Hi
Inline
Post by PhilTealeI would like to create a new structure where all the current domains
are trees in a single forest. I feel that this will provide a more
manageable environment and one where we can assign trusts etc more
easily and more reliably.
Are you sure?
Do you need different namespaces?
Do you have different security needs?
Do you know that this type of config increases the hardware costs and the
Administrative work, more complex DNS structure,etc?
Post by PhilTealeI have built a replica of our current domain structure in a test
environment and am now ready to get cracking, I had thought that I
could accomplish what I am after by using rendom, but this isn't able
to do this becasue the total number of number of domains in the forest
before and after any moves or renames must be the same.
Before considering a domain rename you should be aware of the consequences
of that action.
Domain Rename can be a complicate process depending on your network/forest
environment.
A domain rename will affect every domain controller in your forest and is a
thorough multistep process that requires a detailed understanding of the
operation. Before considering a Domain rename check the some documentation
and some of the most important topics:
Support WebCast: Microsoft Windows Server 2003: Implementing an Active
Directory Domain Rename Operation
http://support.microsoft.com/default.aspx?scid=kb;EN-US;819145
Windows Server 2003 Active Directory Domain Rename Tools and guides
http://www.microsoft.com/technet/downloads/winsrvr/domainrename.mspx
How Domain Rename Works
http://technet2.microsoft.com/WindowsServer/en/Library/4d0c3b6e-e6f5-4ab3-9d81-106ae3a715491033.mspx?mfr=true
--------------------------------
Check:
- Setup a Lab and test all procedures before going to Domain rename on
production environment. Test a recovery process in case of something goes
wrong.
- Perform a full system state backup of all domain controllers in the
forest.
- Document your entire forest.
- You may have to delete and recreate existent trusts.
--------------------------------
- The following conditions are required to be in effect before you can begin
a domain rename procedure:
*Active Directory forest functional must be set to Windows Server 2003.
*The domain rename procedure requires Enterprise Admins privileges to
perform the various steps in the procedure.
*DFS root servers: In order to be able to rename a domain with domain-based
DFS roots, all DFS root servers must be running Windows 2000 with Service
Pack 3 or a higher release of the Windows server.
*A computer running any edition of Windows Server 2003 that is to be used as
the control station during a domain rename operation
--------------------------------
- Before undertaking a domain rename operation, it is imperative that you
fully understand the following conditions and effects that are inherent in
the process and that you are willing and able to fully accommodate them:
*The forest is out of service for a short period of time. Forest service is
interrupted during the time it takes for each domain controller to perform
the directory database updates that are necessary for the domain rename and
to then reboot.
*All domain controllers must either complete the domain rename operation
successfully or be eliminated from the forest.
*Each member computer that is joined to a renamed domain must be rebooted
twice after all domain controllers are updated. Computers running Windows NT
4.0 must be unjoined and then rejoined to the renamed domain instead of
being rebooted
*If you want DNS host names of domain controllers to match a new domain
name, you must perform domain controller rename procedures after the domain
rename operation is complete. The DNS host names of domain controllers are
not changed automatically by the domain rename operation to reflect the new
domain name. In other words, the primary DNS suffix of a domain controller
will not match the new domain DNS name after the domain has been renamed.
*Having the host name of a domain controller decoupled from its domain name
has no impact on forest service. However, domain controller rename requires
a separate, multistep procedure after the domain rename operation is
complete.
*The DNS suffix of host names for member computers in a domain that is being
renamed might not match the new DNS name of the domain for a period of time.
By default, the DNS suffix portion of member computer names is updated
automatically when the domain to which the computers are joined changes (as
happens when you rename a domain). In general, the period of time during
which the DNS name of the domain does not match the DNS suffix of member
computer names is proportional to the number of computers in the domain. In
some cases, you might want to configure the computers to keep the computer
names from being updated automatically.
*If you want DNS host names of domain controllers to match the new domain
name, you must perform domain controller rename procedures following domain
rename. The DNS host names of the domain controllers are not changed
automatically by the domain rename operation to reflect the new domain name.
--------------------------------
- Although a Windows Server 2003 forest has forest restructuring capability,
certain types of structural changes are not supported.
- In a Windows Server 2003 forest, you cannot:
*Change which domain is the forest root domain. Changing the DNS or the
NetBIOS name of the forest root domain, or both, is supported.
*Drop domains from the forest or add domains to the forest. The number of
domains in the forest before and after the rename/restructure operation must
remain the same.
*Rename a domain with the same name that another domain gave up in a single
forest restructure operation.
--------------------------------
- And if you have Exchange Server in your forest?
*Exchange 2003 SP1: If your Active Directory forest contains only Exchange
2003 SP1 servers, you can run the domain rename operation, but you must also
use the Exchange Domain Rename Fix-up Tool to update Exchange attributes.
