Setting up second AD domain

[sideone]

Hi all,

 

We're currently merging trusts and we're looking to rename / replace the AD domain that our users sign in to, and then sync those users to our existing M365 tenancy. It's tricky to find comprehensive documentation but as I understand:

 

Option 1 - second domain

- Create new VM server, promote to DC

- Create new domain on this new DC called the new name

- Create two way trust with old DC

- Add the second AD domain to Entra Connect to allow new users to sync

- Slowly migrate users and devices from old domain to new one, keeping both in place until all are moved

 

Option 2 - rename existing domain

- Use rendom to rename the existing domain whilst keeping old users & devices in place

 

Option 2 sounds more prone to errors, but is there anything that I've missed? Any good documentation on option 1?

 

Thanks

[DavR]

I'd probably go for option 1, create a new domain. Like you say, less likely to be problematic, and it's a good chance to lose any baggage you may have in the existing domain. Do you have the option of maybe moving all devices and users over in the school holidays, eg, Easter break? Get it all done in one go.

 

The other option of course is to take this moment to drop active directory completely, and go fully cloud based with Intune. But I know that's not for everyone. 

[sideone]

1 minute ago, DavR said:

I'd probably go for option 1, create a new domain. Like you say, less likely to be problematic, and it's a good chance to lose any baggage you may have in the existing domain.

Yeah, agreed. Are there any gotchas for creating a second domain on the same host and network? I don't want to stop our current AD from working whilst setting up the second.

[DavR]

I don't think there's any gotchas off the top of my head, but, you'll want to be careful with DHCP and DNS. I'd recommend, as well as putting a trust in place, you also put secondary DNS zones from each domain onto the other.

 

OldDC --> Primary DNS DomainA, Secondary DNS DomainB

NewDC --> Primary DNS DomainB, Secondary DNS DomainA

 

You can then configure your DHCP server to hand out both domain's DNS servers, and then everything should be able to see each other.

[Roberto]

11 minutes ago, sideone said:

Are there any gotchas for creating a second domain on the same host and network? I don't want to stop our current AD from working whilst setting up the second.

 

You can have multiple domains on the same network (DavR's comments here are useful). 

I'm a little concerned about your "same host" comment. If you're virtualising, you can have separate virtual servers on the same physical bit of tin, however you cannot have one DC be a DC for multiple domains. If you need to manage multiple domain names in a single environment then you really should be looking at cloud-first Entra ID type integrations, which can support several hundred custom domains on a tenant. Not sure of the exact number but I can see 200-and-something configured and working happily on mine.

[sideone]

2 minutes ago, Roberto said:

I'm a little concerned about your "same host" comment. If you're virtualising, you can have separate virtual servers on the same physical bit of tin, however you cannot have one DC be a DC for multiple domains

Yes, I meant separate virtual servers on the same physical machine.