AD/domain reorg helpplease

[McBunny]

currently we have a nice simple 1 domain setup servicing 2 divisions

we are wanting to now separate the 2 divisions out as they are now going different ways regarding how they work etc

so we want them to be on their own domain

whats the best way to go about this ? we will be buying them their own server infrastructure

so new dc file print exchange sql boxes running 2008 r2 and exchange 2010 sql 2008

current domain is 2003

if i just create a brand new domain and set up trusts between the 2 domains can i migrate users and the rest of the AD account info Email etc between domains ?

 

[McBunny]

right cant do it via trusts as thats just for security

is there any migration tools

 

[bigmouk]

Will be doing something similar very soon, sounds like you need a child/regional domain setting up, good link here for technet ....

http://social.technet.microsoft.com/Forums/en-US/category/windowsserver

 

[cava83]

You can create the new domain and then use the migration tool.

Is it defo a new domain you need, i.e are they going to be a completely different business entity to what you are at the moment?

Secondly, are you sure you want to go to exchange 2010.............? Looks and sounds good, however, I would stick with 2007.

 

[McBunny]

they are still part of the group we just have to make it separable so yes needs to be a different domain really so if anything happens we can just shut them down and ship them off either side that is

 

[cava83]

You can still have them completely separate as a subdomain.

That would be easier for you than a completely new domain, however, if a new domain is required, then you can use the MS tools to migrate the required users over, which was identified in an earlier post.

Out of interest, how many users? And do they have roaming user profiles?

Thanks,

 

[McBunny]

no roaming and about 80 users will be relocated to the new ad structure

 

[cava83]

cool, that should be fun.

Mailboxes will be a bit of a pain, do you currently use public folders?

When I created a new domain including exchange, I had issues with the above, quite a pain sometimes.

Printers will be an interesting one too

 

[McBunny]

yes we use public folders i want them to stop but they wont

printers wont be an issue will only need to point them to new ip address i will get my boss to do that

 

[cava83]

Why don't you like public folders?

I think they are excellent, specially when you have a collaboration of people looking after one thing?

For instance, if you have 10 members of staff looking after info@company.com

Mail enable that folder, create a sub folder called completed, and off you go.

 

[McBunny]

why because privileges dont propagate down well not in 2k3 anyway and the way they work using groups would be a nightmare infact i dont even have rights on them all as they wernt created by me and people forget to add administrator lol

 

[McBunny]

also undeleting stuff from public folders is a bit harder i had a user last month that deleted half teh structure by mistake

 

[Cookie]

We don't use public folders here because I don't think the users could be trusted not to break everything

 

[DMS]

Sounds like you just need to set up a two way transitive forest trust then migrate your users and Exchange mailboxes across using ADMT. If you're migrating across to Exchange 2010 chances are you'll need to update the schema on your current domain before ADMT can migrate users from it. You'd probably also need to use the version of ADMT that'll ship with 2010.
Regarding your public folders, it's not going to be easy to split them up but you could grant permissions on them to the new division.
If you ever want to propogate permissions down through public folders and find you can't, download PFDAVAdmin from Microsoft. You can set permissions, propogate permissions and remove unresolvable SID's from the DACL's. You can also fix broken permissions or make them comply with the public folder roles that Outlook uses.

 

[McBunny]

that sounds like a freat too for public folders ta will get it now