Migrating 2 domains into child domains in a new forest

I have a unique senario in which my company merged with another.
My Company:
Windows 2003 AD
Exchange 2003 SP3
192.x.x.x
New Company
Windows 2008 AD
Exchange 2010
10.x.x.x
Each domain has its own resources, servers and workstations. For political reasons we still need some management seperation.
My Goals:
Create a new root neutral forest/domain.
Migrate both domains to 2 child domains under this new root
Bring the domain to 2012 R2
Create a single Exchange 2010/2013 cluster with all mailboxes
What is the best way to accomplish this? Where exactly does Exchange sit?
Thanks!

Hi,
>>What is the best way to accomplish this?
In Active Directory, we can use ADMT to do the migration. However, if we need Inter-forest migration from Domain Controller 2003 to Domain Controller 2012, at this time MS
has not ADMT for Windows Server 2012. We can downgrade our forest and Domain functional level to Windows Server 2008 R2, add an additional Domain Controller 2008 R2 and use ADMT 3.2 for migration. After migration is completed, we can demote Domain Controller
2008 R2 and raise again FFL & DFT to Windows Server 2012.
Regarding specific procedures for performing the migration, the following article can be referred to as reference.
Interforest Migration with ADMT 3.2 - Part 1
http://social.technet.microsoft.com/wiki/contents/articles/11996.interforest-migration-with-admt-3-2-part-1.aspx
Interforest Migration with ADMT 3.2 - Part 2
http://social.technet.microsoft.com/wiki/contents/articles/16208.interforest-migration-with-admt-3-2-part-2.aspx
Interforest Migration with ADMT 3.2 - Part 3
http://social.technet.microsoft.com/wiki/contents/articles/16621.interforest-migration-with-admt-3-2-part-3.aspx
>>Where exactly does Exchange sit?
For mailbox migration, in order to get better help, we can ask for suggestions in the following exchange forum.
Exchange Server 2013- Setup, Deployment, Updates, and Migration
http://social.technet.microsoft.com/Forums/exchange/en-US/home?forum=exchangesvrdeploy
Best regards,
Frank Shen

Similar Messages

List of Domains and Child Domains

I am working in Windows Server 2008 R2 SP1.
Is there a way to list Domains and Child Domains entered this way:
http://technet.microsoft.com/en-us/library/cc731541(v=ws.10).aspx

Hi Philosophiae,
Please refer to the cmdlet
Get-ADDomain on server 2008 R2, it will get abundant domain information.
Best Regards,
Anna

User Migration from Parent Domain to Child Domain..The user is enabled with Exchange 2010 Mailbox in Parent Domain

We currently have a single Windows 2008 R2 Active Directory domain controller, and an Exchange 2010 server. We are in the process of adding a child domain on a second Active Directory server for an offsite office location for a subdivision of our company.
The two locations will be connected via VPN.
Currently users exist on the root domain with Exchange accounts who will be moving to the new offsite company/location. We would like to be able to move these user accounts to the child domain while maintaining their existing Exchange mailboxes and
email addresses. Is this possible, and if so how would we do it?

Hi Srinivasa,
According to your description, I think you have done all the preparation.
For DL migration, the following article may give your some hints:
How to Migrate Distribution Groups Across a Forest
Good Luck!
Niko Cheng
TechNet Community Support

Administrator in parent domain has no administrator rights when logging into child domain systems.

We have a simple layout, parent domain in the office is foo.com, I've adding a child domain in the datacenter called prod.foo.com (we have machines with the same names in the office and production, not my doing :p) Prior to this all of our production
machines were standalone and various users just had the local administrator account, which has led to some problems.
Anyway, on to my issue;
I have a security group in foo.com called Production Logins that I've added myself to, and on the test windows 2003 server I've allowed FOO\Production Logins the ability to remote desktop, and I'm able to remote into the box web01.prod.foo.com
just fine, however; When I log into web01.prod.foo.com under my admin account in the parent domain, I only have basic user rights on that machine, not administrator rights. Shouldn't administrator rights carry over to the child domain for
my account? Is there something specific I need to do to allow that?

