Separating a child domain from a forest/parent domain

Our infrastructure is currently as follows:
There are two domains which I will call "apple.local" and "banana.local". The domain "apple.local" is the parent/forest which is at a Windows 2003 Functional Level. The domain "banana.local" is a child domain of "apple.local"
which is at a Windows 2008 Functional Level. This unusual arrangement was the result of a merger.
Recent business changes have meant that the domain "banana.local" needs to become the forest and "apple.local" needs to be permanently retired. I have been searching as to whether this is possible but the general consensus is "no".
However, many of the discussions are several years old and I am interested in whether anything has changed with recent updates.
As an added "bonus", a single Exchange 2010 SP3 server is present and - just to complicate things further - is a member of the child domain "banana.local". Mailboxes (shared and user) and DGs from both domains are present. Access to shared
mailboxes is granted using a mixture of users and security groups from both domains.
Is the best way forward to simply create a new domain on a fresh server? What would be the most straight-forward solution with minimal impact to the users and - in particular - the Exchange platform?
I am in a position to purchase new servers, software and licenses as required to meet the ultimate goal and - within reason - additional expenditure is not an obstacle. We also have the option to create new IP ranges if required.
Any ideas and/or suggestions welcomed!

Is the best way forward to simply create a new domain on a fresh server? What would be the most straight-forward solution with minimal impact to the users and - in particular - the Exchange platform?
It is not possible to detach a child domain from its parent. One of the things you can do is to create your domain and establish trusts between them and migrate resources from old domain to the new domain. Note that computer account migration will take some
time. For exchange part you can ask in Exchange forums but the one thing you can do is to Cross-Forest mailbox move after you set up the new forest.
Exchange 2010 Cross-Forest Mailbox Moves
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?

Similar Messages

Active Directory : Replication Issue - "Disconnected" sub-domain from the Forest

Hello everyone,
I'm managing a multi-domain forest (with 7 sub-domain). All are working fine except for one. Throught repadmin (Repadmin /replsum /bysrc /bydest /sort:delta), I noticed I got both domain controllers of a subdomain (there are only 2 DCs in that
subdomain), who hadn't replicated with the rest of the forest for more than 60 days.
According to my research, it's usually recommended to Depromote and repromote the problematic DC to avoid the issue of lingering objects. In this case, it's both DC of a sub-domain. Of course, on the others DCs in the forest, I got the event
ID 2012 "it has been too long since this machine last replicated with the named source machine....".
HKLM\System\CurrentControlSet\Services\NTDS\Parameters\Allow Replication With Divergent and Corrupt Partner
to a value of 1.
As I understand it, this may cause lingering objects to appear (they can be removed with repadmin /removelingeringobjects command with the DSA GUID, naming context, etc..). So far, I haven't used that registry key yet because of the associated risks.
I didn't noticed any other issue so far. Users in the problematic sub-domain are fine, and the problematic sub-domain seems to be able to pull replication data from the others DCs in the forests. (at least, I'm not getting any error in the A.D. Sites
and Services)
I added two new DCs for the affected sub-domains, so the number of DCs for that domain went from 2 to 4 DCs. The two old DCs that hadn't replicated for 60 days are windows Server 2003 and the two new DCs are Server 2008 R2.
Unfortunately (and I was half expecting this, but did it anyway since I must eventually replace the old DCs), that didn't solve my issue, since the rest of the forest "doesn't see" the two new DCs of the sub-domain. By that, I mean that I
cannot add an Active Directory Domain Services Connection in Sites & Services console (from a DC in another domain of the forest or even the root domain). I see all the DCs, including the two old DCs that are server 2003, but not the new ones.
I believe it's because the others DCs doesn't pull/replicate the information from the old DCs anymore, so they aren't "aware" of the two new DCs for that problematic sub-domain.
I was wondering what is the best course of action. Is it worthwhilte to use the registry key force replication with the old DCs ? (and hopefully, the new DCs will get their AD Services connection/replication vector created, so I can depromote
the old DCs.
Since the Old DCs from the problematic sub-domain seems to be able to pull the replication from the rest of the forest, does the risk of Lingering object isn't that great ?
Or is it too risky and I must create a new sub-domain and migrate one way or another the users ? (which would be time-consuming)
Thanks in advance,
Adam

