Solved

Concerns creating .com domain along side same-named .local domain

Posted on 2014-10-27
6
177 Views
Last Modified: 2014-12-04
I've been tasked to build a .com domain (customer facing and internal) to coexist for a time, with a forest trust between the two, with our current .local domain as we migrate over (obviously internal ntk).  The intent is to purchase a .com cert and slowly migrate our entire network from .local to .com domain.  we are currently at 2008 R2 domain and forest level, with a mix of 2012 and 2008 R2 servers.

we currently have numerous zones in AD as well, one of them is company_name.com as well already - servicing our external clients.

my question is what are the concerns, pitfalls, gotchas, is it wise to have a forest trust between a .com and .local with the same domain name, etc.

never had this scenario, and need some information/guidance on how to proceed.  so please don't assume anything.  and thanks in advance.
0
Comment
Question by:itsasupport
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
6 Comments
 
LVL 71

Accepted Solution

by:
Chris Dent earned 250 total points
ID: 40407945
There's no problem with the trust as long as your NetBIOS domain name also differs.

The most significant pitfall of using something.com for both public and private is that you can only control some of the DNS records on the private side. AD requires full ownership of certain records, one of those is the A records assigned to something.com.

Most of the guidance these days recommends the use of a private sub-domain of the public name. e.g. internal.something.com. It's long been my favourite suggestion. This frees the parent domain from conflict.

Chris
0
 
LVL 37

Expert Comment

by:Jamie McKillop
ID: 40408274
Hello,

My recommendation is that you use split-dns, especially if you are using Exchange. With split-dns, you have two separate zones for your .com. You would have an AD integrated zone and you would also have the zone setup on separate public-facing DNS servers. On the internal zone, you can use private IPs. This is also more secure as you wouldn't need to allow public access to your domain controllers. The only disadvantage is that you need to manage both zones separately.

-JJ
0
 
LVL 39

Expert Comment

by:Aaron Tomosky
ID: 40408299
+1 for something.domain.com

Corp, internal, int, i, cityname are all good examples of active directory private subdomain.
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 10

Expert Comment

by:Pramod Ubhe
ID: 40408706
should not have any issues since .com and .local are two diff. things. please make sure to consult with your exchange admin for the org. name used in exchange or email addresses. additionally you have a very good opportunity to overcome existing challenges with new .com domain and plan wisely to accommodate changes/requirements that may come for next 5-10 years.

I would recommend to implement a new namespace with .com and implement whatever your plans are and then migrate existing .local namespaces to it.
0
 

Author Comment

by:itsasupport
ID: 40426820
thanks guys - here's the situation that they want to have me do.  my domain currently is mydomain.local, and they want to have mydomain.com - both would have the NETBIOS name the same - mydomain - have a CAS server in the .com to work with exchange for the moment - and have a trust between the two.

1. is having the NETBIOS name "mydomain" (made up of course) the same for the existing .local and the new .com ok regarding the trust, exchange and a certificate planned for the .com domain now that we have to abandon .local these days?

2. will exchange work in this regards?
0
 
LVL 37

Assisted Solution

by:Jamie McKillop
Jamie McKillop earned 250 total points
ID: 40426840
You can't create the trust if the NETBIOS names match. Also, you can't just bring up a CAS server in another forest.

-JJ
0

Featured Post

Turn Insights into Action

Communication across every corner of your business is essential to increase the velocity of your application delivery and support pipeline. Automate, standardize, and contextualize your communication processes with xMatters.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Group policies can be applied selectively to specific devices with the help of groups. Utilising this, it is possible to phase-in group policies, over a period of time, by randomly adding non-members user or computers at a set interval, to a group f…
After seeing many questions for JRNL_WRAP_ERROR for replication failure, I thought it would be useful to write this article.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This video shows how to use Hyena, from SystemTools Software, to update 100 user accounts from an external text file. View in 1080p for best video quality.

695 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question