?
Solved

AD Restructuration

Posted on 2009-04-27
8
Medium Priority
?
179 Views
Last Modified: 2012-05-06
I have AD Domain (mydomain.com) that has child domains I also have separate domains.
I have built another domain named the same, mydomain.com.
Now I want all the objects in the old domain to be migrated to the new domain,but since they have the same name, migration will get tough.

I was wondering if I drop a new DC in the existing Domain, just to have objects replicated to it, then take offline and do the migration and restructuratuin of AD for the new domain.
I guess I still will have to migrate the child domains to the parent domain. because I don't want to have child domains in the new domain. I will also need to migrate the objects from separate domain to the new domain
has anyone donae this type of migration, and how hard/easy it is?
I thought about rejoining computers to the new domain will be much easier than migration, though it will have some downtime during the reboot of servers.


Thanks
0
Comment
Question by:jskfan
  • 4
  • 4
8 Comments
 
LVL 71

Expert Comment

by:Chris Dent
ID: 24239905

Hey jskfan :)

I've done one or two of those: )

First, collapsing child domains into the forest root. There are two tools which can help here.

MoveTree:

Download:

http://www.microsoft.com/downloads/details.aspx?FamilyID=96a35011-fd83-419d-939b-9a772ea2df90&displaylang=en

Usage:

http://support.microsoft.com/kb/238394

 - This can be used to move Users and Groups into the Forest Root
 - The sidHistory will be populated with the SID from the original domain
 - Any links to Exchange Mailboxes are maintained with this move (no action required)
 - It works perfectly for 2003 even if it doesn't state that in the KB article

The catch is that group membership will have to be checked / rewritten after the move has completed. However, it's much less effort that the next tool for moves within a forest.

Active Directory Migration Tool (ADMT):

Download:

http://www.microsoft.com/downloads/details.aspx?familyid=AE279D01-7DCA-413C-A9D2-B42DFB746059&displaylang=en

 - Can be used to move the computers over
 - It will re-write the security on the computer so the user profile works "as is"

Okay, so that's the easy bit. Your cross-forest move is much much harder because of "named the same". Is that really a requirement? That excludes the use of the tools above, meaning you have to do everything they did for you manually. Security is the biggest catch there because you will not be able to populate sIDHistory without a Trust and the tools mentioned above (and one other that also requires a trust).

> I was wondering if I drop a new DC in the existing Domain, just to have objects replicated to it,
> then take offline and do the migration and restructuratuin of AD for the new domain.

I'm not certain how this would help. There's no requirement to delete objects in the source domain with a migration (you can, but you don't have to). But you would still have to deal with re-joining computers to this domain if you were to go back.

Chris
0
 

Author Comment

by:jskfan
ID: 24239992
in our environment we need only computer objects to be migrated to the new domain.
User objects , we can create them manually since we don't have many.
Regarding the migration, when you migate an object does it stay in the original place too, just like copying it or it gets deleted from the original place (for instnace from an OU)?
Because I thought I could take a DC from the current domain offline, and do the migration of child domains to parent domain then get rid of child domains and restructure my AD  then put it in the new domain.



0
 
LVL 71

Expert Comment

by:Chris Dent
ID: 24240038

Computers are about the most complex, although that depends how much you care about your users :) If you don't have to maintain user profiles then all you have to do is join it to the new domain.

> Regarding the migration, when you migate an object does it stay in the original place too,
> just like copying it or it gets deleted from the original place (for instnace from an OU)?

If you're using ADMT you can tell it to do either (it's a tick box if you use the GUI).

> then put it in the new domain.

Even if the domain is the same name it is not the same domain. It won't talk to the new domain controllers if that's what you're expecting?

Chris
0
Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

 

Author Comment

by:jskfan
ID: 24240068
<<Even if the domain is the same name it is not the same domain. It won't talk to the new domain controllers if that's what you're expecting?>>>
Even after I disconnect the old domain?
0
 

Author Comment

by:jskfan
ID: 24240078
You mentionned user profiles, is there any way to back it up and restore it to the new domain.
For now users have just local profiles.
0
 
LVL 71

Accepted Solution

by:
Chris Dent earned 2000 total points
ID: 24240111

> Even after I disconnect the old domain?

Regardless of what you do to the old domain. A DC belonging to that old domain cannot be shifted to a new domain without demoting it, and joining it to the new domain as a member server. Demoting it will, of course, wipe out any AD data it held.

> For now users have just local profiles.

The old profile will still be on the PC. But even if the user account is the same name a new profile will be created for the user when they log onto the new domain. The naming of the profiles is a bit deeper than just  the user name, it uses the SID and GUID of the user account in the domain.

Without the migration path and a valid sIDHistory the old profile will be inaccessible and pretty useless without rather a lot of work on each and every client.

The client-side work is fine if you only have a small number of users, say 100 - 200 depending on your IT staffing levels (how many people you can make help fix them). But if you have more than that it'll be extremely painful in my opinion.

Chris
0
 

Author Comment

by:jskfan
ID: 24244865
Chris,

is it possible to rename a domain. if so , I will rename the new domain different than the old domain.
I will create a trust, make migration of the objects from the old domain to the new domain without deleting them from the old domain, then disable the trust and go back to the new domain and rename it the way I want it.
would this work?

0
 
LVL 71

Assisted Solution

by:Chris Dent
Chris Dent earned 2000 total points
ID: 24248801

It's possible, it has a number of requirements and I wouldn't term the process simple. It involves use of this tool:

http://technet.microsoft.com/en-gb/windowsserver/bb405948.aspx

With fairly extensive additional documentation on it here:

http://technet.microsoft.com/en-us/library/cc786120.aspx

You'd have to cover the documentation for it carefully, it's rather involved.

Chris
0

Featured Post

NEW Veeam Agent for Microsoft Windows

Backup and recover physical and cloud-based servers and workstations, as well as endpoint devices that belong to remote users. Avoid downtime and data loss quickly and easily for Windows-based physical or public cloud-based workloads!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Uncontrolled local administrators groups within any organization pose a huge security risk. Because these groups are locally managed it becomes difficult to audit and maintain them.
Active Directory can easily get cluttered with unused service, user and computer accounts. In this article, I will show you the way I like to implement ADCleanup..
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question