Thanks for the reply. One of the link had another link to a good article about the use of repadmin :
So, I ran the command "repadmin /removinglingerobjects " on one of the problematic DCs ().
For clarity purpose, let's say I used the domain :
domain = main domain
subdomain = the domain whose DC are problematic (all of them).
AnotherSubDomain = Just another subdomain I used as a "reference" DC to cleanup the appropriate partition.
Command (the DSA guid is from a DC "clean" in another domain)
repadmin /removelingeringobjects adrec01.mysubdomain.domain.ca C4081E00-921A-480D-9FDE-C4C34F96E7AC dc=ANOTHERsubdomain,dc=domain,dc=ca /advisory_mode
I got the following message in the event viewer :
Active Directory Domain Services has completed the verification of lingering objects on the local domain controller in advisory mode. All objects on this domain controller have had their existence verified on the following source domain controller.
Source domain controller:
c4081e00-921a-480d-9fde-c4c34f96e7ac._msdcs.mydomain.ca
Number of objects examined and verified:
0
Objects that have been deleted and garbage collected on the source domain controller yet still exist on this domain controller have been listed in past event log entries. To permanently delete the lingering objects, restart this procedure without using the
advisory mode option.
How should I interpret the message "number of objects examined and verified 0". Does it mean it just didn't find any object to compare ? (which would be odd IMHO) Or there is another problem ?
Thanks in advance,
Adam

"domain network" - name is forest parent domain

I'm testing Windows 7 in our corporate environment. How does the Windows 7 Network and Sharing center determine the name for the "Domain Network" to which I'm attached? I notice on my test PC it is showing the name of another domain in our forest (our tree root), not the name of the domain I am joined to. For example, each of our regions has their own domain:
region1.company.com
region2.company.com
region3.company.com
ad.company.com (tree root)
I'm in region1.company.com, however my N&S Center shows my connection as being in ad.company.com. My DHCP server is in region1.company.com. It is handing me a connection specific suffix of region1.company.com.
How does Windows 7 determine this name?
Baffling... and I've searched all over

Hi,
“ad.company.com” should be your Network Name. I think this is related to “Network Awareness”:
Windows 7: Pre-release privacy supplement (Please note the section “Network Awareness”.)
For more information about Network Awareness, please also refer to:
Network Awareness in Windows Vista and Windows 7
Thanks.
Nicholas Li - MSFT

Business Objects XI 3.0 connecting to domains from different forest

Hi All,
Does anyone know if BOE XI 3.0 support AD authenication with multiple AD domains which reside in different forrests?
I found other post which mention we are now supporting it in XI 3.0 SP1 but I couldn't find any document on it.
Thanks,
Bobby

3.1 or 3.0 SP1 both support multiple forests. There are rules, there must be a transitive full two way trust between the forests.
i.e. in order to map groups the CMS needs to query the remote forest so the remote forest(s) must trust the local one.
In order for remote users to login to the local forest they must trust the remote one(s)
The changes were made in the AD plugin (basically we query multiple global catalogs and lookup objects by DN as opposed to SID) So there is no configuration needed in BO.
Regards,
Tim

Importing Child Domain Object Along With Parent Domain Objects

I have two AD AWS services. Both are doing full sync. Once is pointing to Domain A which has x users, the other is pointing to Domain B which has y users. Domain B is a child domain of Domain A, when the job runs to Sync Domain A, Domain B's users also get imported. Is this by design?
Craig

Hi Craig,This is probably a sided effect of your user query filter - does it include the sub domain?
To get around this, you can go down either of two routes:
a) change your query filter so it doedsn't include Domain B in the Domain A auth source editor
b) change your Domain A sync type to Partial Users, and choose the subgroups you'd like to have synced to that domain
The later solution only works if there is no overlap in group membership between domains and domain B has a group that can just be discluded in the partial users sync.
If you provide some more details on your exact hierarchy, we might be able to give you some more specific solutions.
Thanks,Akash

