Michael Posted May 22, 2018 Posted May 22, 2018 (edited) Hi all, I have a test setup comprising of a Windows Server 2016 server and a Windows 10 client. The existing domain is called apples.com to be renamed pears.com This is the procedure I've tested (multiple times), and everything appears OK, but want to make sure I'm doing things in the correct order: Create pears.com Primary Zone rendom /list (changing all entries from apples to pears and saving the file) rendom /showforest (displays pears.com) rendom /upload rendom /prepare rendom /execute (server prompts for a reboot) Login to new domain PEARS with existing administrator credentials. Test workstation also displays PEARS as the logon domain and works correctly. gpfixup /olddns:apples.com /newdns:pears.com (Updates Group Policy) gpfixup /oldnb:apples /newnb:pears (Updates Group Policy) netdom computername server.apples.com /add:server.pears.com netdom computername server.apples.com /makeprimary:server.pears.com (reboot server, so FQDN also updates to server.pears.com) Wait a week to allow all other devices to 'check in' to receive the domain name change. At this point resolving to share.apples.com and share.pears.com both resolve correctly. rendom /clean rendom /end Create new _msdcs.pears.com zone. Remove existing apples.com and _msdcs.apples.com zones. Job complete! Please let me know if you've done differently, thank you! Edited May 22, 2018 by Michael 1
snagrat Posted May 22, 2018 Posted May 22, 2018 That’s how I’ve always done it. I’ve always had issues with the gpfixup scripts failing if you have any software deployment GPOs configured. The command just fails, but as soon as you delete the GPO it works. 1
Michael Posted May 22, 2018 Author Posted May 22, 2018 That's good to know. So presumably if the command fails, I can delete the GPO and re-run until it's successful?
snagrat Posted May 22, 2018 Posted May 22, 2018 Yes, but it can be hard to find the GPO as their names are missing. If you have any, I would delete the first
DJ-1701 Posted May 22, 2018 Posted May 22, 2018 Wait... for how long have you been able to rename a domain? I thought you had to setup a new domain and migrate using ADMT.
Katy Posted May 22, 2018 Posted May 22, 2018 Wait... for how long have you been able to rename a domain? I thought you had to setup a new domain and migrate using ADMT. I think they introduced domain rename in 2012 or 2012 R2. Still wouldn't trust it though. 1
PR-UK Posted May 22, 2018 Posted May 22, 2018 Wait... for how long have you been able to rename a domain? I thought you had to setup a new domain and migrate using ADMT. I think you could always rename however nowadays MS don't promote it, plus if you have Exchange, MS SQL, or pretty much any MS Server Applications you'll need to create a new domain and migrate. Personally I'd create a new domain (and have in the past) as I can imagine a rename causing many difficult to trace issues.
Oaktech Posted May 22, 2018 Posted May 22, 2018 Step-by-Step guide to rename Active Directory Domain Name - RebelAdmin I'm going to do it next summer...
Michael Posted May 22, 2018 Author Posted May 22, 2018 I've tested this process and it does work on my test configuration. The only other query I have, will I need to run both netdom commands on just the PDC or on every DC?
snagrat Posted May 23, 2018 Posted May 23, 2018 I've tested this process and it does work on my test configuration. The only other query I have, will I need to run both netdom commands on just the PDC or on every DC? Every DC. No such thing as a PDC anymore
3s-gtech Posted May 23, 2018 Posted May 23, 2018 FSMO Role Holder is the closest thing now, but it's not the same. It still includes the 'PDC Emulator' role, which is why many people still treat one of their DCs as the PDC. I certainly mainly work on the FSMO role holder.
Michael Posted May 23, 2018 Author Posted May 23, 2018 This is what I meant, the role holder which is equivalent to the PDC (I am old school don't you know)!
