Solved

Domain Migration

Posted on 2014-12-01
19
96 Views
Last Modified: 2014-12-16
I inherited a mess when the guy before me was fired.  None of his work was documented and I have been playing CSI since I started here.  We are in the process of migrating from physical laptops to thin clients and all VMs.  We are moving from one domain (test.org) to one parent and two children (Test.org >Test1.org & test2.org).  Since the old and new domains are named the same I cannot establish a trust and it is going to be restructured different.   The file structure on the file server will be the same, I was contemplating just removing the file server from the old domain and adding it to the new one.  I realize that I will have to assign the permissions manually to all of the data though.  What would be the best way to complete this as far as user accounts, files, permissions, exchange server, etc?  Right now I am at a loss and I was just going to recreate all of the user accounts.  We only have about 40 users.  Also right now we use folder redirection for the desktop, my documents and favorites.  I have already create a group policy in the new domain, and it works, but when the user logs in for the first time it creates the folder.  Is there a way to create the folder, put data in it, and then have the user synch up with it and already  have the right permissions?  I tested it and all it did not work.  All of the VMs will run windows 7 and the servers are 2008R2.
0
Comment
Question by:Angela Owens
  • 9
  • 9
19 Comments
 
LVL 15

Expert Comment

by:JBond2010
ID: 40473669
You can use the ADMT tool from Microsoft. Please refer to the link below.  You need to migrate the user accounts and sid history and ACL permissions. When this is done, you can then use robocopy to copy over the files and folders and also the permissions.

http://technet.microsoft.com/en-us/library/cc974332(v=ws.10).aspx

Also, for migrating files and folders to keep permissions. Please refer to the link below.

https://social.technet.microsoft.com/Forums/windowsserver/en-US/84e62edf-d845-4ee3-95bf-695cc54f05fa/migrating-filesfolders-across-forests?forum=winserverMigration


Regards,

JBond2010
0
 

Author Comment

by:Angela Owens
ID: 40473686
From everything I have read you need a trust to be established to use ADMT and I cannot establish one because the old and new domains have the same  name.   Is that true?  When I try it , it says that a trust cannot be established.
0
 
LVL 15

Expert Comment

by:JBond2010
ID: 40473689
That's correct. You have to establish a trust between the Active Directory forests. The 2 Active Directory forests cannot have the same name. They should be different for example domain.local or domain1.local. Active Directory forests with same name will cause all sorts of issues, DNS, netlogon etc.
0
 

Author Comment

by:Angela Owens
ID: 40473745
Is there a way to migrate stuff without using the ADMT?  I cannot rename either domain at this point.  The current one is in use and the new one needs to be set up.  We are going to have a day or two to take down the current one and bring up the new one.  If migrate isn't the right word, then export and reimport?
0
 
LVL 15

Expert Comment

by:JBond2010
ID: 40473756
Just start again with new one. How many domain controllers do you have in the new Active Directory forest? You obviously haven't migrated anything yet. So I would start again with the new forest by demoting the domain controller or domain controllers to member servers and then create the new Active Directory forest with a different name. This will solve all your problems.

If you choose not to do it this way, your workload will be trebled and a lot of manual intervention will be required.


Regards,

JBond2010
0
 

Author Comment

by:Angela Owens
ID: 40473793
I  have contemplated that, just starting fresh.  We haven't migrated anything yet, but the new domain is in place.  We have two domain controllers in the parent and two in each child.  We also  have vSphere, a file server, and Horizon View Administrator, and a few other servers and it all works.  I am a bit scared to start fresh because I am not that experienced and I don't want to break something and not be able to fix it.   Is there a way in powershell to export the user accounts and reimport it?
0
 
LVL 15

Expert Comment

by:JBond2010
ID: 40473835
You haven't created a new Active Directory forest? You've created a child domain in an existing Active Directory forest? Please confirm thank you.


