Has anyone moved to a new internal domain?

[Jawloms]

I have inherited a domain called debenham-cc3.internal, which has no sign of anything RM related in it at all. The default domain policy has loads of settings in it, and there are permissions all over the place. I am steadily working my way through things, but would also love to get rid of the 'cc3' reminders. I know in theory what is involved in moving everyone to a new domain, but realistically how much of a PITA is it? I have around 450 kids, 100 staff, and various servers including SIMS and Exchange. Is it worth the hassle? I appreciate it is at least an Easter holiday job, if not Summer!

 

Thank you

 

Stuart

[6Foot2]

Our LEA moved our network from our old school.local to school.internal about a year and a half ago. They looked at the existing policies, kept the good stuff and dumped what was not so good. They also asked me what I would like the new network to be like and they did their best to match my requests. We virtualised our servers at the same time.

 

I think it has worked out well and while I don't know what the costs were, our Finance Department handled all of that, I believe that those costs were reasonable.

 

As a bonus, they sourced all of the quotes before presenting proposals to us so we didn't have to get three quotes as required for large purchases by our Finance Department.

[pantscat]

Exchange makes it slightly more of a PITA, but it's still relatively straightforward.

 

You'd need to create a new domain (in a new forest) alongside your existing domain, then create a trust between the two forests, build a new Exchange box, and then migrate the mailboxes across.

 

That's the most elegant solution, anyway...

 

Everything else is more or less easy.

[DJamesS]

As pantscat says above, Exchange makes things a bit more of a pain. A fresh /new forest is definitely the way to go, much cleaner and less hassle. The big thing though is in the testing! Setup a couple of servers, on an isolated switch, setup Exchange with some test mailboxes, setup a server to represent what will be your new domain, and a new Exchange server, and test (and re-test) the mailbox migration. Might be worth checking the SQL setup for SIMS too, as that may well need re-permissioning. If SIMS is supported by a third party, definitely get them onboard (easier said than done, but easier to plan up front than fire fight if SIMS doesn't play nicely after the migration). The upheaval (if that is the right word) is worth it in the end, a new clean 'known quantity', without any left over policies, permissions, etc.

[PR-UK]

We did ours over Summer 2015, was fairly straight forward. I did take almost a year setting and configuring everything the way I wanted it though (started Oct 2014 everything was transferred by Sep 2015). We have about 40 servers, 1000 kids and 200 staff.

 

Exchange is a bit of a fiddle, if it's 2013 you need to use the Exchange cross forest migration script first to pre-stage the user accounts then use ADMT to migrate the account details and SID history into the pre-staged accounts.

 

As someone said above, if your SIMs is managed get them booked in. We contacted Capita in advance and were told it was an easy process to do ourselves, however when it came to moving it none of their tools would correctly move it between SQL versions and they announced that the integration with their cloud services had to be done by them (for a charge) so we ended up leaving it as the last server to transfer.

 

Also don't use a .internal address. It's generally accepted now that domains should have an internet relatable address (which you own). If you need a trusted SSL certificate in the future most providers won't supply a non-internet domain cert.

 

Overall it's been a worthwhile process. We used the time to fix a whole host of annoyances IT, Staff, and Students suffered, as well as deploy the latest server and desktop OS's. Our desktop support dept. built a highly customised version of Windows 8.1 removing all the annoying Apps and unhelpful features, the number of complaints compared to Windows 7 is significantly lower.

 

I would say don't rush it, and don't try and cut corners by re-domaining existing servers/desktops, as you'll only end up dragging problems from the old domain to the new one and introduce a whole load more!

 

Good luck!

[Jawloms]

I think I may go for this. Plan, prepare, build and test as much as possible now, and then actually move over the summer. One question though. I currently have a flat network and would like to have a couple of VLANs. Is it worth me putting everything I currently have in VLAN (just picked a number) 30 now, and then building the new network properly, or does it really not make a lot of difference and I may as well start implementing the VLANs now?

[datar_]

It shouldn't make any difference what you use internally, it's just a best practice. I go crazy in my network lab, when your domain is a lol.lol and computers say Your Connected to Network Lol, would you like this to be a work network. It's quite refreshing;

 

If you have services on site such as Exchange, RDS, VLE, SSO stuffs. Or if you SSO from Internal to External, use your FQDN such as example.county.sch.uk/.ac.uk.

[PR-UK]

I would say if you're not having any issues with the flat network as it is at the moment I'd leave it. Then once you start moving devices over to the new domain set them in the VLANs as you go. That way you've got more chance to test without causing problems for the existing setup.

 

We had to implement VLANs a couple of years before the new domain purely because we had so many devices the network was becoming congested and data wasn't getting through.

[Michael]

Migrating/building new domains is something I've done for years. Sometimes the domain is fixable, but other times, it's better to start again.

 

With regards to Exchange, it may give you a reason to look at O365... it's then one less worry and you'll only migrate mailboxes once.

[KK20]

just a note, we have an old "legacy" .local internal domain, exchange is quite happy to use our external domain + cert (not a trace of the .local on our cert). Our websites using SSL also have their addresses as alternate domain names too.

[Jawloms]

@KK20 - We're the same. My server email is a emailserver.internal, the certificate is mail.debenhamhighschool.suffolk.sch.uk. All is happy.

[Jawloms]

So I'm coming to build my new domain. Everyone has an @DebEnhamhigh.co.uk email address, yet our OWA address is mail.debenhamhighschool.suffolk.sch.uk so that is how our exchange server is set up to be viewed externally. I'm guessing my new domain I setup should be on the debenhamhigh.co.uk format rather than the debenhamhighschool.suffolk.sch.uk as we don't use that anywhere other than to access OWA?

[KK20]

I assume you might want OLD emails to trickle in under the old name for a while? Look at the accepted domains in organisation hub transport. We have a "not publicised but still used" .net email address that is accepted by our mail servers but is NOT the primary address under our SMTP either. You will then want to set an email policy with the new address as the primary SMTP. This is again under hub transport in organisation/email address policy. Add the new address and set it to primary reply (feel free to leave the old one for legacy email). I cant remember if this is a LIVE change or you need to right click and apply (I think it is a live change). It is up to you whether you change/care about your EHLO or not. As for your OWA, that is up to your web settings externally. You don't have to have the OWA external address matching your internal server names, ours doesn't - just match up the DNS vs any changes to your firewall for directing traffic to the web server. OWA is a separate web server in reality, it takes a logon and directs the user to a mailbox as appropriate. If things internally are being updated piecemeal, then just update your internal DNS with the old zone pointing mail.olddomain (or whatever you used) to the new server etc.

 

don't forget "autodiscover" adds its own complications too. Use the Microsoft exchange analyser to check out the new domain when you are finished, I found it invaluable as a tool.

 

EDIT: obviously your MX will need to change but don't forget to update your SPF, if that isn't updated then you will probably get caught by other spam filters.

Edited March 9, 2016 by KK20