Domains and Child Domains

Hi guys
Just a bit of advice needed, we have our domain setup (test.com) running 2008 R2 and with 2dcs and all is well running 1200+ users and 500+ computers on the subnet 10.114.4.0/22, we need a branch office setup and want it managed separately with its
own dcs, would it be best to create a child domain (child.test.com) on a new subnet 10.114.8.0/19 or a new forest entirely?
Thanks
Al

I think you will have to define "managed seperately" to be able to give adequate advice.
Microsoft has changed Active Directory in subsequent versions to remove design needs  for more complex setups like subdomains or even forests with trusts by removing limits and adding features to allow proper delegations. For example, teh amount of
objects Ad support has significantly increased, fine-grained pw policy is introduced, delagation has been made easy,...
You should only create another domain if you intend not to manage it from your side and/or do not want resources to be shared and/or connectivity is limited and replication traffic unwanted. Otherwise, in most cases, the proper design would be to define
a new site in the existing domain, put some dc's in there and put its resources (computers, users, groups,...) in a separate OU. You can delegate the management of the OU to admins in the branch office.
This allows for central administration (that can be enforcing), as well as autonomy for the local admins.
Another forest would only be the adequate design if both offices do not have to communicate at all.
http://technet.microsoft.com/en-us/library/cc731718(v=ws.10).aspx
MCP/MCSA/MCTS/MCITP

Similar Messages

  • List of Domains and Child Domains

    I am working in Windows Server 2008 R2 SP1.
    Is there a way to list Domains and Child Domains entered this way:
    http://technet.microsoft.com/en-us/library/cc731541(v=ws.10).aspx

    Hi Philosophiae,
    Please refer to the cmdlet
    Get-ADDomain on server 2008 R2, it will get abundant domain information.
    Best Regards,
    Anna

  • Arbitration mailboxes exist in root and child domains, which to delete?

    Hi,
    I discovered a problem with my Arbitration Mailboxes when setting up a Moderated Distribution group. The moderator wasn't receiving an email from Exchange advising that there was a message that needed to be approved or declined. A bit of digging in Message
    Tracking and the Event log (IDs 9214 & 9217) revealed that the email address for the MS Exchange Approval Assistant exists twice, in both our root and child domains. 
    The question is which to delete, the account in root or child? All of the users are in the child domain so presumably it's the account in root which I should delete, but I'm not 100% sure.
    Any pointers very welcome.
    Cheers.

    Hi,
    Agree with Andy. The arbitration accounts are in the root domain by default. You should delete the account in child domain. Then you can use the Get-Mailbox -Arbitration | fl displayname command to check if you can get this system mailbox in child domain.
    If you can't get this system mailbox in the child domain, you need to run the following command, so that the scope of the search is changed to the forest level.
    Set-ADServerSettings –ViewEntireForest $true
    Best regards,
    Belinda
    Belinda Ma
    TechNet Community Support

  • Replication with Domain and Sub domain in Active directory sites and services

    I seen many AD enviroments and know that when you have mutiple DCs you use Active Directory Sites and services to replicate using the NTDS Settings. If you have a Domain and sub domain do you need to do this as well or does it sync up automatically because
    it's a sub domain? A see a couple of domains where the NTDS settings isn't being used to snyc with the child domain. Just wondering if that is normal or will it cause authentication errors?

    I seen many AD enviroments and know that when you have mutiple DCs you use Active Directory Sites and services to replicate using the NTDS Settings. If you have a Domain and sub domain do you need to do this as well or does it sync up automatically
    because it's a sub domain? A see a couple of domains where the NTDS settings isn't being used to snyc with the child domain. Just wondering if that is normal or will it cause authentication errors?
    Two way transitive trusts are configured automatically when you create a child domain or tree root domain. You don't have to worry about site/subnet or replication part at least from trust perspective. But make sure site's names are unique in each domain.
    How Domain and Forest Trusts Work
    http://technet.microsoft.com/en-us/library/cc773178%28v=ws.10%29.aspx
    http://technet.microsoft.com/en-us/library/cc730868.aspx
    http://blogs.technet.com/b/askds/archive/2008/09/24/domain-locator-across-a-forest-trust.aspx
    Awinish Vishwakarma - MVP
    My Blog: awinish.wordpress.com
    Disclaimer This posting is provided AS-IS with no warranties/guarantees and confers no rights.

