Is it possible to have multiple Active Directory Domains in One IP Network?

I am part of a team (on the periphery) tasked with removing Novell products and moving to AD.
This has in itself all manner of issues - not the least - multiple groups/permissions - a lot of which either have no real meaning now, or may have great importance.

There is a suggestion to create two Active Directory "forests" one with all the inherited rubbish and one new clean.
Is this possible?
I do understand this is rather a simplistic overview, however.
And (for a newbie), what is the scenario and pit-falls?
i do understand that this is not a "solution" that will fit into one or two sentences.....

However if "there be dragons" - I will not take this further.

All information / assistance gratefully received.
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Lee W, MVPTechnology and Business Process AdvisorCommented:
Absolutely.  HOWEVER, you have to potentially be careful of things like DHCP.  AD relies heavily on DNS... and you can't have 2 DHCP servers giving out the same or range or two DHCP servers with different ranges and different info (such as DNS settings).  That just doesn't work well.  If you set everything statically or only allow 1 domain to use DHCP, then there shouldn't be any problem. Oh, just one other caveat - don't name ANY systems, users, or domains the same as any other system, user, or domain.  (So everything must be uniquely named).
I have only done this once myself, but just to re-inforce what Lee said - unique names are critical.

What I did, was prepend the domain name to EVERY hostname so, for example:



Wherever possible, I tried to avoid even having the same suffix (HPLJ9999 for example), and enforced that for any new devices, but when it happened, both of the networks were pre-existing, so we used the prefix to disambiguate.

We also gave every device a fixed IP (both domains were only about 15 / 20 machines anyway, so not a big deal to manage - this would be problematic in a larger environment of course).

There are multiple ways to pull this off. Having two AD domains on the same subnet will require all static IP addresses. However, through the use of VLAN technology you can have certain ports on a what's called a managed layer 3 switch or many layer 3 switches communicating on a unique IP network. A core layer 3 switch or a good firewall would act as a router thus allowing the two networks to communicate but would segment the traffic for each AD domain. With this approach you can have a DHCP server on each network to serve clients. It takes a little engineering and might sound complicated to the uninitiated but this is a common and normal network configuration.

However, I would think that with appropriate and well designed AD groups and organizational units, it is likely that a single AD domain would be the easiest to manage and deploy. VLAN'ing still makes sense if you have a large network and want to segment departments or divisions.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.


lots of good advice.
if I could make a suggestion.
why not have another subnet/Vlan/Domain
have your old Novell clients on Vlan 9 and all the new stuff on Vlan 10.
that way you can see what's still on the old way of life and what has moved over.
should help with the head ache too.
gavin_dAuthor Commented:
All, many thanks for all the sage advice and feedback.
I will take this back to the team and we will disseminate what to do from here.

Your assistance, and speed of response, is very much appreciated.

gavin_dAuthor Commented:
This is unfortunate that while all contributors gave a lot of good advice. But I do not seem to be able to award points to more than one contributor.....which if I have missed - I apologise.
But did have a tool about to try to award point to many, but had to just pick one.

Everyone should have been awarded points.....

Thanks all, anyway. Thanks
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.