?
Solved

Active Directory Split

Posted on 2009-02-24
8
Medium Priority
?
707 Views
Last Modified: 2012-08-14
I'm wondering if there's a way to take a server from a pre-existing domain, establish it as a DC and then move it to a new business and not have sync problems after 90 days (tombstone'd domain). Is there a procedure for this at all?
0
Comment
Question by:lbc_matt
  • 3
  • 2
  • 2
  • +1
8 Comments
 
LVL 57

Expert Comment

by:Mike Kline
ID: 23724654
Are you trying to add a domain controller from domainA into domainB
or are you just moving the DC from domainA to the physical location of domainB but still have connectivity back to the original domain?
Thanks
Mike
 
0
 

Author Comment

by:lbc_matt
ID: 23724722
This is what is happening. Company B is purchasing part of Company A. Company A has a pre-existing domain that has a couple servers in it that Company B is purchasing. My question is (and I'm doubtful this is even possible) can I keep the domain intact and move the servers that are being purchased while cutting communication with the original domain, and create kind of a "clone" domain. If this makes sense.
0
 
LVL 27

Expert Comment

by:bluntTony
ID: 23724850
If I understand correctly, you want to take a DC from an existing domain and use it to run another, new independent domain with the same name. You want to 'clone' your domain.

Technically, once the DCs are seperated permanently, you could perform a metadata cleanup on each server to remove traces of the other server from it's copy of the database. Then they wouldn't be aware of the split, and replication issues would be negated.

This explains how to perform a metadata cleanup along with a few other checks: http://www.petri.co.il/delete_failed_dcs_from_ad.htm

You would then have to ensure DNS is all correct, and clean up AD in the new site so that old machines/users don't exist. I sue there would be other problems, especially if your running Exchange.

Not sure why you would want to do this though! Maybe I've misunderstood your question :)
0
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

 
LVL 57

Expert Comment

by:Mike Kline
ID: 23724998
If the servers that they are buying are member servers then yes it is possible.  You would just join them to the new domain.
If they are domain controllers then no you won't be able to move them into company B.  
Not sure if that is what you are looking for.
Another option is to migrate the objects from companyA to companyB.  That would take some planning and a trust.  You could use a tool like Active directory migration tool for that.
Thanks
Mike
0
 
LVL 18

Expert Comment

by:Americom
ID: 23725142
What type of servers are those that being purchased and be removed from the existing domain? In my opinion, any member sever can be moved to any domain as long as you follow the configuration requirements. There's no reson to move the existing domain unless you plan to retain the name and continue to run those servers in that domain. What you call split domain is probably you want to move part pa the existing domain over and leave the rest remain. It possible if the moved portion has a DC as well as the remaining portion has a DC and these portions have no physical connection meaning cannot see each other. Otherwise you would have duplicate names etc. Even if they rull not be connected, you you still have to do cleaning on both portion of the splited domain ensure that the moved option does not exist in the remaining one and vice versa. Plus in that case, you also need to seize FSMO in at least one of the splited domain depending on which one has the domain and forest infrastructure. But this is just too odd and don't wish to recommend that path.
0
 
LVL 18

Expert Comment

by:Americom
ID: 23725149
What type of servers are those that being purchased and be removed from the existing domain? In my opinion, any member sever can be moved to any domain as long as you follow the configuration requirements. There's no reson to move the existing domain unless you plan to retain the name and continue to run those servers in that domain. What you call split domain is probably you want to move part pa the existing domain over and leave the rest remain. It possible if the moved portion has a DC as well as the remaining portion has a DC and these portions have no physical connection meaning cannot see each other. Otherwise you would have duplicate names etc. Even if they rull not be connected, you you still have to do cleaning on both portion of the splited domain ensure that the moved option does not exist in the remaining one and vice versa. Plus in that case, you also need to seize FSMO in at least one of the splited domain depending on which one has the domain and forest infrastructure. But this is just too odd and don't wish to recommend that path.
0
 
LVL 18

Expert Comment

by:Americom
ID: 23725184
What type of servers are those that being purchased and be removed from the existing domain? In my opinion, any member sever can be moved to any domain as long as you follow the configuration requirements. There's no reson to move the existing domain unless you plan to retain the name and continue to run those servers in that domain. What you call split domain is probably you want to move part pa the existing domain over and leave the rest remain. It possible if the moved portion has a DC as well as the remaining portion has a DC and these portions have no physical connection meaning cannot see each other. Otherwise you would have duplicate names etc. Even if they rull not be connected, you you still have to do cleaning on both portion of the splited domain ensure that the moved option does not exist in the remaining one and vice versa. Plus in that case, you also need to seize FSMO in at least one of the splited domain depending on which one has the domain and forest infrastructure. But this is just too odd and don't wish to recommend that path.
0
 
LVL 27

Accepted Solution

by:
bluntTony earned 2000 total points
ID: 23732803
Other issues are that you will need to ensure all five FSMO still exist on each domain after the split by seizing the roles.

Also you would have a security issue as both domain's security identifiers would be the same, meaning that security principals in each domain could end up with the same SIDs. Furthermore, your existing user accounts such as Administrator would definitely have identical SIDs meaning that each domain would not be able to differentiate between the two user accounts, causing a possible security issue.

If you moved from an Exchange domain, the 'new' server would still have the schema and data relating to the old Exchange org. This would have to be addressed if you wished to install Exchange on the new domain.
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This process allows computer passwords to be managed and secured without using LAPS. This is an improvement on an existing process, enhanced to store password encrypted, instead of clear-text files within SQL
It’s time for spooky stories and consuming way too much sugar, including the many treats we’ve whipped for you in the world of tech. Check it out!
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …
Suggested Courses

864 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question