Exchange Migration from One domain to another domain on same forest

Team,
we are in the process of migrating exchange infrastructure from one child domain to another child domain within same forest.
root domain - root.com
child domains - US.root.com and EMEA.root.com
EMEA and US Domains setup are different from each other. Like EMEA has different email address policy , Email Flow than US , connectors etc.
Now we need to migrate all emea users under US Domain. based on the geographical locations, we are building a new dc, mailbox , cas servers on EMEA location , but these servers will be part of US Domain.
for CAS Servers - we are planing to register respective sites ( site affinity), so all the local requests will be handled by new cas server which is built under US Domain.
Mailbox Servers - we would be creating new db's and the limits on new mbx server and going to replicate as its on EMEA Mailbox server.
can some one please let us know what are the precautions , recommendation, sequence which we need to follow to perform smoother migration. as of now , I can think of below topics.
Mailbox Migration -I Have a script , which
will take care of mailbox movement once the objects are being moved.
Contacts Migration - Willard Martin blog helped me to perform migration
DL Migration - I believe there is no mechanism to migrate DL. only option is to recreate.
Email address Policy:we would be creating a new address policy and apply to OU's
DB Consistency check – do we have to perform the health checks on source mailbox server to see , the servers are free from errors /corruption.
Check outlook configuration - After the migration, we need to check and see , the exchange server/ auto discover works and identify the new exchange servers.
Internal /External Email flow.-
Active Sybc , OWA
Public folder Migration -
Offline Address Book
Certificates
any help or suggestions would be great.
Srinivasa K

Hi Srinivasa,
According to your description, I think you have done all the preparation.
For DL migration, the following article may give your some hints:
How to Migrate Distribution Groups Across a Forest
Good Luck!
Niko Cheng
TechNet Community Support

Child DC cannot Replicate to Parent DC, because of connection errors. MS PortQryUI shows that ports 3268 and 3269 are not listening,

I started a support case with Microsoft to help me with raising the our domain Forest level because i received a message stating that there were Windows 2000 PDC still listed in the database. These PDCs were removed years ago. The tech saw all of the problems
i was having with domain replication so that is where he started. running the MS PortQryUI shows that ports 3268 and 3269 are not listening, (TCP port 3268 (unknown service): NOT LISTENING) when run FROM a Child domain controller against the Parent
Domain controller. Between the 2 Child domain controllers these ports are listening.
The Windows firewall is not running on any of the controllers, i removed a virus protect client from all of the servers, although i didn't enable the firewall there either, but these ports are still not listening on the Parent DC.
I need help debugging this. I am not very familiar with network sniffers so if i need to run one i'll need some guidance. This DC only has one NIC, all IP addresses are static, all servers are setup like this. All servers are in the same subnet, on the same
lan, on the same cisco switch, there shouldn't be anything blocking this port from starting.
I looked over other post that show this same problem, but they don't give a solution. If i am not using the Windows firewall why wouldn't these ports be open?
Any ideas? web searches are all over the map on trying to find the reason for this.
Bobby

Try running the below command on the DCs that you think have the ports blocked or all the DCs.
netdiag /test:ipsec /debug > c:\dcname-ipseclog.log
Open that from the C drive and see if there is anything saying block or filters.
Also, just for kicks have you disabled the firewall service on the DCs?
And just for kicks have you tried enabling firewalls ports on all the DCs? The KB is below
http://support.microsoft.com/kb/555381/en-us
Step 1 - netdiag results
Step 2 - disable the firewall service on all DCs if step 1 was negative
Step 3 - enable the firewalls on all DCs per KB 555381 if step 2 doesn't work
Let us know how it goes!
If it answered your question, remember to “Mark as Answer”.
If you found this post helpful, please “Vote as Helpful”.
Postings are provided “AS IS” with no warranties, and confers no rights.
Active Directory: Ultimate Reading Collection

