DC/DNS Move to New VLAN/Subnet
Posted on 2009-05-05
Due to security considerations, we have created a "management" VLAN to which key systems and services (e.g. WSUS, antivirus central control, DCs, DNS services) will be moved from their current VLAN subnet to the new management VLAN/subnet. (All machines in the DMZ run in their own AD domain.) We need to move the two DCs/DNS servers to this new VLAN. The IP addresses, of course, will have to change and any machine pointing statically to the DNS servers will have to have those IP addresses changed. (We have already configured the VLAN to allow/route the needed traffic between the two VLANs.)
One of our techs seems to think it is as simple as changing the DNS/DC IP address (subnet is the same) to the new subnet/vlan IP addresses reserved for this purpose for both DC/DNS machines and then changing the other DMZ machines' DNS entries.
Having never done this before, I'm not so sure it is that simple. I'd rather be sure the process is done such that we don't lose the DNS resolution or screw-up AD.
If you have experience doing this and can give us the steps along with appropriate testing ideas or can point us to an appropriate KB article that relates to this, your help would be greatly appreciated.
Many thanks in advance for your help with this!