Solved

Domain Migration

Posted on 2014-12-01
19
106 Views
Last Modified: 2014-12-16
I inherited a mess when the guy before me was fired.  None of his work was documented and I have been playing CSI since I started here.  We are in the process of migrating from physical laptops to thin clients and all VMs.  We are moving from one domain (test.org) to one parent and two children (Test.org >Test1.org & test2.org).  Since the old and new domains are named the same I cannot establish a trust and it is going to be restructured different.   The file structure on the file server will be the same, I was contemplating just removing the file server from the old domain and adding it to the new one.  I realize that I will have to assign the permissions manually to all of the data though.  What would be the best way to complete this as far as user accounts, files, permissions, exchange server, etc?  Right now I am at a loss and I was just going to recreate all of the user accounts.  We only have about 40 users.  Also right now we use folder redirection for the desktop, my documents and favorites.  I have already create a group policy in the new domain, and it works, but when the user logs in for the first time it creates the folder.  Is there a way to create the folder, put data in it, and then have the user synch up with it and already  have the right permissions?  I tested it and all it did not work.  All of the VMs will run windows 7 and the servers are 2008R2.
0
Comment
Question by:Angela Owens
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 9
  • 9
19 Comments
 
LVL 15

Expert Comment

by:JBond2010
ID: 40473669
You can use the ADMT tool from Microsoft. Please refer to the link below.  You need to migrate the user accounts and sid history and ACL permissions. When this is done, you can then use robocopy to copy over the files and folders and also the permissions.

http://technet.microsoft.com/en-us/library/cc974332(v=ws.10).aspx

Also, for migrating files and folders to keep permissions. Please refer to the link below.

https://social.technet.microsoft.com/Forums/windowsserver/en-US/84e62edf-d845-4ee3-95bf-695cc54f05fa/migrating-filesfolders-across-forests?forum=winserverMigration


Regards,

JBond2010
0
 

Author Comment

by:Angela Owens
ID: 40473686
From everything I have read you need a trust to be established to use ADMT and I cannot establish one because the old and new domains have the same  name.   Is that true?  When I try it , it says that a trust cannot be established.
0
 
LVL 15

Expert Comment

by:JBond2010
ID: 40473689
That's correct. You have to establish a trust between the Active Directory forests. The 2 Active Directory forests cannot have the same name. They should be different for example domain.local or domain1.local. Active Directory forests with same name will cause all sorts of issues, DNS, netlogon etc.
0
Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

 

Author Comment

by:Angela Owens
ID: 40473745
Is there a way to migrate stuff without using the ADMT?  I cannot rename either domain at this point.  The current one is in use and the new one needs to be set up.  We are going to have a day or two to take down the current one and bring up the new one.  If migrate isn't the right word, then export and reimport?
0
 
LVL 15

Expert Comment

by:JBond2010
ID: 40473756
Just start again with new one. How many domain controllers do you have in the new Active Directory forest? You obviously haven't migrated anything yet. So I would start again with the new forest by demoting the domain controller or domain controllers to member servers and then create the new Active Directory forest with a different name. This will solve all your problems.

If you choose not to do it this way, your workload will be trebled and a lot of manual intervention will be required.


Regards,

JBond2010
0
 

Author Comment

by:Angela Owens
ID: 40473793
I  have contemplated that, just starting fresh.  We haven't migrated anything yet, but the new domain is in place.  We have two domain controllers in the parent and two in each child.  We also  have vSphere, a file server, and Horizon View Administrator, and a few other servers and it all works.  I am a bit scared to start fresh because I am not that experienced and I don't want to break something and not be able to fix it.   Is there a way in powershell to export the user accounts and reimport it?
0
 
LVL 15

Expert Comment

by:JBond2010
ID: 40473835
You haven't created a new Active Directory forest? You've created a child domain in an existing Active Directory forest? Please confirm thank you.