Move domain to another forest (forest trust)

Hello
I have a forest with many domains , and other forest with a domain. They include a trust set up and working . I would like to have only one forest, but it would need to move that single domain in additional forest, and would like to know if it is possible then
moving a domain from one forest to another forest in forest trust ?
Thanks also suggestions stop solve my problem

You're asking to move the domain itself? No, you can't move the domain. You can create a new domain in the forest you want to consolidate to, and then migrate users and groups to that forest. You'll have to migrate workstations and users and repoint
applications as well, if needed. And then, you're not really moving them, you are creating new ones and copying properties of those objects. You mentioned a forest trust but all the forest trust allows you to do is to assign/use permissions from one forest
in another. People speak of moving objects but like I said, for users and groups you're simply creating new ones with the same names, and copying properties over. Computers/servers are joined to the new domain, but it's a new computer account, not one that
gets moved over.
You'll need a migration tool to do this smoothly. As Malek mentioned ADMT, yes this is one tool that can do this. It's not necessarily the best or easiest tool, but it's free from Microsoft. There are also other third party tools such as Dell/Quest
Migration Manager for AD and BinaryTree also has similar tool (there are others out there too). Those two latter tools have the ability to add permissions (ACL entries) to new domain objects, based on the old ACLs from the source domain. This can be a huge
help for servers and workstations (allows the users to continue to use their same profile after their computer is migrated, and they are using their new user account. Otherwise Windows would just create a new profile when the user logged in with his/her new
domain account.
Depending on the size of the domain you want to move (how many objects), this could be a pretty big project. There's a lot going on in a migration, and based on your question, I'd recommend finding help with it if you can. There are a number of companies
and consultants who specialize in AD migrations, even some consultation for planning could help tremendously.

System.DirectoryServices.AccountManagement for a Forest of domains

The GroupPrincipal FindByIdentity finds me all the members of an Active Directory group.
I ran into problems when I started to have a forest of domains.
What is the proper method for finding the members of a group when the members of my group comes from a forest of domains?
(I program in c#)
Certified Geek

Hello Arne,
>> What is the proper method for finding the members of a group when the members of my group comes from a forest of domains?
You could have a try to use the GC which search for the whole domain forest as:
var path="GC://DC=main,DC=com";
For details, please refer to this link:
http://stackoverflow.com/a/16685651
Or in .NET, there is a class named
Forest, you could this class to Use the Forest class to get the current global catalog, where you then can get a reference to a DirectorySearcher that will search the entire forest as used in this
link.
Regards,
Fred.
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

Remove Personal Domain from MMe

I have added a Personal Domain to a MMe account. However, the domain transfer process is going to take a few more days, because of the grace period built into the process. As soon as I added the personal domain name in MMe (I have not clicked the "Done" button.) all of the page icons in iWeb turned red, indicating they needed to be republished. I have not republished. I can still get to my site using the web.me.com/username address, of course. I have made a a number of changes that I would like to publish.
Do I need to wait until the domain transfer process has been completed? I have not done anything to point the domain name to the MMe site at either the previous or future registrar.
Can I remove the Personal Domain from MMe until the domain process has been completed, and manage the site as before? If so, how do I do this?
If I go ahead and republish with the domain name in the MMe account (before the transfer process has been completed, and with the personal domain still associated with the account) can I still access it using the web.me.com/username address?
Thanks...

Log into your MME account and go to the Personal Domain option. It has remove on the right side and just click on that to remove it.
Whether your domain name is linked to your site or not, you can always get to your site by using the url web.me.com/username/sitename.
If you are using iWeb, then your site will always only ever be published to your iDisk and MME and not your domain - it is only an illusion because your domain name is forwarded to your MME account.

