Additional domain in AD

I have an AD controller on windows 2003.
For the longest time, the domain in it has been (example) domain.com
Using (say) ip 10.0.0.0

Now I'd also like to add example.com
Can I create it on the same AD but using ip 11.0.0.0 ?

A couple of follow up questions:

1. There are a number of secondary AD servers to backup the primary one.
1a. Should I assume that example.com will be replicated on all AD Controller?
1b. Should I assume that the two domain need to be on 2 different LAN port on the AD?

2. The two domain clients need to be kept separate. I.e users on domain.com mostly cannot join or access example.com.
Can this be done?
2b. If a user (me...) need to be able to access both domains, can I do it on one account?

3. How can this be done? (detailed how to or link please, I'm not an IT person but have little experience in DIY domain for our own small business.)

Thank you
SW111Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

KwoofCommented:
1.  Create the domain on it's own server only one domain can be hosted per domain controller...if domain.com is using 10.0.0.0/8 (subnet 255.0.0.0), then create example.com on 172.16.0.0/16 or 192.168.0.0/24.  The domains could actually live on the same subnet of IP addresses if needed.

2.  a computer can only be a member of one domain at a time, but if you set up trust
between the domains, the user can logon to their own domain and can be given
access permissions in the other domains.
0
Mike KlineCommented:
Why do want to add another domain?  Not saying it's wrong but you can also add additional DCs

Thanks

Mike
0
Lee W, MVPTechnology and Business Process AdvisorCommented:
Now I'd also like to add example.com
Can I create it on the same AD but using ip 11.0.0.0 ?

No.  Well, potentially yes, but you would be REALLY unwise to do so - 11.x.x.x is a publicly routed network and if you used that network you could have problems accessing servers on the internet that use that address.  Instead, 10.x.x.x is NOT a publicly routed network.  Odds are you use a subnet mask of 255.255.255.0.  At least you should.  MAYBE 255.255.0.0 (though the default on a 10 network would be 255.0.0.0.  I could spend 20 minutes typing out if-then statements about what you might have to do on this, but if you post the actual subnet you use and subnet mask, we can figure that out quickly.  As an alternative, you COULD possible set the network to 172.16-31.x.x. (where the second set of numbers is any number between 16 and 31.  But you must then use a subnet mask of 255.255.0.0 or 255.255.255.0 with the first 3 sets matching.

A couple of follow up questions:

1. There are a number of secondary AD servers to backup the primary one.
1a. Should I assume that example.com will be replicated on all AD Controller?

No - it would not be replicated.  It MIGHT be "noted" if you made it a subdomain - example.domain.com but otherwise, no.  It's a new domain.
1b. Should I assume that the two domain need to be on 2 different LAN port on the AD?
I don't understand what you're asking?  The two domains don't actually need to separated - from a security standpoint and for DHCP purposes they should be, but if you set everything statically and didn't care too much about security (bad idea), then they COULD be on the same network.

2. The two domain clients need to be kept separate. I.e users on domain.com mostly cannot join or access example.com.
Can this be done?

Yes and no and how much depends on your configuration.  IDEALLY, you would get a separate switch and a router and internet connection (cable/fios/dsl/etc) and then connect the ports in the network room/closet to the appropriate switch - this keeps everything separate.  Otherwise, to what level of separation you have depends on the configuration of your network and how much you NEED the separation.
2b. If a user (me...) need to be able to access both domains, can I do it on one account?
If you setup a trust.  Otherwise, you need accounts for both.  If either of the domains are running on an SBS server (or Server Essentials or Foundation server) then NO, those servers cannot have trusts.  Only standard, enterprise, and data center server-based domains can have trusts

3. How can this be done? (detailed how to or link please, I'm not an IT person but have little experience in DIY domain for our own small business.)
Books have been written on this.  If you want this to work and be done well so that everything is done right, I highly recommend you contact a professional with experience configuring domains and networks.  Have them set it up for you and then you can maintain it with the help of others here.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
SandeshdubeySenior Server EngineerCommented:
If you want to add the new domain to existing domain.If you don't want to inherit parent domain name, you can use new tree in the forest like parent is ABC & you can have new tree as XYZ.com.Trust between Root & tree is Tree-Root two trust. Domain tree shares same SM & DNM role in the forest.http://support.microsoft.com/kb/310996.See this thread for more details. http://social.technet.microsoft.com/Forums/windowsserver/en-US/10724cad-d6d2-4f75-adce-b7f7fce0deab/child-domain-and-tree-domain

You can also install new forest and create trust between the forest to access resources.If the domain name is different you can have both domain in same network,but if there is dhcp server then you can have only one DHCP server in same network.

But is there any specific requirement that domain name should be different?
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Server OS

From novice to tech pro — start learning today.