Domain Split

[Lukey]

I have a single domain across two separate offices. One office has been sold and we need to cut the link between them. There is a DC at each office. I want to keep the same domain at both offices to start with (they will never be joined again).
Am I right in thinking that I will need to cut the link and then seize the FSMO roles for the server that doesn't hold them ? As long as both servers cannot see each other, both hold FSMO roles and are both Global Catalog Server, users should be able to log on.... I think....
I have never done this before and would be greatful if someone could confirm whether this will work.
Thanks

 

[adcfaq]

u need do metadata cleanup after u seize fsmo on each site.

http://www.petri.co.il/delete_failed_dcs_from_ad.htm

---------------------------------------
Sr. Directory Services/Exchange Consultant

http://adcfaq.8m.com/

 

[NetIntruder]

hmm.. well, while this would work, it's dirty! If you clean up the metadata, you should be ok. Remember that you are leaving a copy of your SAM file over in an office no longer controlled by you or your staff, so you will want to change your passwords and your service accounts, etc.

If you are going to do it this way, consider moving all of the roles to the server that you will maintain and once split, seize the roles on the other side.

So, to answer your question... yes, this should work just fine, but it's not very clean. If you are comfortable with restoring a Domain Controller it would be even more preferable to backup to "sold" domain controller, transfer the roles, demote it, sever the link and restore it.

~Intruder~
CEH, MCSA/MCSE 2000/2003

"The Less You Do, The Less Can Go Wrong"

 

[Lukey]

Thanks very much for your quick replies. I completely agree that it is a bit of a dirty fix although I have a week to do it and it isn't actually the office that I manage. I just needed to come up with a way that 150 users could still login without noticing a difference really. After a month, they are all being moved to a new office and separate domain anyway.
I just wanted to check that this should work in theory.

Many thanks

 

[xmsre]

If you're a publicly held US company, I wouldn't do that. SOX compliance issues would prevent such a plan from even being considered. Even if SOX or other regulatory requirements don't stop you, the security implications of your plan are numbing.

What you need to do is stand up a new forest and domain(s), then migrate the users.

gotta hate divestures.

 

[Lukey]

xmsre - thanks very much for your reply. As I said before, I understand both the security implications and the poor nature of the fix, although I really don't have a choice at this stage. I will only get chance for one more site visit and the connection to the other DC is to be stopped at the end of next week.

Thanks