Starting again - new domain

[tmcd35]

Okay, I'm thinking big. I want to scrape our existing domain and start completely from scratch - well almost.

 

AD and GPO's have become something of a mess over the years and I've never liked the choice of domain name. Also can't be 100% sure what services rely on an old admin password. Need to clean this up and get it working properly/securly.

 

However, we run Hyper-V servers that are joined to the exiting domain, looks like I've got a chicken and egg situation.

 

What I'm thinking is making the Hyper-V servers DC's for the existing domain then getting rid of the existing DC's. The Hyper-V servers and the main storage server will remain on the existing domain.

 

I can then create a complete new forest as virtual machines running on the hyper-v servers. This will then let me create new virtual domain controllers with new clean GPO's and security groups.

 

So, the question comes down to user migration. Do I...

 

a) Create new users accounts on the new domain, copy user files from the file server into a new virtual file server on the new domain

 

b) Create a forest trust, migrate users to the new domain, copy user files from the file server into a new virtual file server on the new domain

 

c) Create a forest trust, migrate users to the new domain, leave files on the old domain providing access through the forest trust

 

d) Create new user accoints on the new domain, create a forest trust, leave files on the old domain providing access through the forest trust

 

e) Something else I haven't thought off

[tmcd35]

Bump!

 

Posted this a bit late last yesterday so thought I'd bump it this morning. Anyone got any advice/experience of switching domains?

[Theblacksheep]

When we moved from CC3 we created new domain, allowed trust and stored and the old domains files on the new domains servers. When we switched over between the domains happened the data was exactly the same. Then the old domain could be removed once the switch was made.

 

We use VMware so don't have to worry about HOSTS being on domains

Edited November 15, 2013 by Theblacksheep

[tmcd35]

When we moved from CC3 we created new domain, allowed trust and stored and the old domains files on the new domains servers. When we switched over between the domains happened the data was exactly the same. Then the old domain could be removed once the switch was made.

 

Where your domains in the same forest, or do you create a new forest and a trust between them?

 

So you moved files to the new domain, users logged onto the old domain and could access their files across the trust?

Then copy the users to the new domain, and the folder access rights should update automatically?

[glennda]

Where your domains in the same forest, or do you create a new forest and a trust between them?

 

So you moved files to the new domain, users logged onto the old domain and could access their files across the trust?

Then copy the users to the new domain, and the folder access rights should update automatically?

 

If you are wanting to completely remove the original domain completely I would create 2 forests and then setup a trust between the two forests.

 

The folder rights wouldn't update automatically (I don't think).

 

But if you saved this batch into each share it will set permissions based on the foldername (so as long as the folder name is the username you sorted). Obviously change the groups in speech marks to who you would like to allow permission. In this Example Manage Student Data has full control and Teaching Staff are read only.

 

for /d %%1 in (*) do echo y|cacls %%1 /t /g %%1:F administrators:f "manage student data":f "domain admins":f system:f "teaching staff":r

[Theblacksheep]

Where your domains in the same forest, or do you create a new forest and a trust between them?

 

So you moved files to the new domain, users logged onto the old domain and could access their files across the trust?

Then copy the users to the new domain, and the folder access rights should update automatically?

 

Thats it cross forest trust, dont use the same forest. All right except the access rights should be corrected by scripts as they wont update automatically.