Michael Posted May 23, 2018 Author Posted May 23, 2018 For everyone's reference, when running rendom /prepare each DC is contacted, however if it fails, you need to make sure Zone Transfers are enabled (on each DC). rendom /execute will then force each DC to restart for changes to take effect. Both netdom commands then need to be run on each DC in turn, then manually rebooted. That's it - other than that, it's straight forward, but I would advise testing this procedure before making the change in a live environment.
arh1a Posted February 16, 2019 Posted February 16, 2019 I will be doing this soon, what about other servers ie file server, rdp, etc (all 2016 servers). Do you just need to reboot them twice like you do with the workstations so they connect to the new domain name before running the final command? - rendom /clean Also I have Azure AD Sync and RM Unify Sync on the domain controller so will I need to just update the information in each of the software settings after the change? Regarding GPO MSI deployment as above just to confirm before starting the process I can just remove the GPOs then recreate them once the change has been completed? Thanks in advance
HPlum78 Posted February 16, 2019 Posted February 16, 2019 Yeah no support for Azure Sync on local domain rename. Although there is a notion that if you switch the sync off and then reininstall it starts to work again but that would be a full sync so depending on how many objects you have to sync it could take a while. (Not sure what the MS support position on this would be, so maybe worth a proactive call first) How old is this Domain the you are renaming?
arh1a Posted February 16, 2019 Posted February 16, 2019 (edited) Yeah no support for Azure Sync on local domain rename. Although there is a notion that if you switch the sync off and then reininstall it starts to work again but that would be a full sync so depending on how many objects you have to sync it could take a while. (Not sure what the MS support position on this would be, so maybe worth a proactive call first) How old is this Domain the you are renaming? Thanks for the heads up as I wouldn't want staff to loose access to there emails. I will open a call with Microsoft and see what they say about it as hopefully there will be a way. As far as I know the local domain name has been the same ever since the network was setup years ago (2003 server originally but all on 2016 now). Looks like it will break AD Sync - https://serverfault.com/questions/808801/what-impact-would-a-domain-rename-have-on-azure-ad-sync Staff don't login to there email accounts with the local domain name there is a separate domain name that they use to login to email so not sure if that will make a difference - [email protected] Edited February 16, 2019 by arh1a
HPlum78 Posted February 16, 2019 Posted February 16, 2019 (edited) How many staff/ students and computers? Just thinking about what the RID count looks like? Edited February 16, 2019 by HPlum78
HPlum78 Posted February 16, 2019 Posted February 16, 2019 (edited) function Get-RIDsRemaining { param ($domainDN) $de = [ADSI]”LDAP://CN=RID Manager$,CN=System,$domainDN” $return = new-object system.DirectoryServices.DirectorySearcher($de) $property= ($return.FindOne()).properties.ridavailablepool [int32]$totalSIDS = $($property) / ([math]::Pow(2,32)) [int64]$temp64val = $totalSIDS * ([math]::Pow(2,32)) [int32]$currentRIDPoolCount = $($property) – $temp64val $ridsremaining = $totalSIDS – $currentRIDPoolCount Write-Host “RIDs issued: $currentRIDPoolCount” Write-Host “RIDs remaining: $ridsremaining” } Oh need to run powershell as admin. That's ripped from somewhere in the past you can also use dcdiag to get the count. [color=#000000][font=WOL_Bold]Dcdiag.exe /test:ridmanager /v [/font][/color] Edited February 16, 2019 by HPlum78
arh1a Posted February 16, 2019 Posted February 16, 2019 How many staff/ students and computers? Just thinking about what the RID count looks like? Roughly 350 staff/pupil users and about 80 computers/laptops RID if ive read it correctly from the dcdiag command - rIDAllocationPool is 6103 to 6602
HPlum78 Posted February 16, 2019 Posted February 16, 2019 Not scratched the surface then, just thinking if you where close to exhausting the RID Pool then it would be more advisable to migrate to a new domain.
arh1a Posted February 16, 2019 Posted February 16, 2019 Not scratched the surface then, just thinking if you where close to exhausting the RID Pool then it would be more advisable to migrate to a new domain. Ah I see what you mean. A domain name change would definitely be more simple (apart from the Azure AD Sync bit which is a bit unknown at the moment).
arh1a Posted February 20, 2019 Posted February 20, 2019 Can someone confirm what commands I would need to run on the other domain controllers or will they just need a restart to pick up the new domain?
Oaktech Posted February 28, 2019 Posted February 28, 2019 Does anyone know if SCCM plays nice with a domain rename?
snagrat Posted February 28, 2019 Posted February 28, 2019 Does anyone know if SCCM plays nice with a domain rename? Completely breaks SCCM. Not supported at all.
Oaktech Posted February 28, 2019 Posted February 28, 2019 Completely breaks SCCM. Not supported at all. B*gger. I'll add that to my list of things I need to recreate over the summer.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now