Regards,

JBond2010
0
 

Author Comment

by:Angela Owens
ID: 40473852
It was already in place when I started.  It is a parent domain and two child domains.   But the old domain and new one are named the same thing.  In our new domain, the parent is going to have the servers and then the children will have the user accounts, etc.  Right now everything is on in one domain (our current working domain).  We will have a few days of downtime, to migrate everything, when no users will be here and then we plan to bring it up in the new environment.  I am trying to just get it all built at the moment.  But I have not done any user accounts, exchange, or moved the data over yet.
0
 
LVL 15

Expert Comment

by:JBond2010
ID: 40473872
By default is this scenario, there are 2 way transitive trusts. So the parent domain trusts the 2 child domains and the 2  child domains trust the parent. This is how it works in Active Directory.

Correct me if I'm wrong. Did you say that the Parent domain does not trust the new child domain?
0
 

Author Comment

by:Angela Owens
ID: 40474097
The new parent domain and child domains have a trust going  on.  But I cannot establish a trust between our current domain or old domain and the new parent because they are named the same thing.
0
 
LVL 15

Expert Comment

by:JBond2010
ID: 40474195
When you say the new domain, is this a new Active Directory forest or a new child domain of the existing Active Directory?

Do you have 2 separate Active Directory forests?
0
 

Author Comment

by:Angela Owens
ID: 40474221
I am sorry I may have not explained well.  They are not part of any forests.  Just two separate domains.   The old and new are not joined in any way.  I am not sure why the guy before me did it this way and why he just didn't create two new children under the existing domain.   But my dilemma is how to get all the accounts recreated in the new domain and the mail moved.
0
 
LVL 15

Expert Comment

by:JBond2010
ID: 40474267
You have 2 separate Active Directory forests then.
0
 

Author Comment

by:Angela Owens
ID: 40474296
yes.  I assumed they were domains, and not forests, sorry.  But yes they are separate.
0
 
LVL 15

Expert Comment

by:JBond2010
ID: 40475719
You have 2 separate Active Directory forests with the same name. Because they share the same name space, this is why you cannot create a forest trust.

What you need to do is, with the new forest demote the domain controllers thus removing Active Directory and then promote them again to domain controllers creating a new name space different from the old Active Directory forest.

Then create a 2 way Active Directory forest trust. User ADMT tool to migrate over the user and computer accounts and also copy over SID history and ACL permissions. You can then user robocopy to copy over the data and also the file and folder permissions. I have provided a link below on how to use the ADMT tool.

http://social.technet.microsoft.com/wiki/contents/articles/16208.interforest-migration-with-admt-3-2-part-2.aspx


Regards,

JBond2010
0
 

Accepted Solution

by:
Angela Owens earned 0 total points
ID: 40488827
I was unable to use the ADMT so I just recreated the environment.
0
 

Author Comment

by:Angela Owens
ID: 40493484
I've requested that this question be closed as follows:

Accepted answer: 0 points for Angela Owens's comment #a40488827

for the following reason:

Since the new and and old domain shared the same name a trust could not be established.  Renaming either domain was not an option.  If i could then I could have used the ADMT.
0
 
LVL 15

Expert Comment

by:JBond2010
ID: 40493483
Hi Angela,

That's what I was trying to explain to you. You needed to recreate your environment is order to use the ADMT tool.


Regards,

JBond2010
0

Featured Post

Enroll in June's Course of the Month

June’s Course of the Month is now available! Experts Exchange’s Premium Members, Team Accounts, and Qualified Experts have access to a complimentary course each month as part of their membership—an extra way to sharpen your skills and increase training.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

#Citrix #XenApp #Citrix Scout #Citrix Insight Services #Microsoft VMMAP #Microsoft ADEXPLORE #Microsoft RAMMAP #Microsoft TCPVIEW #Microsoft AUTORUNS #Microsoft PROCESS EXPLORER #Microsoft PROCESS MONITOR
VM backup deduplication is a method of reducing the amount of storage space needed to save VM backups. In most organizations, VMs contain many duplicate copies of data, such as VMs deployed from the same template, VMs with the same OS, or VMs that h…
How to install and configure Citrix XenApp 6.5 - Part 1. In this video tutorial we have explained step by step installation of Citrix XenApp 6.5 Server on Windows Server 2008 R2 is explained in this video. We have explained the difference between…
In this video tutorial I show you the main steps to install and configure  a VMware ESXi6.0 server. The video has my comments as text on the screen and you can pause anytime when needed. Hope this will be helpful. Verify that your hardware and BIO…

691 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question