  • Affinity goup, availability set and the concept of Update Domain and Fault Domain

    Can 2 VM belonging to the same affinity group, belong to the same
    availability set?
    I have read (http://social.technet.microsoft.com/wiki/contents/articles/7916.importance-of-windows-azure-affinity-groups.aspx)
    Affinity groups are logical abstraction of the physical concept of
    Containers (unit of compute) in Microsoft Datacenters.
    How do then Update Domains and Fault Domains relate to this concept of Container?
    Are there multiple Fault Domains in a Container?
    Thanks,
    Davide
    System and Network Administrator - MCSA security, CCNA, VCP3, VCP4, MCITP Enterprise administrator

    Hi Davide,
    Thanks for posting!
    >>Can 2 VM belonging to the same affinity group, belong to the same
    availability set?
    The answer is no. Base on my understanding, affinity group is to keep your VMs physically closer together within the datacenter. And your 2 VMs may be in one host OS. But if you use the Availability Set,  it could guarantees that your 2 VMs are
    spread across multiple racks in the Windows Azure Data Centers.
    >>How do then Update Domains and Fault Domains relate to this concept of Container?
    >>Are there multiple Fault Domains in a Container?
    For this issue, I recommend you refer to this documents  (http://azure.microsoft.com/en-us/documentation/articles/virtual-machines-manage-availability/
    ) and this blog (http://michaelwasham.com/windows-azure-powershell-reference-guide/understanding_configuring_availability_sets_powershell/
    ). At the same time, you could see this article (http://www.techbunny.com/2013/11/close-but-not-too-close-azure-affinity.html ) for digging deep understanding .
    Hope this helps.
    Regards,
    Will
    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click
    HERE to participate the survey.

  • Active Directory Domain Services Child Domains

    I am using Windows Server 2008 R2 SP1.
    http://technet.microsoft.com/en-us/library/cc771856(v=ws.10).aspx
    When I select "Add Roles" I click on "Active Directory Domain Services (Installed)" the "Next>" button is not enabled and can not be selected.
    Did I install ADDS wrong?
    Is this not how you define Child Domains?
    If I use the Command Line or Answer File Methods I get an error message at "ChildName".
    Did I forget to install something about enabling Child Domains when installing ADDS?

    Hi,
    Did you try to create a child domain on the Domain Controller? It seems like that this Server is already a DC, with Active Directory Domain Services installed.
    We don’t have to enable anything in the root domain for creating child domains/new trees, we just need to run
    Dcpromo or Add Role on another server which is not a DC, and select the existing domain as its parent, then the child domain will be created.
    In addition, please make the existing DC as the preferred DNS server on the new server.
    I hope this helps.
    Amy

  • Manage client in parent domain from child domain

    My site has a root domain (mydomain.net) and a parent domain (ent.mydomain.net).
    My primary SCCM site is installed in ent.mydomain.net and is managing all my clients.
    I have 4 DC's installed in mydomain.net that I would like to manage from my child domain (ent.mydomain.net).
    It is my understanding that if the schema has been extended in the parent domain, and I manually install the client on the DC, it should be able to be managed from the child domain.  
    I have installed the client in the parent, but it cannot find the site in the child (I have not extended the schema yet).  i know that the client will not be able to find the site until the system management container has been created and populated
    (does not currently exist).  I know that I can create the container, but how would it get populated with the correct site information.  
    If anyone has any experience with this kind of configuration, the help would be appreciated.
    Thanks

     i know that the client will not be able to find the site until the system management container has been created and populated (does not currently exist).  I know that I can create the container, but how would it get populated with the
    correct site information.  
    You could enable AD publishing to that domain, but site assignment is also a matter of site assignment boundary groups. You can also assign a client to a site manually though.
    Torsten Meringer | http://www.mssccmfaq.de

  • ContentSubmitters AD group: root domain or child domain???

    Hi
    We have an empty root domain.  Mailbox users & Exchange 2013 servers are in a child domain.
    As per Microsoft's documentation; we want to create the "ContentSubmitters" group in AD for content index to work properly (article 2807668).  However I do not know where to create it!!!  The article doesn't address it.
    Does it go on the root domain where default exchange groups reside OR OR OR OR OR does it go on child domain where exchange servers reside?????
    Thanks

    Hi,
    Agree with Riaz, you need to create the ContentSubmitters group on the domain that Exchange server is installed using Active Directory Users and Computer (ADUC).
    What's more, when you create the active directory security group called ContentSubmitters, follow the steps below to grant Admistrators and NetworkService full access to the group.
    Right click the group -> Properties ->Security tab -> add those two groups -> give them full control to the group.
    Here is a thread for your reference.
    Exchange 2013 Content Catalog Index Failed All Databases
    http://social.technet.microsoft.com/Forums/exchange/en-US/fccf9dca-b865-4356-905b-33ac25dcc44d/exchange-2013-content-catalog-index-failed-all-databases?forum=exchangesvravailabilityandisasterrecovery
    Hope it helps.
    Best regards,
    If you have feedback for TechNet Subscriber Support, contact
    [email protected]
    Amy Wang
    TechNet Community Support