Hi,
To
do what
the friend
said
above you need
to configure
restricted groups
GPO
More
information:
http://www.windowsecurity.com/articles/Using-Restricted-Groups.htmlMCP, MCDST e MCSA 2003

Active Directory Domain Services Child Domains

I am using Windows Server 2008 R2 SP1.
http://technet.microsoft.com/en-us/library/cc771856(v=ws.10).aspx
When I select "Add Roles" I click on "Active Directory Domain Services (Installed)" the "Next>" button is not enabled and can not be selected.
Did I install ADDS wrong?
Is this not how you define Child Domains?
If I use the Command Line or Answer File Methods I get an error message at "ChildName".
Did I forget to install something about enabling Child Domains when installing ADDS?

Hi,
Did you try to create a child domain on the Domain Controller? It seems like that this Server is already a DC, with Active Directory Domain Services installed.
We don’t have to enable anything in the root domain for creating child domains/new trees, we just need to run
Dcpromo or Add Role on another server which is not a DC, and select the existing domain as its parent, then the child domain will be created.
In addition, please make the existing DC as the preferred DNS server on the new server.
I hope this helps.
Amy

Domains and Child Domains

Hi guys
Just a bit of advice needed, we have our domain setup (test.com) running 2008 R2 and with 2dcs and all is well running 1200+ users and 500+ computers on the subnet 10.114.4.0/22, we need a branch office setup and want it managed separately with its
own dcs, would it be best to create a child domain (child.test.com) on a new subnet 10.114.8.0/19 or a new forest entirely?
Thanks
Al

I think you will have to define "managed seperately" to be able to give adequate advice.
Microsoft has changed Active Directory in subsequent versions to remove design needs for more complex setups like subdomains or even forests with trusts by removing limits and adding features to allow proper delegations. For example, teh amount of
objects Ad support has significantly increased, fine-grained pw policy is introduced, delagation has been made easy,...
You should only create another domain if you intend not to manage it from your side and/or do not want resources to be shared and/or connectivity is limited and replication traffic unwanted. Otherwise, in most cases, the proper design would be to define
a new site in the existing domain, put some dc's in there and put its resources (computers, users, groups,...) in a separate OU. You can delegate the management of the OU to admins in the branch office.
This allows for central administration (that can be enforcing), as well as autonomy for the local admins.
Another forest would only be the adequate design if both offices do not have to communicate at all.
http://technet.microsoft.com/en-us/library/cc731718(v=ws.10).aspx
MCP/MCSA/MCTS/MCITP

Manage client in parent domain from child domain

My site has a root domain (mydomain.net) and a parent domain (ent.mydomain.net).
My primary SCCM site is installed in ent.mydomain.net and is managing all my clients.
I have 4 DC's installed in mydomain.net that I would like to manage from my child domain (ent.mydomain.net).
It is my understanding that if the schema has been extended in the parent domain, and I manually install the client on the DC, it should be able to be managed from the child domain.
I have installed the client in the parent, but it cannot find the site in the child (I have not extended the schema yet). i know that the client will not be able to find the site until the system management container has been created and populated
(does not currently exist). I know that I can create the container, but how would it get populated with the correct site information.
If anyone has any experience with this kind of configuration, the help would be appreciated.
Thanks

i know that the client will not be able to find the site until the system management container has been created and populated (does not currently exist). I know that I can create the container, but how would it get populated with the
correct site information.
You could enable AD publishing to that domain, but site assignment is also a matter of site assignment boundary groups. You can also assign a client to a site manually though.
Torsten Meringer | http://www.mssccmfaq.de

ContentSubmitters AD group: root domain or child domain???

Hi
We have an empty root domain. Mailbox users & Exchange 2013 servers are in a child domain.
As per Microsoft's documentation; we want to create the "ContentSubmitters" group in AD for content index to work properly (article 2807668). However I do not know where to create it!!! The article doesn't address it.
Does it go on the root domain where default exchange groups reside OR OR OR OR OR does it go on child domain where exchange servers reside?????
Thanks

Hi,
Agree with Riaz, you need to create the ContentSubmitters group on the domain that Exchange server is installed using Active Directory Users and Computer (ADUC).
What's more, when you create the active directory security group called ContentSubmitters, follow the steps below to grant Admistrators and NetworkService full access to the group.
Right click the group -> Properties ->Security tab -> add those two groups -> give them full control to the group.
Here is a thread for your reference.
Exchange 2013 Content Catalog Index Failed All Databases
http://social.technet.microsoft.com/Forums/exchange/en-US/fccf9dca-b865-4356-905b-33ac25dcc44d/exchange-2013-content-catalog-index-failed-all-databases?forum=exchangesvravailabilityandisasterrecovery
Hope it helps.
Best regards,
If you have feedback for TechNet Subscriber Support, contact
[email protected]
Amy Wang
TechNet Community Support

New deploy child domain certificate server didn't publish root trust certificate to the client

Child domain certificate didn't install into child domain workstation.
https://support.microsoft.com/en-us/kb/281271?wa=wsignin1.0
Certification Authority configuration to publish certificates in Active Directory of trusted domain
Any advise?
Thanks.

Hi,
>>New deploy child domain certificate server didn't publish root trust certificate to the client
Is this an enterprise root CA or standalone CA?
If it is an enterprise root CA, it will automatically use Group Policy to propagate its certificate to the Trusted Root Certification Authorities certificate store for all users and computers in the domain. If it is an standalone CA, we can configure GPO
to distribute the certificate.
Regarding how to use policy to distribute certificates, the following article can be referred to for more information.
Use Policy to Distribute Certificates
https://technet.microsoft.com/en-us/library/cc772491.aspx
We can run command gpupdate/force to immediately update group policy and then we can refresh the certificates in certmgr.msc to see if the certificate will come up.
Besides, for certificate questions, we can also ask for suggestions in the following forum.
Security
https://social.technet.microsoft.com/Forums/windowsserver/en-US/home?forum=winserversecurity
Best regards,
Frank Shen
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

File associations are lost when user account is migrated from one domain to another domain (SID changes)

Hello,
Currently we are in the middle of a migration project. We are migrating users from child domains to the root domain of one organization.
The user accounts are migrated with powershell using Move-ADObject cmdlet. This works as expected. The SIDHistory attribute is updated correctly.
Recently we received complaints from some *migrated* users - they lost their default/custom file associations. This happens only on Windows 8/Windows 8.1.
What happens:
the user is migrated and logs on
her profile loads and everything's preserved (as expected)
the user clicks on a .jpeg file (previously associated with program XYZ)
OS asks the user to choose a program to open the file with
the user chooses a default program XYZ and the file opens
when the user clicks on a .jpeg file again - OS asks to choose a program again
i.e. the settings are not preserved.
Our investigation shows that it is connected with the UserChoice registry key and the HASH value under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.SomeExt
According to this blog
the HASH is calculated based on user's SID. But after the migration the user has new SID and the HASH becomes invalid and we hit this:
"However In Win 8, the registry changes are verified by a hash (unique per user and app) that detects tampering by apps. In the absence of a valid hash, we ignore the default in the registry."
Currently deleting the UserChoice key for all associations solves the problem. But the user has to make all her customizations again which is undesirable.
Is there any supported way to fix this? Why the OS doesn't update the HASH after the first logon when the SID has changed as it updates the SID for the ProfileList key?
This could become big issue in large migrations.

Hello Petar K. Georgiev,
Please check the following article to change the registry key to change back to the default file type associations.
http://www.sevenforums.com/tutorials/19449-default-file-type-associations-restore.html
Please note: Since the website is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
Best regards,
Fangzhou CHEN
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]

"Can Portal Authenticate a single user into multiple Domains"

Hi All,
I have a requirement in the following way.is it Possible to achieve?
lets take user with user-id(SSO environment) ABC ,maintained in MS AD under domain name say "SAP.com"
We are going to migrate this domain into another domain say "SAP123.com" and so others,and we want to maintain the same user with same userID in new domain(SAP123.com) also.
In simple words user must be able to authenticate on both domains and he should be able to access all the applications in new domain also via role mechanism
This we are going to do only for test purpose,later we will be maintaining only 1 domain for 1 user.
My only question : is it possible to accomplish the above requirement by any means?and How?Does it make sense?
waiting for your valuable inputs.
Thanks in Advance
Amit Koyal

