[2 days left] What’s wrong with your cloud strategy? Learn why multicloud solutions matter with Nimble Storage.Register Now

x
?
Solved

Need to integrate two domains - Need Direction

Posted on 2014-01-14
5
Medium Priority
?
298 Views
Last Modified: 2014-01-16
We need to integrate two domains into a third.
We need to move both domains from a 10.x.x.x network to a 172.16.x.x network.

Where do I begin?
What needs to be set up first?

Should I look at this from an OSI layer perspective (i.e.- take care of layers 1-3 first, then go on to services like exchange, OU's, etc.)?
...or should I be server focused, making sure that everyone's profiles get moved, yada yada yada?

I have all of the requirements in my mind for the most part, but it's hard to organize them in order of priority... yes, I have made notes on paper/computer but that isn't helping me prioritize.

Essentially, I'm asking one question- In what order should I complete all the steps necessary to integrate two domains into a third?

(It would be great if there was a walkthrough or a template for this sort of thing.)



Note:
Not that it strictly matters at this point, but we will be prepping the third domain for deploying everyone onto XenDesktop 7.
0
Comment
Question by:Paul Wagner
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 53

Expert Comment

by:Will Szymkowski
ID: 39780385
The following should be done this particular order...
This is a very high level overview...

- Network (communication between all domains)
- Create your 3rd domain
- Create Forest Trusts from Domain A and Domain B to Domain C (3rd domain)
- Use the Active Directory Migration Tool to move AD Objects to Domain C
- Migrate Exchange Mailboxes to Domain C
- Setup Exchange Accepted Domains for all of the domain that you will still be using or receiving mail internally for

There are much more details to the list above but that should get you started.

ADMT Download - http://www.microsoft.com/en-ca/download/details.aspx?id=8377

ADMT Step-by-step - http://blog.thesysadmins.co.uk/admt-series-1-preparing-active-directory.html

Will.
0
 
LVL 38

Expert Comment

by:Mahesh
ID: 39783847
ADMT is very simple when only AD migration is there
When MS Exchange is involved in migration, its not simple thing to do
It requires lot of planning to maintain co-existence, mail flow, GAL and so on.

You need to hire consultant to design and deploy it properly, this is not the case where you can get detailed plan from blogs, EE and guides as this is situation specific and one must fully aware with your scenario, environment and exact requirements and then he can come up with plan.

Mahesh
0
 
LVL 5

Author Comment

by:Paul Wagner
ID: 39783865
@Will
What is it going to do to have exchange servers in domain A and domain C with the same external email certs, email addressses, etc.? Do I need to flip the switch overnight or can they coexist?


@Mahesh
We did hire a consultant already and he is working on the plan. I want to make sure his plan is sound.
0
 
LVL 38

Accepted Solution

by:
Mahesh earned 2000 total points
ID: 39784592
from Exchage point of view, we do require more information

How would you want to go ahead ?

Do you want to keep same smtp namespace (Shared SMTP name space) in 3rd forest as like in forest A and forest B or it is entirely different ?
This will deside your mailflow architecture.

What is the affected user base at each domains as this will key question whether you need co-existence for lonf period OR short period and depending on this you need to decide kind of automation, manual work required.

Its not simply you can migrate users with ADMT, infact you can't do that because of Exchange dependencies and there is Exchange specific steps are involved for each user from server and client side as well.
Its really required careful planning otherwise you will face NDR issues, GAL updation issues, X500 problems
You can find out lot of online documenatiton wrt cross forest MS exchange migration and you can use it as reference, but you need to finalize your plan and you may face unknown issues during co-existence, some times you need to take MS help in case of weried issues

You do require email address of eah domain to be listed as contacts in each of domain if you want to ensure mailflow during co-existence.
During co-existence do you want to GAL to updated automatically in all 3 forests or you will manage that manually by adding and removing contacts
MS FIM is there to do automation for you (GAL SYNC)

Also do you want to have freebusy \ calender information to be shared across forests, then there you need to setup with MS tools such as Interorg replication tool (Exchange 2003), but well works in co-existence scenarios.

In simple words:
After you prepared AD with migration prerequistes there are multiple ways to migrate resources cross forest as MS Exchange is involved

The normal ADMT migration without MS exchange involved is pretty straight forward:
Build DNS name resolution across forests
Build cross forest \ external trusts
Migrate all groups
Migrate all service accounts
Migrate all users
Migrate all computers
Lastly migrate all application \ infrastructure servers

But things are getting complicated when exchange is involved cross forest as ADMT does not work with Exchnge attributes, simply can't migrate exchange attributes
Hence you must use seperate tools (may be 3rd party is one good option such s Quest) wrt to exchange user mailbox migration and this is directly impacting AD user and group migration.
Quest is really having very good migration tools, bit costly but help you to save time and headeque

Suppose you have all Exchange enabled distribution groups then ADMT will not migrate there exchnge attribute, so either you can provision them with FIM if its quantity is in thousands or you could migrate them with ADMT without exchange attributes and then mke them mail enabled them one by one \ through script
In case of mailbox user cross forest migration, you need to use exchange tool \ scripts (Preparemoverequests.ps1 if I can recollect perfectly) 1st to copy use from one exchnge org and then use ADMT in merged mode to have other AD attribute such as SID to be migrated.

Also unless you define proper gal sync \ updation solution, it will create mess with X500, NK2 files with cached x500 and so on.  

Frankly speaking, Exchange cross forest migrtion scenarios are never painless according to my experience.
Now as you aware, there are lot of stuff to be designed \ looked, You need to go google on each milestone and ensure that hired consultant is taking steps as appropriate.
because here one cannot provide you end to end plan for verification, hence you need to go ahead with step by step verification.
Please don't get me wrong, just trying to make you aware of troubles during co-existence \ migration.

Mahesh
0
 
LVL 5

Author Closing Comment

by:Paul Wagner
ID: 39786441
Very well thought out and intelligent. Thanks for the help.
0

Featured Post

Learn how to optimize MySQL for your business need

With the increasing importance of apps & networks in both business & personal interconnections, perfor. has become one of the key metrics of successful communication. This ebook is a hands-on business-case-driven guide to understanding MySQL query parameter tuning & database perf

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Group policies can be applied selectively to specific devices with the help of groups. Utilising this, it is possible to phase-in group policies, over a period of time, by randomly adding non-members user or computers at a set interval, to a group f…
In this article, we’ll look at how to deploy ProxySQL.
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…
Suggested Courses

656 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question