+ Post New Thread
Page 2 of 2 FirstFirst 12
Results 16 to 20 of 20
Windows Thread, Moving to new domain - advice please. in Technical; Originally Posted by psydii I'm not at all sure why you can't have the SBS and the new exchange box ...
  1. #16
    Number6's Avatar
    Join Date
    Feb 2009
    Location
    Worcester, UK
    Posts
    457
    Thank Post
    2
    Thanked 9 Times in 8 Posts
    Rep Power
    13
    Quote Originally Posted by psydii View Post
    I'm not at all sure why you can't have the SBS and the new exchange box running at the same time to allow for a move-mailbox, but you're happy with the exmerge route so I'll shut up about it.

    For the shared areas problem we used this tool
    Download details: SubInACL (SubInACL.exe)

    caveat: this was during a w2k3 -> w2k3 migration. I haven't tested in a w2k8 environment, though a very quick google suggest there should not be any issues as your NAS is 2k3.
    I have used subinacl previously, it's a good tool.

    One of our users lost access to her home folder recently, it was a permission denied problem that cropped up for no apparent reason. Subinacl sorted it without fuss.

  2. #17
    Number6's Avatar
    Join Date
    Feb 2009
    Location
    Worcester, UK
    Posts
    457
    Thank Post
    2
    Thanked 9 Times in 8 Posts
    Rep Power
    13
    Another question:

    Is there any need to do anything other than remove all client PCs and servers out of the old domain and into a workgroup?

    One of our ICT people suggested that I need to give local admin ownership of the C$ share on all machines. Do I need to do this?

  3. #18

    Join Date
    Jul 2006
    Location
    London
    Posts
    1,267
    Thank Post
    112
    Thanked 242 Times in 193 Posts
    Blog Entries
    1
    Rep Power
    74
    It has this by default. If it has been configured differently, figure out why. My gut tells me that stuff will break during your migration if OLDDOMAIN\Domain Admins are the only accounts that can properly control a machine.

    Some more things that I'd investigate before the migration:
    • Have you considered the effect of changing GPO scope will have on your machines? If use GPO Software Installation you may loose the ability to use GPOSI to uninstall applications if you loose the original GPO that installed it.
    • Will the paths to the msi's remain the same? If the msi was on a network share and the client has not cached the install files, you will not be able to unistall/repair or patch previously deployed applications properly if that UNC path is not available.
    • Is the av update account a domain account or Local account? Is the AV Server changing significantly?
    • moving between WSUS servers doesn't always go well and sometimes you need to reset the SoftwareDistribution folder.
    • W7 uses Offline files a lot. I believe permissions to them are tied to user SIDs. Have you tested the impact to users trying to access files in the client side cache once they are in the new domain?
    • Do any machine local groups contain domain members? This can lead to STOP errors (certainly in XP, haven't much experience with Vista/7) if they remian after a machine has left a Domain.
    • Do any ACE's on client devices reference Domain accounts? This can lead to delays in certain UI features, possibly other unexpected effects to.
    • Has your Web Filtering product been tested against the new domain? (I believe there can be gotchas with the increased level LDAP security in W2K8)
    • Do you have any Enterprise certificates? You will get warnings in your logs if they remain on the clients once the old CA goes.
    Last edited by psydii; 15th December 2010 at 11:33 AM. Reason: tidying up layout

  4. #19
    Number6's Avatar
    Join Date
    Feb 2009
    Location
    Worcester, UK
    Posts
    457
    Thank Post
    2
    Thanked 9 Times in 8 Posts
    Rep Power
    13
    Quote Originally Posted by psydii View Post
    It has this by default. If it has been configured differently, figure out why. My gut tells me that stuff will break during your migration if OLDDOMAIN\Domain Admins are the only accounts that can properly control a machine.

    Have you considered the effect of changing GPO scope will have on your machines?
    Will the paths to the msi's remain the same?
    Is the av update account a domain account or Local account? Is the AV Server changing significantly?
    moving between WSUS servers doesn't always go well and sometimes you need to reset the SoftwareDistribution folder.
    W7 uses Offline files a lot. I believe permissions to them are tied to user SIDs. Have you tested the impact be users trying to access files in the client side cache once they are in the new domain?
    Do any machine local groups contain domain members? This can lead to STOP errors (certainly in XP, haven't much experience with Vista/7) if they remian after a machine has left a Domain.
    Do any ACE's on client devices reference Domain accounts? This can lead to delays in certain UI features, possibly other unexpected effects to.
    Has your Web Filtering producted been tested against the new domain? (I believe there can be gotchas with the increased level LDAP security in W2K8)
    Any Enterprise certificates? You will get warning galore if they remain on the clients once the old CA goes.
    Your gut matches with my gut

    I've been given next to no support over this by line management, except for platitudes stating it won't be an issue. I'm flying by the seat of my pants on this one.

    I have a strict four working day window in which to do this, and that includes strpping down the cabs, modifying them, installing new UPS', etc, as well as the actual domain migration work.

    I'm trying to deal with issues as they arise in my mind but, like you, I'm convinced it'll all go pear shaped for lots of reasons. And no fingernails left to chew!

  5. #20

    Join Date
    Jul 2006
    Location
    London
    Posts
    1,267
    Thank Post
    112
    Thanked 242 Times in 193 Posts
    Blog Entries
    1
    Rep Power
    74
    Do you really have to do whole migration in this window?

    Either way, if you haven't already, spin yourself up a virtual environment with a 'bare metal' restore of your two domains and a client. Then run through the migration testing all the aspects that concern you.

    At worst you might discover a show-stopper (for example it can be done in the time available), saving you the stress and grey hairs over the Christmas break.
    On the other hand you may only find a couple of minor trip hazards, and you can stop worrying as you then *know* it will work.

SHARE:
+ Post New Thread
Page 2 of 2 FirstFirst 12

Similar Threads

  1. Advice regarding moving school UPWARDS from OFFICE 2003.
    By kennysarmy in forum Office Software
    Replies: 19
    Last Post: 19th November 2010, 12:54 PM
  2. moving job out of education advice
    By sandeep2504 in forum General Chat
    Replies: 1
    Last Post: 12th October 2010, 03:19 PM
  3. Moving users to new domain
    By ravenadsl in forum Windows Server 2008 R2
    Replies: 8
    Last Post: 21st May 2010, 11:51 AM
  4. Moving domain name from ISP to another
    By superatticman in forum Internet Related/Filtering/Firewall
    Replies: 3
    Last Post: 18th March 2010, 07:25 PM
  5. Moving from single label to dotted domain name..
    By johnny in forum How do you do....it?
    Replies: 8
    Last Post: 23rd February 2007, 01:31 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •