Different Domains

[Sydders01]

Hi all,

 

 

we have several schools about 5.

 

 

They all have different domains. We want to put all of them in one place maybe one domain with subdomains for easy management

 

 

Please has anyone done this before? can you give me a design plan/best practices

 

 

Thanks

[Stormborn15]

Also interested in this

[snagrat]

I've done it at several MATs.

 

I went with single domain, single forest.

 

We have a DC in Azure and each school has an IPSEC VPN to Azure so al schools connect to the Azure DC. Because not all schools are with the same ISP yet this allows the schools to be connected at a domain level but not for services like SMB. It also allows us to host other services in Azure. The Azure side costs about £50 per month.

 

It's works very well.

 

Each school as its own OU and then the central team are in their own OU. Most data is stored in O365 so user's that roam sites still have access to their own data.

 

Each site has had to be rebuilt to the new domain but all the prep can be done before the site is started to minimise the amount of work required at the school

[Sydders01]

Thanks @NAGrat

 

please is it possible for me to do this in a virtual environment to see how it works?

 

since I do have several domain now, how did you go about it?

 

 

 

I've done it at several MATs.

 

I went with single domain, single forest.

 

We have a DC in Azure and each school has an IPSEC VPN to Azure so al schools connect to the Azure DC. Because not all schools are with the same ISP yet this allows the schools to be connected at a domain level but not for services like SMB. It also allows us to host other services in Azure. The Azure side costs about £50 per month.

 

It's works very well.

 

Each school as its own OU and then the central team are in their own OU. Most data is stored in O365 so user's that roam sites still have access to their own data.

 

Each site has had to be rebuilt to the new domain but all the prep can be done before the site is started to minimise the amount of work required at the school

[Katy]

When we ran everything over MPLS links, our trust has multiple domains in a forest, forest root domain is for the central systems/staff, child domain per school. Unfortunately it means starting fresh at each school to set it up. Now we switched to normal Internet connections at each school and VPNs to link together.

Although now new schools that join are just added as domain trusts in AD so they don't have to trash everything and start fresh to join the forest.

[snagrat]

I'm not sure what you could really test within a virtual environment.

 

Being as it is one domain there is no forest delegation etc that needs to be set.

 

The question to you would be how are you schools linked?

 

All the schools I have done were all on their own domain. I started with one school and renamed their domain to what I wanted it to be and then used that school as the starting point.

 

Then as more schools came online we would demote their domain and join it up with the new one. Then we rebuilt all machine anyway so they were auto joined to the new domain.

 

Our OU structure is the same in pretty much all schools so getting that done first saved time as you know it works properly.

[Michael]

There are several ways to tackle this -

 

Single Domain, Single Forest (as above) or Parent Domain, Child Domain (Single Forest) or separate Domains, separate Forests connected with Trusts. That's with regards to how Active Directory is configured. As to how you connect them all up, there are numerous options.

 

When we ran everything over MPLS links, our trust has multiple domains in a forest, forest root domain is for the central systems/staff, child domain per school. Unfortunately it means starting fresh at each school to set it up. Now we switched to normal Internet connections at each school and VPNs to link together.

Although now new schools that join are just added as domain trusts in AD so they don't have to trash everything and start fresh to join the forest.

 

Curious why did you backtrack on MPLS and multiple Domains in a Forest? Yes you have to start fresh, but at least then everything's consistent in your organisation.

[Katy]

Curious why did you backtrack on MPLS and multiple Domains in a Forest? Yes you have to start fresh, but at least then everything's consistent in your organisation.

MPLS cost a fortune and the shared internet connection provided via the MPLS wasn't very good (too many schools compared to what it was designed for), so moved to normal leased line with meraki VPN. Not sure why they stopped joining schools as child domains as I work in one of the schools rather than centrally at the trust.

[Sydders01]

Hi @snagrat Mys schools have different domain. They are not linked in anyway. But we are looking at joining them one at a time to one of our school were we have created an ou . You have any blue print you can pm me on how to go please?

 

I'm not sure what you could really test within a virtual environment.

 

Being as it is one domain there is no forest delegation etc that needs to be set.

 

The question to you would be how are you schools linked?

 

All the schools I have done were all on their own domain. I started with one school and renamed their domain to what I wanted it to be and then used that school as the starting point.

 

Then as more schools came online we would demote their domain and join it up with the new one. Then we rebuilt all machine anyway so they were auto joined to the new domain.

 

Our OU structure is the same in pretty much all schools so getting that done first saved time as you know it works properly.