Prevent Active Directory Parent Domain Admins from accessing Child Domain

We want to prevent Parent domain administrators (or a similar profile?) from accessing and/or administering child domains. Is this possible, or do parent domain admins have irrevocable administrative access to any child domain?
Asked another way, can a restricted profile be configured for administration of the parent domain that does not cross domain boundaries effectively isolating each domain's administrative needs?
Thanks in advance for input and advice!
Best regards.

Sorry, I was replying again after I read your second paragraph. The parent domain is the Forest root. we have parentdomain.com
parent.parentdomain.com
child1.parentdomain.com
child2.parentdomain.com
child3.parentdomain.com
We do not want the Domain Administrator for parentdomain.com to be able to administer, or preferably, even access the Child Domains.
1.) Can we remove that user from "Enterprise Admin" role and assign a different role so that they can only administer parentdomain.com (effectively demoting that user)?
2.) Promote a Child.parentdomain.com user to Enterprise Admin?
Thanks sorry for the confusion.
Ah ok.
Yes, you can. the answer is the same basically. The group membership is what counts. So in the child domain, remove the enterprise admins group from the child domain admins groups. OR make sure the domain admins of the forest root are not members of the
enterprise admins group. that way they are still only admins in the parent domain.
It is really only depending on group members ship and including those groups in the child domain. by default the enterprise group is included for example, but nothing stops you from removing those groups.
based on the group membership you can also deny them the ability to log on.
the only thing you cannot prevent is the forest administrator account from doing something.
One thing I would like to add though: any admin in the forest domain likely has the ability to still get access if he wants to force his way in.

Manage client in parent domain from child domain

My site has a root domain (mydomain.net) and a parent domain (ent.mydomain.net).
My primary SCCM site is installed in ent.mydomain.net and is managing all my clients.
I have 4 DC's installed in mydomain.net that I would like to manage from my child domain (ent.mydomain.net).
It is my understanding that if the schema has been extended in the parent domain, and I manually install the client on the DC, it should be able to be managed from the child domain.
I have installed the client in the parent, but it cannot find the site in the child (I have not extended the schema yet). i know that the client will not be able to find the site until the system management container has been created and populated
(does not currently exist). I know that I can create the container, but how would it get populated with the correct site information.
If anyone has any experience with this kind of configuration, the help would be appreciated.
Thanks

i know that the client will not be able to find the site until the system management container has been created and populated (does not currently exist). I know that I can create the container, but how would it get populated with the
correct site information.
You could enable AD publishing to that domain, but site assignment is also a matter of site assignment boundary groups. You can also assign a client to a site manually though.
Torsten Meringer | http://www.mssccmfaq.de

Migrate Users from a child domain to a root domain in different forest

Hello,
it supported to migrate users from child source doman to target root domain?
I established a trust, but i don't see child domain at ADMT installed on target domain DC. Source root domain is visible

You should not be needed to establish a trust as all domains within the same forest already trust each other - are you sure those domains belong to the same forest? You can find out using the following command:
nltest /DOMAIN_TRUSTS
If ADMT dosen't show a partiuclar domain in the dropdown list, you can/have to type the domain name manually.
Enfo Zipper
Christoffer Andersson – Principal Advisor
http://blogs.chrisse.se - Directory Services Blog

Migrating to Lync in a child domain from OCS in a Parent domain

I am looking to migrate from OCS to Lync 2010. I have gotten as far as deploying the target pool, but when I try and merge the topologies it fails.
OCS is in The root domain of my forest but Lync is planned for the primary Child domain where 80% of my users live. I just need to know if this is a supported migration scenario for Lync. If it is how do I merge the two topologies, as it looks
like the merge tool is only looking at the child domain for the configuration of OCS?
Jeff

Hi,
Did you build a new pool with Side by side approach?
It is supported to migrate Lync from one domain to another domain in the same forest. Here is the supported server migration paths in the link below:
http://technet.microsoft.com/en-us/library/gg425764.aspx
For the issue merge topology failed, did you receive any error message from FE server Event Viewer?
The Lync server default sip domain should be the same when migrating from OCS to Lync server. If not, you can add sip domain in Lync topology and then run the command such as below on Lync FE server:
Set-CsSipDomain –Identity new sip domain name –IsDefault $True
Note: (change new sip domain name to your Lync server sip domain name)
Then run OCS merge again to test the issue again.
Best Regards,
Eason Huang
Eason Huang
TechNet Community Support

