Best solution for local domain setup for 2 remote office

Hi There,
we have 2 offices with about 10 users in each office. We have setup the
local domain for office1 with the name of Domainname.local. Since we have
mobile users travel between these 2 office from time to time, we need make
the user login transparent for mobile users. Now we need setup the local
domain for office2, to reduce the complexisity and ease management, we don't
want setup the domain delegate to achieve this, and we are going to setup the
same domain name (Domainname.local) in the office2 and create exact same user
login and password for all users which already in office1 server.
Since the 2 domain servers physically located remotely with different
Security ID, will this setup fulfil my requirement? If not, what is the best
way I can achieve this?

Many thanks in advance!
Shermaine

Hello xiaomei,

You can add an additional Domain controller to your existing domain and make
it DNS server Global catalog server. Then, after replication, reconfigure
the ip addresses for the other office and shut it down, move it to the other
office. Setup a new subnet and site in Active directory sites and services
for the other office. Configure all machines with the new DNS server ip address
so that they use as preferred DNS server the machine where they work mostly.
Now your users can use the domain machines/accounts and login to the existing
domain doesn't matter which office they are.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Hi There,
> we have 2 offices with about 10 users in each office. We have setup
> the
> local domain for office1 with the name of Domainname.local. Since we
> have
> mobile users travel between these 2 office from time to time, we need
> make
> the user login transparent for mobile users. Now we need setup the
> local
> domain for office2, to reduce the complexisity and ease management, we
> don't
> want setup the domain delegate to achieve this, and we are going to
> setup the
> same domain name (Domainname.local) in the office2 and create exact
> same user
> login and password for all users which already in office1 server.
> Since the 2 domain servers physically located remotely with different
> Security ID, will this setup fulfil my requirement? If not, what is
> the best
> way I can achieve this?
> Many thanks in advance!
> Shermaine

If you think by creating a new domain with all the same names, it will some
how fake out the system, it won't. All the internal machine id's sid's,
guid's, etc... will be different. The best bet for you would be to setup a
vpn between the two sites and bring up a second dc and allow it to sync with
the first.

-
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.

"xiaomei" <xiaomei@discussions.microsoft.com> wrote in message
news:58BC4A56-4F2C-457F-AEDE-2335D00DE16B@microsoft.com...
> Hi There,
> we have 2 offices with about 10 users in each office. We have setup the
> local domain for office1 with the name of Domainname.local. Since we have
> mobile users travel between these 2 office from time to time, we need make
> the user login transparent for mobile users. Now we need setup the local
> domain for office2, to reduce the complexisity and ease management, we
> don't
> want setup the domain delegate to achieve this, and we are going to setup
> the
> same domain name (Domainname.local) in the office2 and create exact same
> user
> login and password for all users which already in office1 server.
> Since the 2 domain servers physically located remotely with different
> Security ID, will this setup fulfil my requirement? If not, what is the
> best
> way I can achieve this?
>
> Many thanks in advance!
> Shermaine

Hi
As others said it doesn't work like that.

--
I hope that the information above helps you.


Have a Nice day.

Jorge Silva
MCSE, MVP Directory Services

Thanks so much, Meinolf, Paul, Jorge!
So unlucky, this DC also serve as file server for the office, and I already
did the DC setup with hundreds GB of data sharing for internal user. Now what
I can do is remove the DC and make the server in the network group and setup
the suggested domain on other server late on.
However I am worry after downgrade the DC to work group member server, will
the user acc with access right assigned to the existing shared folder corrupt?

Thanks again!

Shermaine


"Jorge Silva" wrote:

> Hi
> As others said it doesn't work like that.
>
> --
> I hope that the information above helps you.
>
>
> Have a Nice day.
>
> Jorge Silva
> MCSE, MVP Directory Services

Hello xiaomei,

Unfortunally if you demote the server to a member server all domain accounts
are removed and also the permissions. What you can do is to set the rights
for everyone after demoting, but ofcourse this is not the way you like to
have it i think. How may user do you have on the second office?

