Merge forests and rename with Server 2003 and Server 2008 Enterpri

I have two domains across two offices each with their own subnet with a
working two-way trust. I believe DNS is configured correctly. However, we
have a need for users of one domain to be included in groups of the other.
Somehow, I think both of these domains were configured in their own forest.
This is my (well.. not really what I would have done) current configuration:

Domain 1:
DomainDnsZones.bobsdomain.local
ForestDnsZones.bobsdomain.local
bobsdomain.local

Domain 2:
DomainDnsZones.billsdomain.private
ForestDnsZones.billsdomain.private
billsdomain.private

The current configuration was obtained from domainlist.xml after running the
rendom /list command on each server.

How would I change both of these to be in the same forest? For example, I
would prefer this:

bobsdomain.mycompany
billsdomain.mycompany

Is there an easy way to accomplish this while preserving share permissions?

"brandon.johnson" <> wrote in
message news:5E344AEB-FE96-4673-AF58-...
>I have two domains across two offices each with their own subnet with a
> working two-way trust. I believe DNS is configured correctly. However, we
> have a need for users of one domain to be included in groups of the other.
> Somehow, I think both of these domains were configured in their own
> forest.
> This is my (well.. not really what I would have done) current
> configuration:
>
> Domain 1:
> DomainDnsZones.bobsdomain.local
> ForestDnsZones.bobsdomain.local
> bobsdomain.local
>
> Domain 2:
> DomainDnsZones.billsdomain.private
> ForestDnsZones.billsdomain.private
> billsdomain.private
>
> The current configuration was obtained from domainlist.xml after running
> the
> rendom /list command on each server.
>
> How would I change both of these to be in the same forest? For example, I
> would prefer this:
>
> bobsdomain.mycompany
> billsdomain.mycompany
>
> Is there an easy way to accomplish this while preserving share
> permissions?

You can not "merge" domains,...there is no such thing.

You have to create a new Domain in the target Forest.
This domain cannot be spelled the same as the "source" domain.
You migrate (not merge) objects (users, pcs) from the old to the new.
This is non-destructive,...the old Domain remains perfectly intact,...even
the machine accounts remain (even though they are not really "there"
anymore).

After completed trusts are removed and the old domain must be removed so it
is no longer visible,..you can potentially rename the new domain back to the
name you want,...but renaming a domain can cause problems. It might be safer
to create yet another new domain in the target forest with the correct name
(after the old is not there anymore) and then do a second migration.

You use ADMT to migrate the domain.
Exchange can not be migrated. Exchange must be completely
removed,...migrate the Machine,...reinstall Exchange.

Share permissions,....the Security Translation Wizard in the ADMT can help
with that. But when it "does its thing" when there are a lot of files in a
lot of shares it can take a long time,...don't get inpatient and interrupt
it.

For Exchange you have to build a new exchange (even if temporary) and "copy"
the contents of the mail boxes from the old to the new with ExMerge (Ex2003
and older). Exchange is often done "mid-way" through the domain migration
process, but the exact process may vary with the situation. The mailboxes
are not copied of moved,..only their contents. You will simply let the new
Exchange create new empty mailboxes,...initialize them by sending every use
a "test message",...then use Exmerge to populate them with the messages
copied from the old mailboxes. If you don't initialize the new boxes as I
said then Exmerge will fail to populate them.

How long does it all take?? Well I've been working on one for almost 6
months and it is just about finished,...but they do not normally take that
long. I have done that same thing in a little as 2 or 3 days
before,...again it depends on the enviroment.

Read the docs for ADMT. This ia a "big" and somewhat "dangerous" job. You
have to know what you are doing with ADMT or you can really make a mess.
In fact reading the Docs is not enough,...you have to seriously "study" the
Docs. I have done several migrations and the latest one is fresh on my
mind, yet I still would not attempt it again without reviewing the Docs and
keeping a printed copy of them with me while doing it.

I don't claim to be a expert on migrations,...but if you take what I said
and study the ADMT Docs and the Exmerge Docs you should be able to get it
done.

--
Phillip Windell

The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------

Hello brandon.johnson,

Thius requires a migration what can be done with ADMT:
http://msmvps.com/blogs/mweber/archi...ew-forest.aspx

New and old name MUST be different.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> I have two domains across two offices each with their own subnet with
> a working two-way trust. I believe DNS is configured correctly.
> However, we have a need for users of one domain to be included in
> groups of the other. Somehow, I think both of these domains were
> configured in their own forest. This is my (well.. not really what I
> would have done) current configuration:
>
> Domain 1:
> DomainDnsZones.bobsdomain.local
> ForestDnsZones.bobsdomain.local
> bobsdomain.local
> Domain 2:
> DomainDnsZones.billsdomain.private
> ForestDnsZones.billsdomain.private
> billsdomain.private
> The current configuration was obtained from domainlist.xml after
> running the rendom /list command on each server.
>
> How would I change both of these to be in the same forest? For
> example, I would prefer this:
>
> bobsdomain.mycompany
> billsdomain.mycompany
> Is there an easy way to accomplish this while preserving share
> permissions?
>