fast method for reducing Active Directory Administrators members.
Transferring FSMO roles is done when an admin wants to split roles between certain Domain Controllers or the Domain Controller holding the Roles has been forcefully demoted using dcpromo / forceremoval
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

834 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question