I have attempted to figure this out with only my google-fu, however I am not familiar enough with active directory to confidently use guides not about my specific situation without at least asking. Any guides or recommendations you can throw my way would be much appreciated, also what are the big problems I should be on the lookout for?
Currently
We have a new server (2008 R2 standard) we are setting up as a domain controller for a new domain "CompanyA". We currently have a domain controller for the domain "project1", but we need to change servers and domains for various reasons.
Short term goal
We would like to setup the new domain so that "project1" is trusted, so all of our current accounts work on it. Then, as we setup/upgrade services/accounts move them to the new domain (e.g. new SharePoint server, new users, new file server,etc..)
Long term
Eventually (1-2 years) we will remove the "project1" server and domain and migrate the remaining users and computers over to the new domain.
To recap, I'm looking for: * Will this work? * How should I go about it? * Potential Problems
Update - Implemented
OK, it worked with some hiccups. Yes you do need to add them to each others DNS; I used conditional forwarders. Our big problem is permissions, external accounts can't be added to certian groups so I can't allow them to access Hyper-V :( I'm ok with having two accounts for administration (Can't add them to Domain Admin) but I wish I wasn't limited to remote desktop to manage the server/Hyper-V, the RSAT is useless because it pulls your credentials from your windows session.
If your DNS or network is having issues the trust will break / not establish, evidently these are "usual suspects" and proved to be where my problems originated from.
I will gve you the same answer I gave to a very similar situation this morning:
In the short term, clearly a trust is the way to go. In the long term, you will probably do it using the Active Directory Migration Tool and the Password Export Server.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=20c0db45-db16-4d10-99f2-539b7277ccdb http://www.microsoft.com/downloads/en/details.aspx?familyid=F0D03C3C-4757-40FD-8306-68079BA9C773&displaylang=en
I suggest that you read this document Microsoft on how to use the ADMT and restructuring domains.
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=6D710919-1BA5-41CA-B2F3-C11BCB4857AF
Is it a must that you must change the domain?
because you can affectively just add new 2008 servers and promote them to DC's instead. Once replication has happened you can move all the FSMO roles acorss to the 2008 servers then decommision your old servers. You now have the same domain but with new hardware. You can then upgrade the domain to be 2008 compliant once old servers are gone.
Basically this achieve all your goals above except the domain name will be the same.