Domain Migration

I inherited a mess when the guy before me was fired.  None of his work was documented and I have been playing CSI since I started here.  We are in the process of migrating from physical laptops to thin clients and all VMs.  We are moving from one domain (test.org) to one parent and two children (Test.org >Test1.org & test2.org).  Since the old and new domains are named the same I cannot establish a trust and it is going to be restructured different.   The file structure on the file server will be the same, I was contemplating just removing the file server from the old domain and adding it to the new one.  I realize that I will have to assign the permissions manually to all of the data though.  What would be the best way to complete this as far as user accounts, files, permissions, exchange server, etc?  Right now I am at a loss and I was just going to recreate all of the user accounts.  We only have about 40 users.  Also right now we use folder redirection for the desktop, my documents and favorites.  I have already create a group policy in the new domain, and it works, but when the user logs in for the first time it creates the folder.  Is there a way to create the folder, put data in it, and then have the user synch up with it and already  have the right permissions?  I tested it and all it did not work.  All of the VMs will run windows 7 and the servers are 2008R2.
Angela OwensNetwork EngineerAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

JamesSenior Cloud Infrastructure EngineerCommented:
You can use the ADMT tool from Microsoft. Please refer to the link below.  You need to migrate the user accounts and sid history and ACL permissions. When this is done, you can then use robocopy to copy over the files and folders and also the permissions.

http://technet.microsoft.com/en-us/library/cc974332(v=ws.10).aspx

Also, for migrating files and folders to keep permissions. Please refer to the link below.

https://social.technet.microsoft.com/Forums/windowsserver/en-US/84e62edf-d845-4ee3-95bf-695cc54f05fa/migrating-filesfolders-across-forests?forum=winserverMigration


Regards,

JBond2010
0
Angela OwensNetwork EngineerAuthor Commented:
From everything I have read you need a trust to be established to use ADMT and I cannot establish one because the old and new domains have the same  name.   Is that true?  When I try it , it says that a trust cannot be established.
0
JamesSenior Cloud Infrastructure EngineerCommented:
That's correct. You have to establish a trust between the Active Directory forests. The 2 Active Directory forests cannot have the same name. They should be different for example domain.local or domain1.local. Active Directory forests with same name will cause all sorts of issues, DNS, netlogon etc.
0
Cloud Class® Course: Microsoft Azure 2017

Azure has a changed a lot since it was originally introduce by adding new services and features. Do you know everything you need to about Azure? This course will teach you about the Azure App Service, monitoring and application insights, DevOps, and Team Services.

Angela OwensNetwork EngineerAuthor Commented:
Is there a way to migrate stuff without using the ADMT?  I cannot rename either domain at this point.  The current one is in use and the new one needs to be set up.  We are going to have a day or two to take down the current one and bring up the new one.  If migrate isn't the right word, then export and reimport?
0
JamesSenior Cloud Infrastructure EngineerCommented:
Just start again with new one. How many domain controllers do you have in the new Active Directory forest? You obviously haven't migrated anything yet. So I would start again with the new forest by demoting the domain controller or domain controllers to member servers and then create the new Active Directory forest with a different name. This will solve all your problems.

If you choose not to do it this way, your workload will be trebled and a lot of manual intervention will be required.


Regards,

JBond2010
0
Angela OwensNetwork EngineerAuthor Commented:
I  have contemplated that, just starting fresh.  We haven't migrated anything yet, but the new domain is in place.  We have two domain controllers in the parent and two in each child.  We also  have vSphere, a file server, and Horizon View Administrator, and a few other servers and it all works.  I am a bit scared to start fresh because I am not that experienced and I don't want to break something and not be able to fix it.   Is there a way in powershell to export the user accounts and reimport it?
0
JamesSenior Cloud Infrastructure EngineerCommented:
You haven't created a new Active Directory forest? You've created a child domain in an existing Active Directory forest? Please confirm thank you.


Regards,

JBond2010
0
Angela OwensNetwork EngineerAuthor Commented:
It was already in place when I started.  It is a parent domain and two child domains.   But the old domain and new one are named the same thing.  In our new domain, the parent is going to have the servers and then the children will have the user accounts, etc.  Right now everything is on in one domain (our current working domain).  We will have a few days of downtime, to migrate everything, when no users will be here and then we plan to bring it up in the new environment.  I am trying to just get it all built at the moment.  But I have not done any user accounts, exchange, or moved the data over yet.
0
JamesSenior Cloud Infrastructure EngineerCommented:
By default is this scenario, there are 2 way transitive trusts. So the parent domain trusts the 2 child domains and the 2  child domains trust the parent. This is how it works in Active Directory.

Correct me if I'm wrong. Did you say that the Parent domain does not trust the new child domain?
0
Angela OwensNetwork EngineerAuthor Commented:
The new parent domain and child domains have a trust going  on.  But I cannot establish a trust between our current domain or old domain and the new parent because they are named the same thing.
0
JamesSenior Cloud Infrastructure EngineerCommented:
When you say the new domain, is this a new Active Directory forest or a new child domain of the existing Active Directory?

Do you have 2 separate Active Directory forests?
0
Angela OwensNetwork EngineerAuthor Commented:
I am sorry I may have not explained well.  They are not part of any forests.  Just two separate domains.   The old and new are not joined in any way.  I am not sure why the guy before me did it this way and why he just didn't create two new children under the existing domain.   But my dilemma is how to get all the accounts recreated in the new domain and the mail moved.
0
JamesSenior Cloud Infrastructure EngineerCommented:
You have 2 separate Active Directory forests then.
0
Angela OwensNetwork EngineerAuthor Commented:
yes.  I assumed they were domains, and not forests, sorry.  But yes they are separate.
0
JamesSenior Cloud Infrastructure EngineerCommented:
You have 2 separate Active Directory forests with the same name. Because they share the same name space, this is why you cannot create a forest trust.

What you need to do is, with the new forest demote the domain controllers thus removing Active Directory and then promote them again to domain controllers creating a new name space different from the old Active Directory forest.

Then create a 2 way Active Directory forest trust. User ADMT tool to migrate over the user and computer accounts and also copy over SID history and ACL permissions. You can then user robocopy to copy over the data and also the file and folder permissions. I have provided a link below on how to use the ADMT tool.

http://social.technet.microsoft.com/wiki/contents/articles/16208.interforest-migration-with-admt-3-2-part-2.aspx


Regards,

JBond2010
0
Angela OwensNetwork EngineerAuthor Commented:
I was unable to use the ADMT so I just recreated the environment.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Angela OwensNetwork EngineerAuthor Commented:
I've requested that this question be closed as follows:

Accepted answer: 0 points for Angela Owens's comment #a40488827

for the following reason:

Since the new and and old domain shared the same name a trust could not be established.  Renaming either domain was not an option.  If i could then I could have used the ADMT.
0
JamesSenior Cloud Infrastructure EngineerCommented:
Hi Angela,

That's what I was trying to explain to you. You needed to recreate your environment is order to use the ADMT tool.


Regards,

JBond2010
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Virtualization

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.