Converting an OU into its own Domain

[Killer_Bot]

For various reasons I would rather not dwell on; I find myself in a position that the system I've inherited effectively manages 3 different schools and I now need to look at migrating 2 of them into a single domain each. So in effect our domain has School A, B and C but when I'm done I need 3 domains; the original with School A and two new ones with B in the second and C in the third. B and C are currently their own Organisational Units and have their own HyperV server running a DC, File Server, Print Server and MIS Server. This is further complicated in that we have VPNs to said schools and manage them using SCCM for support and deployment. But I'll cross that bridge once the bulk of the work is done.

 

Just hoping to get some advice as this won't be happening until likely the summer. My plan for now is to create a new virtual server at school B and C and install AD and create their own Domain. Then to use something like ADMT to migrate their users and get things like DNS, DHCP, Group Policy and whatnot in a similar state. Once that's set up I plan to get their 365 tenancy set up and then just export PSTs from our existing Exchange 2010 and import them to each user (you're only talking circa 40 staff at each school - students aren't a major issue). So, so far, I think that should work.

 

However the file server is a bit more complicated because of permissions. I can leave the current domain and join their new one but then I guess I'm going to have to go through and reconfigure the permissions. I'll be able to script some of it based on the filename (for documents in particular) but I'm wondering if there's not a better way. Would it be worthwhile to create a new server and just attach the VHDX files to said server rather than leaving and rejoining (and just do fresh permissions).

 

Has anyone else been through anything similar or can think of any major blockages that could impede the above? Or even a better approach to tackling it other than 'start fresh' and let them deal with it?

[psydii]

I've done a few cross forest migrations, but in 2022 I'd be tempted to sync each OU up to its own tenant, migrate all files and emails to 365, and then stand up a new domain at each site and sync the users back down to the new domains.

 

Even then you might be able to get away with not creating on prem AD and instead move to Intune and Papercut