Puzzled - parent domain user as administrator in child domain cannot add printer

I've got a bare domain at the forest with 3 users and several "child" domains. I'm trying to set it up so that the user (let's call it EA-Service) in the forest can do administrative work in each of the sub domains without having to log on to the various
domains as each domain's domain administrator. There are a handful of these domains at this time, but as we pick up more accounts (think hosting), we expect the number of domains to reach the hundreds. I don't want hundreds of domain accounts
to track.
I thought adding EA-Service to a forest group called EA-Universal and adding EA-Universal to Builtin\Administrators on each of the domain controllers would give me administrator access on each of the domains.
I spent a frustrating two days trying to add an internet printer's driver using EA-Service on one of the child domains and it kept failing (message wasn't clear). Today I said, What the Heck, logon with my domain admin account on the child domain and
try. It worked. I dropped the printer and then logged out and back in with my EA-Service account and I couldn't do it. Clearly Builtin\Administrator isn't everything on a DC.
What right, privilege, or piece of arcane magic did the domain administrator account have that the EA-Service account did not? And how can I give that special whatever-it-might-be to my EA-Service account?
How can I determine exactly what rights & privileges a particular userid on a machine has? I could then compare the two sets of rights and see what was different.
I really need to have a super-duper-administrator account to do various maintenance tasks and I don't want to have to use each domain's Admin account to do it.
Can y'all help me?
-g

I had an entire post built that took me all day with interruptions and poof, it's gone. Rats. Here is my second attempt:
Assign permission on the resource using DL group.
This last one is the one I'm having trouble with.
I have to admint that I'm feeling very stupid about this whole thing. Everyone seems to understand it completely. I have read many posts and believe I understand them, but I'm not getting something as I've certainly not got it to work.
I have seen some excellent writeup by Ace, Awinish, Meinolf that have really helped me understand the RBAC/AGUDLP/IGDLA. This
post by Ace Fekay is one such example among others. I have read about the different group types and scopes. I have read about rights, privileges and permissions. I believe I understand them. I've worked in security since IBM's
RACF which is also RBAC.
The problem is just what permissions need to be given to DA-DomainLocal (the group to which EA-Service, the forest user, ultimately belongs) so that its members have the same abilities as DA-Service (a domain administrator account on a child domain)?
Clearly adding to Administrators on the child AD is insufficient as the EA-Service ID was directly added to it and it could not add a printer while DA-Service could. EA-Service is also a member of the Enterprise Admins group on the parent/forest domain.
What other permissions/rights/privileges does the DA-DomainLocal group (or directly, the EA-Service ID) still lack? What are the differences between the access tokens/descriptors of EA-Service and DA-Service? And how do I find out?
I believe I've seen some tool that showed them, but I can't seem to find it now that I'm looking.
I listed the NTFS permissions (via AccessEnum from SysInternals) for the entire C drive and note that Administrators is on most of them and not once did I see something like Domain Admins appear and I saw nothing to do with printers at all. The list
was very long so I could have missed it if it was there. I also used the same tool to look at the HKLM hive, but that was too large to browse through.
I have set up the group structure exactly as Awinish suggested and remain stuck at the last piece. If it was some specific resource I'd have no problem, I could add it, give it permissions/rights/privileges as needful. The problem remains is
that I don't know what those permissions/rights/privileges are nor how to discover a definitive list (I've seen some generic lists, but they don't list the exact names of the right/privileges).
I'm sure I'm just being dumb.
How do I go about discovering what permissions/rights/privileges that DA-Service has that EA-Service (via the DA-DomainLocal group) needs?
I thank all of you for helping me. I appreciate the time you are taking.
-g

Separating a child domain from a forest/parent domain

Similar Messages

Maybe you are looking for