Moving to new domain - advice please.

[Number6]

Morning!

 

In parallel with my other thread today regarding export - import of Exchange data.

 

I want to make sure that I have all i's dotted and t's crossed before we hit the go button next Monday.

 

We're migrating everyone and everything to a new domain as follows:

 

EXISTING SITUATION

 

SBS2003 - apart from it's DC and Exchange duties it runs WSUS and that's it

 

1 x Member Server 2008 box running SIMS & Sophos & some file storage. Also acts as a secondary DC

 

1 x NAS box running Storage Server 2003 - file server. This holds all the users home folders and other data, nothing is stored on local PCs.

 

1 x Server 2003 print server

 

~100 client PCs - mainly W7 with a few legacy XP machines

 

85 users with mailboxes

 

MOVING TO THIS SCENARIO

 

1 x Brand New Server 2008 R2 Ent DC

 

1 x Brand New Server 2008 R2 Ent running Exchange 2010 Ent

 

PLUS

 

The 2008 and 2 x 2003 servers in the current scenario.

 

All user accounts have been created on the new DC and mailboxes created on the Exchange Server with same names and logins as originally used.

 

So my plan is to export the Exchange data with Exmerge onto the NAS box, demote the Secondary DC and remove all servers and PCs from the current domain into a workgroup.

 

Add all machines into new domain.

 

Import old Exchange data into new 2010 server.

 

It all *seems* relatively straightforward, however, one of my concerns is data ownership. How can I ensure that the users will be able to access their data? Ownership will have been conferred under the old domain and the SIDs will be different for the newly created users, presumably I will need to transfer ownership of the files to the "new" users but how can I best achieve this?

 

Do I need to take local admin ownership of the server data once the servers are unjoined from the old domain, or do I need to take local admin ownership of the client PC C-drives, or both? How would I achieve this?

 

Apart from the Exchange export and import, data ownership is my biggest concern; I don't want to set everything back up only to find that users can't access their data.

 

Advice would be most welcome at this chewing-fingernails stage please

[Number6]

Also, will I need to change ownership or permissions of the .pst files created by exmerge?

[glennda]

Also, will I need to change ownership or permissions of the .pst files created by exmerge?

 

I think when i was involved in doing this we didn't - but not 100% sure.

 

Your data concern's shouldn't be a problem. If you set the file paths in ad for the users home dir's AD should then grant the correct permissions.

 

Only bit that could be tricky is if you have any shared areas.

[Number6]

We do have shared areas on the NAS box and on the SIMS server.

[glennda]

We do have shared areas on the NAS box and on the SIMS server.

 

depending on how you have the file permissions setup - here we have each subject only has access to each subjects folder - so that could be a pain resetting file permissions etc.

 

Sims server is pretty easy to move - just need to change the permissions on the share (I would suggest a group say sims staff and add each member of staff that uses sims to that group)

[Number6]

Yes, that sounds logical re: SIMS

 

Unfortunately our shared folders are shared by just about everyone.

[psydii]

Hmm.

 

Have a quick skim of the Active Directory Domain Migration Tool documentation:

http://www.microsoft.com/downloads/en/details.aspx?familyid=6f86937b-533a-466d-a8e8-aff85ad3d212&displaylang=en

 

and maybe the Fileserver Migration tool as well:

Windows Server 2008 R2: Microsoft File Server Migration

 

and for the Exchange move I'd use move-mailbox rather than exmerge avoiding the problematic .pst phase.

How to Move a Mailbox Across Forests: Exchange 2007 Help

[psydii]

Oh and do you have an absolutely bullet proof roll back plan and authorisation to raise a support calls with microsoft and or other vendors just in case things go sideways?

 

The roll back plan can be tested quite easily: if you can build a replica of your live servers in a virtual machine, then it works. Added bonus you've now got an environment from which you can fully test the migration.

[Number6]

The roll-back plan is to plug the SBS box back in and reset everything

 

Other than that we can't physically move the mailboxes because we don't intend to have old and new servers co-existing at all. We need to export the mail data to a neutral zone and then import it later.

[Jon]

Why are you creating a new domain, is it because you need to have a different domain name?

 

you could save yourself a lot of work by adding your new servers to the existing domain and retiring the old ones.

[Number6]

Why are you creating a new domain, is it because you need to have a different domain name?

 

you could save yourself a lot of work by adding your new servers to the existing domain and retiring the old ones.

 

I know.

 

But we've had a lot of strange problems with the SBS box. It was installed before my time here and has never been right. We don't want to risk importing any AD problems so we're starting from scratch.

[psydii]

I'm not at all sure why you can't have the SBS and the new exchange box running at the same time to allow for a move-mailbox, but you're happy with the exmerge route so I'll shut up about it.

 

For the shared areas problem we used this tool

Download details: SubInACL (SubInACL.exe)

 

caveat: this was during a w2k3 -> w2k3 migration. I haven't tested in a w2k8 environment, though a very quick google suggest there should not be any issues as your NAS is 2k3.

[glennda]

I'm not at all sure why you can't have the SBS and the new exchange box running at the same time to allow for a move-mailbox, but you're happy with the exmerge route so I'll shut up about it.

 

For the shared areas problem we used this tool

Download details: SubInACL (SubInACL.exe)

 

caveat: this was during a w2k3 -> w2k3 migration. I haven't tested in a w2k8 environment, though a very quick google suggest there should not be any issues as your NAS is 2k3.

