Solved

Concerns creating .com domain along side same-named .local domain

Posted on 2014-10-27
6
175 Views
Last Modified: 2014-12-04
I've been tasked to build a .com domain (customer facing and internal) to coexist for a time, with a forest trust between the two, with our current .local domain as we migrate over (obviously internal ntk).  The intent is to purchase a .com cert and slowly migrate our entire network from .local to .com domain.  we are currently at 2008 R2 domain and forest level, with a mix of 2012 and 2008 R2 servers.

we currently have numerous zones in AD as well, one of them is company_name.com as well already - servicing our external clients.

my question is what are the concerns, pitfalls, gotchas, is it wise to have a forest trust between a .com and .local with the same domain name, etc.

never had this scenario, and need some information/guidance on how to proceed.  so please don't assume anything.  and thanks in advance.
0
Comment
Question by:itsasupport
6 Comments
 
LVL 71

Accepted Solution

by:
Chris Dent earned 250 total points
ID: 40407945
There's no problem with the trust as long as your NetBIOS domain name also differs.

The most significant pitfall of using something.com for both public and private is that you can only control some of the DNS records on the private side. AD requires full ownership of certain records, one of those is the A records assigned to something.com.

Most of the guidance these days recommends the use of a private sub-domain of the public name. e.g. internal.something.com. It's long been my favourite suggestion. This frees the parent domain from conflict.

Chris
0
 
LVL 37

Expert Comment

by:Jamie McKillop
ID: 40408274
Hello,

My recommendation is that you use split-dns, especially if you are using Exchange. With split-dns, you have two separate zones for your .com. You would have an AD integrated zone and you would also have the zone setup on separate public-facing DNS servers. On the internal zone, you can use private IPs. This is also more secure as you wouldn't need to allow public access to your domain controllers. The only disadvantage is that you need to manage both zones separately.

-JJ
0
 
LVL 39

Expert Comment

by:Aaron Tomosky
ID: 40408299
+1 for something.domain.com

Corp, internal, int, i, cityname are all good examples of active directory private subdomain.
0
Edgartown IT Case Study

Learn about Edgartown's quest to ensure the safety and security of the entire town's employee and citizen data. Read the case study!

 
LVL 10

Expert Comment

by:Pramod Ubhe
ID: 40408706
should not have any issues since .com and .local are two diff. things. please make sure to consult with your exchange admin for the org. name used in exchange or email addresses. additionally you have a very good opportunity to overcome existing challenges with new .com domain and plan wisely to accommodate changes/requirements that may come for next 5-10 years.

I would recommend to implement a new namespace with .com and implement whatever your plans are and then migrate existing .local namespaces to it.
0
 

Author Comment

by:itsasupport
ID: 40426820
thanks guys - here's the situation that they want to have me do.  my domain currently is mydomain.local, and they want to have mydomain.com - both would have the NETBIOS name the same - mydomain - have a CAS server in the .com to work with exchange for the moment - and have a trust between the two.

1. is having the NETBIOS name "mydomain" (made up of course) the same for the existing .local and the new .com ok regarding the trust, exchange and a certificate planned for the .com domain now that we have to abandon .local these days?

2. will exchange work in this regards?
0
 
LVL 37

Assisted Solution

by:Jamie McKillop
Jamie McKillop earned 250 total points
ID: 40426840
You can't create the trust if the NETBIOS names match. Also, you can't just bring up a CAS server in another forest.

-JJ
0

Featured Post

U.S. Department of Agriculture and Acronis Access

With the new era of mobile computing, smartphones and tablets, wireless communications and cloud services, the USDA sought to take advantage of a mobilized workforce and the blurring lines between personal and corporate computing resources.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article shows how to deploy dynamic backgrounds to computers depending on the aspect ratio of display
Did you know that more than 4 billion data records have been recorded as lost or stolen since 2013? It was a staggering number brought to our attention during last week’s ManageEngine webinar, where attendees received a comprehensive look at the ma…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

713 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question