  • User Migration from Parent Domain to Child Domain..The user is enabled with Exchange 2010 Mailbox in Parent Domain

    We currently have a single Windows 2008 R2 Active Directory domain controller, and an Exchange 2010 server. We are in the process of adding a child domain on a second Active Directory server for an offsite office location for a subdivision of our company.
    The two locations will be connected via VPN.
    Currently users exist on the root domain with Exchange accounts who will be moving to the new offsite company/location. We would like to be able to move these user accounts to the child domain while maintaining their existing Exchange mailboxes and
    email addresses. Is this possible, and if so how would we do it?

    Hi Srinivasa,
    According to your description, I think you have done all the preparation.
    For DL migration, the following article may give your some hints:
    How to Migrate Distribution Groups Across a Forest
    Good Luck!
    Niko Cheng
    TechNet Community Support

  • Migrating 2 domains into child domains in a new forest

    I have a unique senario in which my company merged with another. 
    My Company:
    Windows 2003 AD
    Exchange 2003 SP3
    192.x.x.x
    New Company
    Windows 2008 AD
    Exchange 2010
    10.x.x.x
    Each domain has its own resources, servers and workstations.  For political reasons we still need some management seperation. 
    My Goals:
    Create a new root neutral forest/domain. 
    Migrate both domains to 2 child domains under this new root
    Bring the domain to 2012 R2
    Create a single Exchange 2010/2013 cluster with all mailboxes
    What is the best way to accomplish this? Where exactly does Exchange sit?
    Thanks!

    Hi,
    >>What is the best way to accomplish this?
    In Active Directory, we can use ADMT to do the migration. However, if we need Inter-forest migration from Domain Controller 2003 to Domain Controller 2012, at this time MS
    has not ADMT for Windows Server 2012. We can downgrade our forest and Domain functional level to Windows Server 2008 R2, add an additional Domain Controller 2008 R2 and use ADMT 3.2 for migration. After migration is completed, we can demote Domain Controller
    2008 R2 and raise again FFL & DFT to Windows Server 2012.
    Regarding specific procedures for performing the migration, the following article can be referred to as reference.
    Interforest Migration with ADMT 3.2 - Part 1
    http://social.technet.microsoft.com/wiki/contents/articles/11996.interforest-migration-with-admt-3-2-part-1.aspx
    Interforest Migration with ADMT 3.2 - Part 2
    http://social.technet.microsoft.com/wiki/contents/articles/16208.interforest-migration-with-admt-3-2-part-2.aspx
    Interforest Migration with ADMT 3.2 - Part 3
    http://social.technet.microsoft.com/wiki/contents/articles/16621.interforest-migration-with-admt-3-2-part-3.aspx
    >>Where exactly does Exchange sit?
    For mailbox migration, in order to get better help, we can ask for suggestions in the following exchange forum.
    Exchange Server 2013- Setup, Deployment, Updates, and Migration
    http://social.technet.microsoft.com/Forums/exchange/en-US/home?forum=exchangesvrdeploy
    Best regards,
    Frank Shen

  • WLC / ACS / AD - Domain and non-Domain Laptops (802.1X / PEAP)

    Hi All,
    I'm implementing a solution based around 4404 WLC, 1113 ACS and Microsoft AD. What I want to achieve is have two WLAN (SSID), one that can only be used by domain users on domain laptops, the other can be used by domain users on personal laptops. The domain laptops will have full connectivity but the personal laptops will be restricted.
    I've created the two SSID using 802.1X via ACS / Remote Agent and can authenticate and logon OK.
    I thought that I should have user auth and machine auth for the domain laptops but just user auth for personal laptops.
    I can have non authenticated machines go to a specific ACS group or blocked but I need to allow them if they're on the restricted SSID. I can't quite figure out how to have two SSIDs authenticating to the same ACS / AD - allow one and block the other.
    Am I on the right path?
    Anyone done this before or have any bright ideas?
    Cheers,
    John

    With the use of SSID-based WLAN access, the users can be authenticated based on the SSID they use in order to connect to the WLAN. The Cisco Secure ACS server is used to authenticate the users. Authentication happens in two stages on the Cisco Secure ACS:
    1. EAP authentication
    2. SSID authentication based on Network Access Restrictions (NARs) on Cisco Secure ACS
    For the further description and configuraiton following URL may help you :
    http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a00807669af.shtml

