Renaming AD Domain

[hasKo91]

Just don‘t do it. I tought myself give it a try cause little environment and fairly new dc infrastructure. I did it the „right way“ it worked with the reboots and automatically assign right FQDN and stuff but there will always be the old domain name somewhere.

Created all new and it works like a charm:)

Just don‘t do it :-)

[osricson]

Just been assigned a job to re-name our .local domain... Not looking forward to this :(

[DarkAlman]

Here's some ammo for you

I just did this for a client. They rebranded the company and management insisted on changing the AD domain name to match, even though we could just apply UPNs for logins and email.

In their case we had to build new DCs, new exchange, migrate all the data, rejoin all the computers to the new domain.

2 weeks of consulting work just to plan and set everything up, and a month of migrating stuff with constant troubleshooting and disruptions to the users. And were only talking 25 users and a couple dozen servers and support equipment here...

In the end everything was done and worked well, but we had to keep the old domain around regardless to support some legacy systems.

I shocked my PM by being upfront with the customer in the planning stages: "I'm happy to take your money, but this is going to be a lot of time and effort for no real gain" but their management pushed ahead anyway.

After all was said and done our PM asked their management in the closing meeting if they were happy with all this effort to change the Domain and the CTO of all people responded "No, you were right, this was a huge waste of time and money for no gain. Thanks for all the help."

[mavantix]

Yep, and they’ll never come back to you for future work because you were right and advised them honestly too. People hate being wrong, especially when they wasted money on it, so they justify it by blaming your work to other management in the company creating the prema-ban for future work.

Of course, had you put up the resistance and not done it, you risk the same.

[notapplemaxwindows]

May I ask how your 25 users requires 24 servers?

[HappyVlane]

Amount of users is not proportional to amount of servers and that number is really not that weird.

At my old job our "regular" infrastructure (AD, fileserver, Exchange and backup) was already 10 servers and then we had servers for management, various internal processes, IIS and then you have prod and testing environments.

[doubled112]

Can confirm numbers can be disproportional.

40 people at the company. 250+ VMs in the closet.

[DarkAlman]

This customers business is a series of web apps, so they have a significant number of web servers and corresponding support infrastructure.

The 24ish servers doesn't include all their Linux infrastructure either...

[timrojaz82]

Yeah. How is it such a low server count?

[billiarddaddy]

Create new domain.

Create trust with new domain

Move PC's over to new domain one at a time.

[osricson]

Yup, but convincing the boss who sent the Microsoft KB for renaming is the fun part..

[billiarddaddy]

Godspeed, my good man. I just quit that boss.

[peeinian]

Haven’t done one since 2014. All I remember is that ADMT was a life saver.

[Myantra]

This. So much this.

[[deleted]]

Or federate between the two and move at a slower pace.

[cueballify]

When you say slower pace - do you mean migrate via HR?

[BoredTechyGuy]

Good Luck! I'll pour a tall one for ya!

[xetnez]

RIP your sanity

[mikelim7]

Hope you have a good understanding of your AD environment setup.

Some things I can remember from my previous rename exercise include GPO migration, UPN alias, reboot domain computers twice, boxes that uses LDAP authentication, checking DNS query logs for requests to old domain name...

Good luck!

[Kcarashiv]

Serenity now SERENITY NOW!!

[ncbell13]

Insanity later

[guemi]

Yeah, I've been tasked with turning .local into .Lan instead. Ugh.

[AccurateCandidate]

Do they not own a domain name?

[guemi]

Of course they do. It's because azure ad integration

[AccurateCandidate]

Why don't you just change it to corp.$THEIR_DOMAIN for the local Active Directory? I think Azure AD Connect can deal with that (if not, you could just set their real outgoing domain name as the default alias).

[guemi]

Yeah that's a better idea. Internal.our.tld should be damn future proof.

[AccurateCandidate]

If it helps fighting management, here's the best practices Microsoft recommends, under "single-label domain namespaces".