Hi Amit,
yes, I'm around, but unfortunately pretty busy at the moment (preparing the TechEd session for Amsterdam next week).
Here my answers:
1. As you can read from SAP Note 762419, "it is possible to use integrated Windows authentication in a multi-domain environment even if users' logon IDs (represented by the attribute "samaccountname") are not unique across all domains". Please make sure that you go through the limitations of the two options.
2. If you change the portal domain, SSO will work only with servers located in the same (new) domain as the portal. You don't need to make here any change if your (SAP) applications are also in the new domain. If not, please consult the documentation I gave you in my previous post.
Hope this helps,
Robert

Child Domain Lync Installation

run enable-csadforest on root domain server. Any idea to do csadforest without install Lync deployment tools on root server?
check universal security group is added on root domain.
check child domain didn't replication the universal security group.
Run Enable-CsAdDomain -Domain chil.domain.com for enable child domain user to use Lync.
Any advise? how long time to replication the universal security group?
i will install Lync server into child domain and federation with office 365.
Thanks.

Hi,
Did you prepare schema successfully without issue?
You need to prepare the forest on a computer which joined to a domain as a member of the Enterprise Admins group for the forest root domain. You need to prepare the forest with the Lync Lync Server Deployment Wizard or the Lync server Management Shell cmdlets
directly. So you need to install the Lync deployment tools on one of the root server.
You are right, you must verify that global settings have been replicated before running domain preparation.
Please also login the child domain using the account which as a member of the Enterprise Admins group, the check if the replication happens or not.
Best Regards,
Eason Huang
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Eason Huang
TechNet Community Support

VDI 3 + Active Directory Child Domain Setup Question

Hi Everyone,
Quick question. Will this config work because I'm having some issues.
Domain A
Child Domains A.A, B.A, C.A, etc..
Kerbros is setup and pointing at domain A with admin account access.
VDI3 can see all the domains when I pull down the domain selector... however!... I can only log into the parent domain A. Attempts to log into child domains A.A, B.A, etc give me an 'Unknown user/password error'.
Will this config work? All child domains are part of the same forest which I thought was supported.
Many thanks in advanced for any replies.
Dono

Hello,
yes, forests with multiple child domains are supported and your configuration should be working.
In order to troubleshoot the problem, please follow the instructions at:
http://wikis.sun.com/display/VDI3/End-users+cannot+access+their+virtual+machines.
The cacao logs should contain more details about the error.
Thanks,
Katell

Added existing domain to the parent domain and now permission not inheriting on the child domain

Hi Friends
There was a existing Domain but we bought the company and make that Domain as a child domain of our Domain, problem is that users of Parent domain does not have access to the child domain. permissions are not inheriting from parent domain to child domain.
for e.g i created user on the parent domain i cant even login to the machine in other domain or access the resources which are on the child domain.

Simply delegate the permissions you want to grant so that users from the root domain can have access to resources in the child domain.
As an example, you make users from the parent domain login to computers from the child domain using
Allow logon locally group policy: http://technet.microsoft.com/en-us/library/cc756809%28v=ws.10%29.aspx
You can also make them able to RDP the computers if you add them to Remote Desktop Users
group. This could be done by Restricted Groups Group Policy.
So, for security reasons and depending on your current configuration, it is normal that users from the root domain might not have by default access to resources in the child domain. This could be fixed by doing the proper delegation.
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

AD User Cannot reset their password on Child Domain

I have windows server 2008r2 which is my Parent Domain and child domain on windows server 2003. All my users on Child domain stuck on resetting their password
and following error message appears
"The password does not meet the password
policy requirements"
Although I have not applied any password policy, don't know why this error message is appearing.
Please help...

Hi,
In addition to the above information, you can check the resultant password policy settings applied for an AD user account by following the below steps,
- Login to a client machine as AD user
- Go to Start -> Run -> Type RSPO.msc.
- In the RSOP console, navigate to the node Computer Configuration\ Windows Settings\ Security Settings\ Account Policies\ Password Policy.
- In Password Policy page, you can confirm, what is the current password settings applied to that AD user.
- Now based on the password policy settings you can try to change the password.
Regards,
Gopi
JiJi
Technologies

Migrating 2 domains into child domains in a new forest

Similar Messages

Maybe you are looking for