 

because it is two separate domains that you don't want talking to each other - exchange can't swap domains easily

[psydii]

because it is two separate domains that you don't want talking to each other - exchange can't swap domains easily

Since the NAS and all the clients are moving across without being rebuilt, I don't really see why they can't, other than the quite reasonable "that's how the plan is and at this stage changing this part so completely would be high risk with little/no benefit" and "psydii is making a tit of himself with his move-mailbox talk, in 2010 it's New-MoveRequest".

 

I'm going to take your "exchange can't swap domains easily" comment out of the context of the preceding sentence for a moment: While true that you can't move and Exchange installation between forests, you also can't do an in place upgrade from 2003-2010. New-MoveRequest is the recommended tool (move-mailbox was for 2007 only). It can quite easily move mail boxes between domains/forests where there exists only a layer 3 route, suitable open ports and an system administrator who knows suitable Admin passwords to both domains.

 

I only return to this point to correct my mis-information posted above.

[Number6]

because it is two separate domains that you don't want talking to each other - exchange can't swap domains easily

 

Exactly so.

 

Even if we could, we simply do not want the SBS box to be connected once the new servers go live. Paranoid I know, but we've had too many strange AD related problems with it and i don't want even the slightest risk of any issues being imported into the new AD structure.

[Number6]

I'm not at all sure why you can't have the SBS and the new exchange box running at the same time to allow for a move-mailbox, but you're happy with the exmerge route so I'll shut up about it.

 

For the shared areas problem we used this tool

Download details: SubInACL (SubInACL.exe)

 

caveat: this was during a w2k3 -> w2k3 migration. I haven't tested in a w2k8 environment, though a very quick google suggest there should not be any issues as your NAS is 2k3.

 

I have used subinacl previously, it's a good tool.

 

One of our users lost access to her home folder recently, it was a permission denied problem that cropped up for no apparent reason. Subinacl sorted it without fuss.

[Number6]

Another question:

 

Is there any need to do anything other than remove all client PCs and servers out of the old domain and into a workgroup?

 

One of our ICT people suggested that I need to give local admin ownership of the C$ share on all machines. Do I need to do this?

[psydii]

It has this by default. If it has been configured differently, figure out why. My gut tells me that stuff will break during your migration if OLDDOMAIN\Domain Admins are the only accounts that can properly control a machine.

 

Some more things that I'd investigate before the migration:

• Have you considered the effect of changing GPO scope will have on your machines? If use GPO Software Installation you may loose the ability to use GPOSI to uninstall applications if you loose the original GPO that installed it.
  
• Will the paths to the msi's remain the same? If the msi was on a network share and the client has not cached the install files, you will not be able to unistall/repair or patch previously deployed applications properly if that UNC path is not available.
  
• Is the av update account a domain account or Local account? Is the AV Server changing significantly?
  
• moving between WSUS servers doesn't always go well and sometimes you need to reset the SoftwareDistribution folder.
  
• W7 uses Offline files a lot. I believe permissions to them are tied to user SIDs. Have you tested the impact to users trying to access files in the client side cache once they are in the new domain?
  
• Do any machine local groups contain domain members? This can lead to STOP errors (certainly in XP, haven't much experience with Vista/7) if they remian after a machine has left a Domain.
  
• Do any ACE's on client devices reference Domain accounts? This can lead to delays in certain UI features, possibly other unexpected effects to.
  
• Has your Web Filtering product been tested against the new domain? (I believe there can be gotchas with the increased level LDAP security in W2K8)
  
• Do you have any Enterprise certificates? You will get warnings in your logs if they remain on the clients once the old CA goes.
  

Edited December 15, 2010 by psydii
tidying up layout

[Number6]

It has this by default. If it has been configured differently, figure out why. My gut tells me that stuff will break during your migration if OLDDOMAIN\Domain Admins are the only accounts that can properly control a machine.

 

Have you considered the effect of changing GPO scope will have on your machines?

Will the paths to the msi's remain the same?

Is the av update account a domain account or Local account? Is the AV Server changing significantly?

moving between WSUS servers doesn't always go well and sometimes you need to reset the SoftwareDistribution folder.

W7 uses Offline files a lot. I believe permissions to them are tied to user SIDs. Have you tested the impact be users trying to access files in the client side cache once they are in the new domain?

Do any machine local groups contain domain members? This can lead to STOP errors (certainly in XP, haven't much experience with Vista/7) if they remian after a machine has left a Domain.

Do any ACE's on client devices reference Domain accounts? This can lead to delays in certain UI features, possibly other unexpected effects to.

Has your Web Filtering producted been tested against the new domain? (I believe there can be gotchas with the increased level LDAP security in W2K8)

Any Enterprise certificates? You will get warning galore if they remain on the clients once the old CA goes.

 

Your gut matches with my gut

 

I've been given next to no support over this by line management, except for platitudes stating it won't be an issue. I'm flying by the seat of my pants on this one.

 

I have a strict four working day window in which to do this, and that includes strpping down the cabs, modifying them, installing new UPS', etc, as well as the actual domain migration work.

 

I'm trying to deal with issues as they arise in my mind but, like you, I'm convinced it'll all go pear shaped for lots of reasons. And no fingernails left to chew!

[psydii]

Do you really have to do whole migration in this window?

 

Either way, if you haven't already, spin yourself up a virtual environment with a 'bare metal' restore of your two domains and a client. Then run through the migration testing all the aspects that concern you.

 

At worst you might discover a show-stopper (for example it can be done in the time available), saving you the stress and grey hairs over the Christmas break.

On the other hand you may only find a couple of minor trip hazards, and you can stop worrying as you then *know* it will work.