Regards,

JBond2010
0
 

Author Comment

by:Angela Owens
ID: 40473852
It was already in place when I started.  It is a parent domain and two child domains.   But the old domain and new one are named the same thing.  In our new domain, the parent is going to have the servers and then the children will have the user accounts, etc.  Right now everything is on in one domain (our current working domain).  We will have a few days of downtime, to migrate everything, when no users will be here and then we plan to bring it up in the new environment.  I am trying to just get it all built at the moment.  But I have not done any user accounts, exchange, or moved the data over yet.
0
 
LVL 15

Expert Comment

by:JBond2010
ID: 40473872
By default is this scenario, there are 2 way transitive trusts. So the parent domain trusts the 2 child domains and the 2  child domains trust the parent. This is how it works in Active Directory.

Correct me if I'm wrong. Did you say that the Parent domain does not trust the new child domain?
0
Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

 

Author Comment

by:Angela Owens
ID: 40474097
The new parent domain and child domains have a trust going  on.  But I cannot establish a trust between our current domain or old domain and the new parent because they are named the same thing.
0
 
LVL 15

Expert Comment

by:JBond2010
ID: 40474195
When you say the new domain, is this a new Active Directory forest or a new child domain of the existing Active Directory?

Do you have 2 separate Active Directory forests?
0
 

Author Comment

by:Angela Owens
ID: 40474221
I am sorry I may have not explained well.  They are not part of any forests.  Just two separate domains.   The old and new are not joined in any way.  I am not sure why the guy before me did it this way and why he just didn't create two new children under the existing domain.   But my dilemma is how to get all the accounts recreated in the new domain and the mail moved.
0
 
LVL 15

Expert Comment

by:JBond2010
ID: 40474267
You have 2 separate Active Directory forests then.
0
 

Author Comment

by:Angela Owens
ID: 40474296
yes.  I assumed they were domains, and not forests, sorry.  But yes they are separate.
0
 
LVL 15

Expert Comment

by:JBond2010
ID: 40475719
You have 2 separate Active Directory forests with the same name. Because they share the same name space, this is why you cannot create a forest trust.

What you need to do is, with the new forest demote the domain controllers thus removing Active Directory and then promote them again to domain controllers creating a new name space different from the old Active Directory forest.

Then create a 2 way Active Directory forest trust. User ADMT tool to migrate over the user and computer accounts and also copy over SID history and ACL permissions. You can then user robocopy to copy over the data and also the file and folder permissions. I have provided a link below on how to use the ADMT tool.

http://social.technet.microsoft.com/wiki/contents/articles/16208.interforest-migration-with-admt-3-2-part-2.aspx


Regards,

JBond2010
0
 

Accepted Solution

by:
Angela Owens earned 0 total points
ID: 40488827
I was unable to use the ADMT so I just recreated the environment.
0
 

Author Comment

by:Angela Owens
ID: 40493484
I've requested that this question be closed as follows:

Accepted answer: 0 points for Angela Owens's comment #a40488827

for the following reason:

Since the new and and old domain shared the same name a trust could not be established.  Renaming either domain was not an option.  If i could then I could have used the ADMT.
0
 
LVL 15

Expert Comment

by:JBond2010
ID: 40493483
Hi Angela,

That's what I was trying to explain to you. You needed to recreate your environment is order to use the ADMT tool.


Regards,

JBond2010
0

Featured Post

Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

Join & Write a Comment

Why should I virtualize?  It’s a question that’s asked often enough.  My response is usually “Why SHOULDN’T you virtualize?”
It Is not possible to enable LLDP in vSwitch(at least is not supported by VMware), so in this article we will enable this, and also go trough how to enabled CDP and how to get this information in vSwitches and also in vDS.
How to install and configure Citrix XenApp 6.5 - Part 1. In this video tutorial we have explained step by step installation of Citrix XenApp 6.5 Server on Windows Server 2008 R2 is explained in this video. We have explained the difference between…
In this video tutorial I show you the main steps to install and configure  a VMware ESXi6.0 server. The video has my comments as text on the screen and you can pause anytime when needed. Hope this will be helpful. Verify that your hardware and BIO…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now