Solved

Concerns creating .com domain along side same-named .local domain

Posted on 2014-10-27
6
176 Views
Last Modified: 2014-12-04
I've been tasked to build a .com domain (customer facing and internal) to coexist for a time, with a forest trust between the two, with our current .local domain as we migrate over (obviously internal ntk).  The intent is to purchase a .com cert and slowly migrate our entire network from .local to .com domain.  we are currently at 2008 R2 domain and forest level, with a mix of 2012 and 2008 R2 servers.

we currently have numerous zones in AD as well, one of them is company_name.com as well already - servicing our external clients.

my question is what are the concerns, pitfalls, gotchas, is it wise to have a forest trust between a .com and .local with the same domain name, etc.

never had this scenario, and need some information/guidance on how to proceed.  so please don't assume anything.  and thanks in advance.
0
Comment
Question by:itsasupport
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
6 Comments
 
LVL 71

Accepted Solution

by:
Chris Dent earned 250 total points
ID: 40407945
There's no problem with the trust as long as your NetBIOS domain name also differs.

The most significant pitfall of using something.com for both public and private is that you can only control some of the DNS records on the private side. AD requires full ownership of certain records, one of those is the A records assigned to something.com.

Most of the guidance these days recommends the use of a private sub-domain of the public name. e.g. internal.something.com. It's long been my favourite suggestion. This frees the parent domain from conflict.

Chris
0
 
LVL 37

Expert Comment

by:Jamie McKillop
ID: 40408274
Hello,

My recommendation is that you use split-dns, especially if you are using Exchange. With split-dns, you have two separate zones for your .com. You would have an AD integrated zone and you would also have the zone setup on separate public-facing DNS servers. On the internal zone, you can use private IPs. This is also more secure as you wouldn't need to allow public access to your domain controllers. The only disadvantage is that you need to manage both zones separately.

-JJ
0
 
LVL 39

Expert Comment

by:Aaron Tomosky
ID: 40408299
+1 for something.domain.com

Corp, internal, int, i, cityname are all good examples of active directory private subdomain.
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 10

Expert Comment

by:Pramod Ubhe
ID: 40408706
should not have any issues since .com and .local are two diff. things. please make sure to consult with your exchange admin for the org. name used in exchange or email addresses. additionally you have a very good opportunity to overcome existing challenges with new .com domain and plan wisely to accommodate changes/requirements that may come for next 5-10 years.

I would recommend to implement a new namespace with .com and implement whatever your plans are and then migrate existing .local namespaces to it.
0
 

Author Comment

by:itsasupport
ID: 40426820
thanks guys - here's the situation that they want to have me do.  my domain currently is mydomain.local, and they want to have mydomain.com - both would have the NETBIOS name the same - mydomain - have a CAS server in the .com to work with exchange for the moment - and have a trust between the two.

1. is having the NETBIOS name "mydomain" (made up of course) the same for the existing .local and the new .com ok regarding the trust, exchange and a certificate planned for the .com domain now that we have to abandon .local these days?

2. will exchange work in this regards?
0
 
LVL 37

Assisted Solution

by:Jamie McKillop
Jamie McKillop earned 250 total points
ID: 40426840
You can't create the trust if the NETBIOS names match. Also, you can't just bring up a CAS server in another forest.

-JJ
0

Featured Post

MS Dynamics Made Instantly Simpler

Make Your Microsoft Dynamics Investment Count  & Drastically Decrease Training Time by Providing Intuitive Step-By-Step WalkThru Tutorials.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article runs through the process of deploying a single EXE application selectively to a group of user.
This article outlines the process to identify and resolve account lockout in an Active Directory environment.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

738 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question