*Domain rename does not rename e-mail domains
*Domain rename doesn't change any e-mail domain in Exchange doesn't change
any recipient policy. *You must change your recipient policy after domain
rename.
*Domain rename does not rename the Exchange Organization
*You cannot rename the Exchange Organization with the domain rename tool.
*Domain rename does not merge Exchange Organizations
*It is not possible with domain rename to merge two Exchange organizations
into a single Exchange organization.
*The account you use must also have Full Exchange Administrator permissions.
*Exchange 2003 is required
*The domain rename tools are supported in Exchange 2003; all Exchange
servers in the organization must be running Exchange 2003.
* The domain rename operation is not supported in an Active Directory forest
that contains Exchange 2000 or Exchange 5.5 servers.
*Exchange must not be installed on domain controllers (. If a domain
controller is running Exchange, move the Exchange data off of the domain
controller and uninstall Exchange.
Exchange Links:
TechNet Support WebCast: Renaming domains when Microsoft Exchange Server
2003 is in the Active Directory
http://support.microsoft.com/default.aspx?scid=kb;en-us;838623
Downloads for Exchange Server 2003
http://www.microsoft.com/technet/prodtechnol/exchange/downloads/2003/default.mspx
Supplemental steps for using the Exchange Server Domain Rename Fixup tool
together with the Windows Server 2003 domain rename tools
http://support.microsoft.com/?id=842116
Domain Rename - Rename a Windows 2003 Forest with Exchange 2003 installed
http://www.msexchange.org/tutorials/Domain-Rename.html
Microsoft Exchange Server Domain Rename Fixup (XDR-Fixup)
http://www.microsoft.com/downloads/details.aspx?FamilyId=24B47D4A-C4B9-4031-B491-29839148A28C&displaylang=en
Exchange System Attendant does not start after you rename a Windows Server
2003 domain
http://support.microsoft.com/?id=822590
--------------------------------
- And CAs what's Up?
- Management of enterprise certificates can continue during a domain rename
procedure when the following requirements are in effect before domain
rename:
*The CAs are not installed on domain controllers.
*As a best practice, all the CAs should include both Lightweight Directory
Access Protocol (LDAP) and Hypertext Transfer Protocol (HTTP) Uniform
Resource Locators (URLs) in their Authority Information Access (AIA) and
certificate revocation list (CRL) distribution point extensions.
*Note
If any certificate that is issued by a CA has only one of these URL types,
the certificate may or may not work. Depending on the complexity of your
domain configuration, the steps described in the "Step-by-Step Guide to
Implementing Domain Rename" (in Windows Server 2003 Domain Rename Tools)
might not be sufficient for proper management of CAs after the domain rename
operation. Anyone who undertakes domain rename in an environment that uses
certificates must have considerable expertise in managing Microsoft CAs.
- If one or more of the following conditions exist at the time of domain
rename, CA management is not supported:
*The CA is configured to have only LDAP URLs for its CRL distribution point
or AIA. Because the old LDAP extensions are invalid after the domain rename
operation, all the certificates that are issued by the CA are no longer
valid. As a workaround, you have to renew the existing CA hierarchy and all
issued End Entity certificates.
*An interdomain trust relationship is based on cross-certification with name
constraints. After the domain rename operation, the name constraints might
not be valid. As a workaround, you have to reissue cross-certificates with
appropriate name constraints.
*An e-mail name in the style of Request for Comments (RFC) 822, "Standard
for the Format of ARPA Internet Text Messages," is used in the Active
Directory user account. If the CA (or the certificate template) is
configured to include RFC 822-type e-mail names and this e-mail name style
is used in the certificates that are issued, these certificates will contain
an incorrect e-mail name after a domain rename operation. You should change
any such Active Directory user accounts before any certificates are issued.
--
I hope that the information above helps you
Good Luck
Jorge Silva
MCSA
Systems Administrator
Post by PhilTealeHi
I'm hoping someone will be able help; I have decided that I would like
to restructure our Active Directory, which currently consists of
multiple domains each in their own forest. This structure has arisen
through not having real plan when it comes to customer projects (each
of which usually requires its own AD for users, computers, security
etc).
I would like to create a new structure where all the current domains
are trees in a single forest. I feel that this will provide a more
manageable environment and one where we can assign trusts etc more
easily and more reliably.
I have built a replica of our current domain structure in a test
environment and am now ready to get cracking, I had thought that I
could accomplish what I am after by using rendom, but this isn't able
to do this becasue the total number of number of domains in the forest
before and after any moves or renames must be the same.
So, my question is, has anyone else done what I would like to do?
Also, what tools did people use to do it?
Thanks for reading this and I hope someone will be able to point me in
the right direction.
Cheers
Phil