Company Split - how to move servers and some accounts to a new domain

Hello Experts,
Company A has been planning a split from Company B.  
They have their own offices with 2 servers they own, I believe one is a 2003 DC and the other a member server.  They have been logging into Company B domain but all their files reside on the servers on their premises.  
Now Company A is making permanent split.  A new AD domain will be built.  This is a small environment with 35 users.  Questions:
1.  Can I demote DC, remove the DC and member server from the Company B domain and create new domain?
2.  What is the process?
3.  I believe all the shares would lose permissions?
4.  What would other ramifications be?
5.  Can you export GPO's from one domain to another?
6.  Will all workstations have to manually be removed from old domain ane re-added to new domain?

In interested in the proper/best process here. I'm thinking I should get a new 2008 R2 server, build new domain, and then add the 2 existing machines to the new domain.   If you're clear on the proper/best way to do this, I would greatly appreciate your expertise.  What haven' t I thought about?  Is there way around re-permissioning  shares?  I believe you can use ADMT to migrate accounts, but wondering since there are only 35 users if it's easier to manually re-create accounts?
TIA!!
kialnAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

serchlopCommented:
You can demote a DC using dcpromo in the domain controller you want to demote.

Can you specify if your new domain will be added in the existing forest or will be a new one.

If the domain will be in the same forest, then you don't have to recreate the AD object. You only have to move object between both domains and then your users will access the resources in the same way they access now.

If the domain is in new forest you can create a relation trust between domains and move the object that you want to the new domain with Active Directory Migration Tool.
0
serchlopCommented:
If new domain is in the same forest you should see next page from microsoft to move objects.

http://support.microsoft.com/kb/555229
0
Darius GhassemCommented:
Here is another option. If you currently have a domain setup at company B and you can keep the same domain name you can break the connection between the two Domain Controllers. Now if they will not talk with each other anymore then this can be a quick way to split the two companies about.

Now if you want to create a new domain name you would lose all permissions but you can use ADMT to migrate the user accounts to the new domain then you can join computers to the new domain.

Now back to the break keeping the same domain name here are the steps.

1. Break connection between the two companies which means break network connection
2. Seize FSMO roles to CompanyB Domain Controller this allows CompanyB DC to think it is now primary but allows Company to think it is primary as well.
3. Run metadata cleanup to remove all Domain Controllers that are on CompanyA.
4. Setup DHCP so it hands IP addresses pointing to the CompanyB Domain Controller as DNS

So, now you will have two domains but with the same name.
0
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

kialnAuthor Commented:
Just to clarify the new domain is not in the same forest.  I don't have rights on old domain, and will be working with their administrator to facilitate this move.  I appreciate help, especially if anyone can answer the questions I've posted.  Points given for organized answers and clarity, thanks so much for your time!
0
serchlopCommented:
You can create a trust relationship between domains and then move the users and computers accounts with Active Directory Migration Tool. This has to be run  in the old domain. You should maintain sid objects.

Look at the next page is expalined very well. Credits to the page.

http://freyes.svetlian.com/admt/admt.htm
0
Darius GhassemCommented:
1.  Can I demote DC, remove the DC and member server from the Company B domain and create new domain?
You can do this. Not a problem but you would have to create a whole new domain.

2.  What is the process?
Depending on what you would like to do I have gave you to options which one would you like to do?

3.  I believe all the shares would lose permissions?
Shares would lose permissions since you are moving to a new domain

4.  What would other ramifications be?
You would have to add the computers back to the domain. Users could lose their current desktop profiles but you could migrate these to new profile

5.  Can you export GPO's from one domain to another?
I would not export GPOs just recreate them

6.  Will all workstations have to manually be removed from old domain ane re-added to new domain?
Yes.

Now there are other ways like ADMT http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/2003_Server/Q_21822078.html

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
kialnAuthor Commented:
Thanks for your reply.  Regarding #2 above - since there are only 35 user accounts, my preference would be to get a brand new DC (one is needed anyway) and manually create the accounts.  Then on the old DC, demote it and remove it from the domain, also removing any member servers.  Sound good?
0
Darius GhassemCommented:
Well if you want to create a new domain you can use ADMT to migrate user accounts or create user accounts all over again.

You will lose all permissions on shares. You will have to join each computer to the domain. Everything will be brand new. You will have to migrate User Profiles to the new domain on each local computer by using USMT.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.