2 sites 1 forest?

[dave.81]

Sounds like a film but wondering on the best way to achieve this. We've taken on a feeder school which i am currently in the process of replacing their SBS2008 server with something newer and better spec'd. We will have staff logging into computers on both sites and need to share certain files, so would like to bring their domain into ours, or just replace theirs completely.

 

Can i just add them as a site on our active directory and this will allow them to login between the 2 sites or is it more complicated than that?

[psydii]

Quick win: Set up a trust between the two forests. and Domain Local groups for access control.

 

Long Term: configure Sites and Services in AD Put a DC from your domain physically at their site, and migrate them over to your domain. retire theirs.

 

subinacl will become your friend.

 

The exchange migration will probably be the toughest element. Export their mailboxes to PST and import into your exchange. You'll need to configure it to handle their DNS domain too.

 

I'd be very tempted to export their mailboxes and i

[Sagima]

I think you could probably set up a trust between the two forests use the active directory migration tool to bring their domain into yours. Exchange should allow the move once that is done.

 

(as I was typing this I found this blog entry Exchange 2010 Cross-Forest Migration Step by Step Guide – Part I - GD Bloggers - Site Home - TechNet Blogs which was roughly what I was thinking of when you asked the question)

 

then leave them a dc (and maybe a replica of thier part of the fileserver via dfs) and set up a site so they use that dc

Edited November 10, 2015 by Sagima

[dave.81]

Luckily we dont have to worry about exchange as neither of us use it.

 

They are such a small site, less than 100 total users that i'm tempted to not migrate anything other than data and scrap everything else! So i am right in thinking that using Sites and Services in AD i can allow both groups of users to share resources and log in at both sites?

[psydii]

No, sites and services controls replication within a domain.

 

You need a cross-forest trust for users to access resources between the physical sites.

Create a forest trust

https://technet.microsoft.com/en-gb/library/cc780479(v=ws.10).aspx

 

Accessing resources across forests

https://technet.microsoft.com/en-us/library/cc772808(v=ws.10).aspx

Edited November 10, 2015 by psydii
Updated links and clarity

[Geoff]

Once you've got them migrated I'd stick a box over at their site. Put hyper-v on it and have two VM's. One a DC (with DNS and DHCP) and another for Printing and WSUS.

[john]

Do they have IT staff on-site or are you and your team it? If so why not just do one domain in one forest with Sites and Services to give it the intelligence for things that are site based like the DCs, DFS etc... No need to make things more complicated unless they really do need to be. You can have them in separate OUs and delegate to them the bits they need if they have an "IT helper" or something and you can block your GPO inheritance on the OUs for them and make the own etc..

[DGardiner]

i have 4 sites on one forest(one can be hardly called a site, but its on its own network and has a basic specced dc for like 10 people) it works great. do some reading on DFSR if you need people to be able to work at either site - plan it out, DFSR can be your friend if you are nice to it

[dave.81]

They have no IT support and i'll be expect to 'pop' over a few times a month to help with issues so want to put a system in place where i can do as much as possible without wasting 2 hours in the car to pop in. I did think about using a single domain but worried how the replication would work as they only have business broadband (46mb/5mb). I'll be giving them their own DC and file storage but will need to access certain shared files between the 2 sites.

 

I've only ever managed a single site so more than happy to take suggestions on the best way, 2 sites or a single one?

[DGardiner]

They have no IT support and i'll be expect to 'pop' over a few times a month to help with issues so want to put a system in place where i can do as much as possible without wasting 2 hours in the car to pop in. I did think about using a single domain but worried how the replication would work as they only have business broadband (46mb/5mb). I'll be giving them their own DC and file storage but will need to access certain shared files between the 2 sites.

 

I've only ever managed a single site so more than happy to take suggestions on the best way, 2 sites or a single one?

 

yeah, you are really going to have to think about the sharing data, 5up is probably not great for too much being pulled through, the ad sync should be fine. but any file transfers will kill that upload for hours.

 

what we did was decide on a core site, and get 100/100 point to point links from the other schools to the core and a smoothwall at the core to do the filtering on all of those on a 20/20 fibre line(now a 200/200 line)

 

its a pretty big investment though but gives you room to do file transfers between the sites without nailing your internet too bad

[Geoff]

You must make sure you set things up in AD Sites & Services correctly. In particular when you define your site to site IP links make sure you get the costs and the scheduling correct. There's this technet blog that goes through the details for you:

 

Step-By-Step: Setting Up Active Directory Sites, Subnets & Site-Links - Canadian IT Professionals - Site Home - TechNet Blogs

 

I would also look at setting up some QoS on your low bandwidth links if it's not feasible to up the bandwidth. You'll want to prioritize VoIP traffic for example.

Edited November 10, 2015 by Geoff

[psydii]

AD replication should be no problem over that link. Unless either you store large objects in sysvol, or the link is already saturated.

 

If anyone tries to access files between sites, then you will definitely saturate your link.

 

Also this is worth a read: https://technet.microsoft.com/en-gb/library/cc771251.aspx

[dave.81]

Right i think i've settled on the plan, will site with a single domain and replicated AD over the current link and use OU groups for their users/pupils. Give them their own DC and file server but for the 2/3 members of staff who switch sites and need office documents between sites i'll give them shares via GPO.

 

Does the above mean i'll need to run on the same subnet/ip range or will the VPN be able to do the routing between the 2?

[Geoff]

You will need a separate subnet for your second site. You will need something at each end of your site to site link to route between them.