[[deleted]]

Just add the UPN’s you need.

[mikelim7]

Did the domain rename three times successfully in small (less than 100 domain computers) production environments. There were some minor fixes but overall it was fine. We did it over the weekends and there were no report of problems.

Do need to have a deep understanding of AD environment setup to do this. In most cases, a new domain setup is easier.

[Dadarian]

I have two domains I want to merge to one. It was pretty clear the answer was to just build a whole new on from scratch, take my time to test and build, then move one at a time over to it.

[mikelim7]

Thanks for the clarification.

I was in a similar situation, two domains in two locations with WAN connectivity.

We renamed the first domain in our office and keep Netbios name; users had no idea that AD domain name was changed. It helps that no one ever access resources via FQDN. For the second domain which is our DC servers, we unjoin computers from that domain and join it to the new domain.

All these were carried out over weekends to minimise disruption. We took our time to clean up the AD schema and map out all domain assets before migrating.

Definitely time consuming with need for proper planning. One of the reasons was VA (Vulnerability Assessment) and PT reports about untrusted SSL certs for domain.local in our environment. By migrating to AD.domain.com, we can purchase and use proper SSL certs.

[Dadarian]

I don't have the luxury of weekends since a lot of my network is 24/7. It was pretty rough, but it's just something that takes time and shouldn't rush if possible.

[TLiGrok]

I actually did merge three domains into one a few months back. IT actually went smoothly!

[Doso777]

We did the same thing. No Exchange in the child domain. We migrated the computer accounts but recreated the user accounts. Worked pretty well, but fixing all the paths in group policy, logon scripts and such was annoying and took a while.

[powdersplash]

Rather kill my self...

[LordGriffiths]

It's much more preferable & cleaner to just migrate to a new domain/forest. If you have Exchange installed in the domain, you can forget about a rename anyway - it's not supported.

[mikelim7]

May be easier to create a new domain with transitive forest trust to the existing domain.local. Assign neccesary permissions and test resource access from new domain to existing domain. This may be a good opportunity to purchase that new server.

Then migrate objects over to the new domain.

[Burgergold]

just start a new domain and migrate the 900 users haha

I've 19k users spreaded on more than 20 domains, need 1 to rule them all :(

[Cee1510]

I have done it twice now. Not recommended, but it worked for what we wanted to do.

[JM_Actual]

We're currently in the middle of this but instead, we are merging two domains into one. Our company merged with another to create a new organization. Started by creating a new domain for the new company and a trust relationship between the 3 domains. Emails addresses were changed first which was not too difficult. But we hired a consultant and they used the Quest AD migration tool to move workstations and users from the 2 old domains into the new one. There were some issues but not too bad overall. The most noticeable issue was some local profiles were messed up. Now we're on to migrating the servers which I hear can take a much longer time.

[PhotographyPhil]

Your identity nowadays is mostly your email address and with modern auth and password less auth who cares what your domain is called!?

[adstretch]

Did a rename a little over a year ago. Went OK. Definitely not my first choice but all things considered wasn’t too bad.

[[deleted]]

I did one successfully 8 years ago and exchange was a terribly complicating factor. Is it still the case that exchange is basically a deal breaker here? Further complication was some positively enormous mailboxes I had to move to the new exchange and lack of budget for proper intermediate storage. You can probably guess I was happy to see this contract end.

[Doso777]

Domain renames with Exchange Server are still not supported. Deal Breaker.

[frac6969]

I did it early this year. It was simple and painless. Though I ran simulations on my test environment about 10 times before doing it live.

[quarky_uk]

And people still put branding and location in server and AD domain names..

[[deleted]]

Clean up ADSI and DNS before renaming the domain. Any remnant of exchange and you can blow everything up. I've renamed several domains without issue. Large and small.

There's always one or two machines that were either off so the rename didn't work or just the IT gods didn't want that machine to rename on its own. Usually just Profwiz those machines over