  • Workshop domain and regular domain difference in weblogic81sp3

    1) From what I read, if you use workshop developed an app with Web Services proj, you would need a workshop enabled domain to host the app(.ear).
    2) if so, do I HAVE to run config wizard on the acturall production box(s) to create the workshop domain? We are currently deploying our 7.0 app using this approach, which pre-build the whole domain directory with prod configuration in it, and then push it to prod boxes. By pre-build, we use a staging box where we run our ant tasks to build a domain that has applications, config.xml, e.t.c in it. and then the whole domain is being pushed out to all production boxes. So, can i still do the same with the workshop domain? of course, i will need to use the wizard to create a template workshop domain, and modify that for our new workshop domain.
    Please, anyone, let me know if this is still doable with this new workshop domain.
    thanks
    yuan

    WRONG place !!!! i will repost it to the right place

  • Webserver domains and sub-domains not loading correctly

    I'm having a problem with my pages loading correctly on my Maverick server.
    www.example.com loads correctly
    example.com loads to the website at the top of my virtual domain list.
    Weird but happens on all my virtual sites...
    http://www.richard-bradley.com loads fine
    http://richard-bradley.com loads to another virtual domain at the top of my list...?
    Any advice would be appreciated...

    This sound like a DNS thing.
    Whats the Primary Zone in your DNS? In the DNS config page click the cog at the boom to show All Records
    I sound like the primary zone is www.richard-bradley.com and it needs to be richard-bradley.com
    But can you confirm this for me to make sure I understand.
    You have primary site www.example.com and anyone visiting it get served data "A"
    You have a virtual site example.com and and you set it to serve data "B" but when someone visits they get data "A"
    Am I getting that right?

  • CUP AD domain and email domain

    Hi,
    I'm installing CUP 8.6 and CUCM 8.6 with AD and Exchange 2010 schedule integration.
    AD domain is domain.local, so user ID is [email protected]
    but email domain is customer.com, so mail address is [email protected]
    When we configure email address domain  in AD same as AD domain
    schedule integration works just fine.
    AD user: [email protected]
    user email in AD: [email protected]
    However, when we change AD email adress to email domain
    it doesn't sync shcedule anymore.
    AD user: [email protected]
    user email in AD: [email protected]
    From my reading and test,
    I noticed CUPS use the AD email ID to fetch the schedule from Exchange;
    it doesn't see the account name, so if I configure like following, userA CUPC shows userB shcedule.
    AD user: [email protected]
    user email in AD: [email protected]
    Now, if I change "BusinessEMail" to "otherMailbox" from Application -> Cisco Unified Personal Communicator -> Settings.
    and configure like following, schedule works fine, and CUPC user email shown properly.
    AD user: [email protected]
    user email in AD: [email protected]
    user otherMailbox in AD: [email protected]
    However, the email in AD will be incorrect address,
    and this field will be refered by other systems, so I don't wan't to change.
    Is there any way to configure CUPS to refer "otherMailbx" for scheduling?
    Or any other workaround?
    Thanks in advance.
    Regards,

    The nearest I can see that you would get to this using .Mac is - [email protected]@mac.com.
    You would be creating an alias in Mac Mail preferences and directing this to your Mac mail. You have the option to color code all messages to this "alias". so that they stand out from your regular mail.
    If you publish to a commercial server you will be able to have the email address that you want.
    If you are running a commercial site you more or less have to do this. .Mac is not reliable enough, nor fast enough for a commercial site and, apparently, we are not allowed to use it for that purpose.
    Having said that, if you do, you will not be alone!
    I don't run any commercial sites from .Mac for the reasons given plus a few more but you only have to look at some of the sites showcased in this forum to see that a lot of people do.

  • AD User Cannot reset their password on Child Domain

    I have windows server 2008r2 which is my Parent Domain and child domain on windows server 2003. All my users on Child domain stuck on resetting their password
    and following error message appears 
    "The password does not meet the password
    policy requirements"
    Although I have not applied any password policy, don't know why this error message is appearing.
    Please help...

    Hi,
    In addition to the above information, you can check the resultant password policy settings applied for an AD user account by following the below steps,
    - Login to a client machine as AD user
    - Go to Start -> Run -> Type RSPO.msc.
    - In the RSOP console, navigate to the node Computer Configuration\ Windows Settings\ Security Settings\ Account Policies\ Password Policy.
    - In Password Policy page, you can confirm, what is the current password settings applied to that AD user.
    - Now based on the password policy settings you can try to change the password.
    Regards,
    Gopi
    JiJi
    Technologies

Maybe you are looking for