?
Solved

Concerns creating .com domain along side same-named .local domain

Posted on 2014-10-27
6
Medium Priority
?
179 Views
Last Modified: 2014-12-04
I've been tasked to build a .com domain (customer facing and internal) to coexist for a time, with a forest trust between the two, with our current .local domain as we migrate over (obviously internal ntk).  The intent is to purchase a .com cert and slowly migrate our entire network from .local to .com domain.  we are currently at 2008 R2 domain and forest level, with a mix of 2012 and 2008 R2 servers.

we currently have numerous zones in AD as well, one of them is company_name.com as well already - servicing our external clients.

my question is what are the concerns, pitfalls, gotchas, is it wise to have a forest trust between a .com and .local with the same domain name, etc.

never had this scenario, and need some information/guidance on how to proceed.  so please don't assume anything.  and thanks in advance.
0
Comment
Question by:itsasupport
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
6 Comments
 
LVL 71

Accepted Solution

by:
Chris Dent earned 1000 total points
ID: 40407945
There's no problem with the trust as long as your NetBIOS domain name also differs.

The most significant pitfall of using something.com for both public and private is that you can only control some of the DNS records on the private side. AD requires full ownership of certain records, one of those is the A records assigned to something.com.

Most of the guidance these days recommends the use of a private sub-domain of the public name. e.g. internal.something.com. It's long been my favourite suggestion. This frees the parent domain from conflict.

Chris
0
 
LVL 37

Expert Comment

by:Jamie McKillop
ID: 40408274
Hello,

My recommendation is that you use split-dns, especially if you are using Exchange. With split-dns, you have two separate zones for your .com. You would have an AD integrated zone and you would also have the zone setup on separate public-facing DNS servers. On the internal zone, you can use private IPs. This is also more secure as you wouldn't need to allow public access to your domain controllers. The only disadvantage is that you need to manage both zones separately.

-JJ
0
 
LVL 39

Expert Comment

by:Aaron Tomosky
ID: 40408299
+1 for something.domain.com

Corp, internal, int, i, cityname are all good examples of active directory private subdomain.
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
LVL 10

Expert Comment

by:Pramod Ubhe
ID: 40408706
should not have any issues since .com and .local are two diff. things. please make sure to consult with your exchange admin for the org. name used in exchange or email addresses. additionally you have a very good opportunity to overcome existing challenges with new .com domain and plan wisely to accommodate changes/requirements that may come for next 5-10 years.

I would recommend to implement a new namespace with .com and implement whatever your plans are and then migrate existing .local namespaces to it.
0
 

Author Comment

by:itsasupport
ID: 40426820
thanks guys - here's the situation that they want to have me do.  my domain currently is mydomain.local, and they want to have mydomain.com - both would have the NETBIOS name the same - mydomain - have a CAS server in the .com to work with exchange for the moment - and have a trust between the two.

1. is having the NETBIOS name "mydomain" (made up of course) the same for the existing .local and the new .com ok regarding the trust, exchange and a certificate planned for the .com domain now that we have to abandon .local these days?

2. will exchange work in this regards?
0
 
LVL 37

Assisted Solution

by:Jamie McKillop
Jamie McKillop earned 1000 total points
ID: 40426840
You can't create the trust if the NETBIOS names match. Also, you can't just bring up a CAS server in another forest.

-JJ
0

Featured Post

Get real performance insights from real users

Key features:
- Total Pages Views and Load times
- Top Pages Viewed and Load Times
- Real Time Site Page Build Performance
- Users’ Browser and Platform Performance
- Geographic User Breakdown
- And more

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Here's a look at newsworthy articles and community happenings during the last month.
Compliance and data security require steps be taken to prevent unauthorized users from copying data.  Here's one method to prevent data theft via USB drives (and writable optical media).
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…
This video shows how to use Hyena, from SystemTools Software, to update 100 user accounts from an external text file. View in 1080p for best video quality.
Suggested Courses
Course of the Month11 days, 18 hours left to enroll

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question