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Thanks so much, Meinolf, Paul, Jorge!
> So unlucky, this DC also serve as file server for the office, and I
> already
> did the DC setup with hundreds GB of data sharing for internal user.
> Now what
> I can do is remove the DC and make the server in the network group and
> setup
> the suggested domain on other server late on.
> However I am worry after downgrade the DC to work group member
> server, will
> the user acc with access right assigned to the existing shared folder
> corrupt?
> Thanks again!
>
> Shermaine
>
> "Jorge Silva" wrote:
>
>> Hi
>> As others said it doesn't work like that.
>> -- I hope that the information above helps you.
>>
>> Have a Nice day.
>>
>> Jorge Silva
>> MCSE, MVP Directory Services

You could look at doing a domain name change and then set up a forest trust
between the two forests and do a migration. This way you could move all of
your access definitions and data across without losing what you have already
done. It might be easier though to just rebuild.

--
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.

"xiaomei" <xiaomei@discussions.microsoft.com> wrote in message
news:4FB8C95F-3A2E-4236-8C57-49161EF02C27@microsoft.com...
> Thanks so much, Meinolf, Paul, Jorge!
> So unlucky, this DC also serve as file server for the office, and I
> already
> did the DC setup with hundreds GB of data sharing for internal user. Now
> what
> I can do is remove the DC and make the server in the network group and
> setup
> the suggested domain on other server late on.
> However I am worry after downgrade the DC to work group member server,
> will
> the user acc with access right assigned to the existing shared folder
> corrupt?
>
> Thanks again!
>
> Shermaine
>
>
> "Jorge Silva" wrote:
>
>> Hi
>> As others said it doesn't work like that.
>>
>> --
>> I hope that the information above helps you.
>>
>>
>> Have a Nice day.
>>
>> Jorge Silva
>> MCSE, MVP Directory Services

Hi xiaomei
You don't need to demote anything, the user will have a fix account in one
of the domains, in the other you can create an additional account that the
user can use when trying to access to the resources on that forest. Better
way would be to do as Paul suggested (if possible create a trust between the
forets and assign the access to the proper user in the proper forest).

--
I hope that the information above helps you.


Have a Nice day.

Jorge Silva
MCSE, MVP Directory Services

Very appreciate your help, Meinolf, Paul, Jorge!
One worry about rename the domain name, if the domain name changed, the
associated domain user account will changed accordingly or corrupted?

Many thanks!

Shermaine

"Jorge Silva" wrote:

> Hi xiaomei
> You don't need to demote anything, the user will have a fix account in one
> of the domains, in the other you can create an additional account that the
> user can use when trying to access to the resources on that forest. Better
> way would be to do as Paul suggested (if possible create a trust between the
> forets and assign the access to the proper user in the proper forest).
>
> --
> I hope that the information above helps you.
>
>
> Have a Nice day.
>
> Jorge Silva
> MCSE, MVP Directory Services
>
>

Hello xiaomei,

Renaming the domain will not have an effect on the users, they normally just
see the new netbios name in the logon window.

Have a look here about domain rename.:
http://technet.microsoft.com/en-us/l.../cc738208.aspx

http://blogs.dirteam.com/blogs/jorge...11/24/154.aspx

http://blogs.dirteam.com/blogs/jorge...5/24/1037.aspx

With Exchange installed:
http://technet.microsoft.com/en-us/m.../cc160789.aspx

http://support.microsoft.com/kb/838623

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Very appreciate your help, Meinolf, Paul, Jorge!
> One worry about rename the domain name, if the domain name changed,
> the
> associated domain user account will changed accordingly or corrupted?
> Many thanks!
>
> Shermaine
>
> "Jorge Silva" wrote:
>
>> Hi xiaomei
>> You don't need to demote anything, the user will have a fix account
>> in one
>> of the domains, in the other you can create an additional account
>> that the
>> user can use when trying to access to the resources on that forest.
>> Better
>> way would be to do as Paul suggested (if possible create a trust
>> between the
>> forets and assign the access to the proper user in the proper
>> forest).
>> -- I hope that the information above helps you.
>>
>> Have a Nice day.
>>
>> Jorge Silva
>> MCSE, MVP Directory Services