Re: Flat domain to start off?

Hi Brian,

Thank you very much for your response. We have about 800 users at the
moment. I was told I need to assign each domain controller as a GC server.

So with a flat domain, everyone will belong to company.com similar to our
existing configuration. I think this is the easiest way to do. However, if
I do need to move computers/users to a sub-domain, would it be too difficult
to do?

Thanks again for your help.

John


"Brian Delaney" <BrianDelaney@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:13FD20BB-CBCB-4ECF-A017-64E361D7B973@xxxxxxxxxxxxxxxx
Whenever possible a single domain is the way to go. Replication in 2003
is
also much more efficient and configurable then NT4. You can easily create
Sites with schedules to allow replication to your overseas offices during
offpeak hours. Also, with the configuration of subnets you will be able
to
control the DCs that your client computers authenticate against to prevent
authentication from crossing slow WAN links.

If you do however have a substantial number of users (>50,000) you may
want
to consider additional domains based on geographic location to further
reduce
the replication. But I suspect since you are using a single NT4 domain
you
do not have nearly that many users.

One important thing to watch for when moving to 2003 is that XP and 2000
clients will not authenticate against NT4 BDC once they have
authenticaticated against a 2003 DC. So you may want to have a look at
the
article: http://support.microsoft.com/kb/298713/en-us which dicusses how
to
prevent overloading your first 2000/2003 domain controller by utilizing
the
NT4Emulator registry key.

Hope this helps,

Brian



"John" wrote:

Currently we have NT4 domain structure across our sites - 2 main offices
and
few small remote offices overseas. Each office location has a different
IP
address range such as:

office 1 - 10.1.x.x
office 2 - 10.10.x.x
office 3 - 10.20.x.x

At the present time, it's one flat domain. Can we start off with
upgrading
our existing NT4 PDC to AD 2003, keeping the same structure and same
domain
name as our existing NT4 domain. Down the road, create sub-domains and
migrate users and computers to these sub domains? One sub-domain can be
like office1.company.com and move all computers/users that belong to
office
location 1 to that domain.

One thing I'm concern is we have slow links between oversea offices. At
the
present time, these offices have local BDCs but we have to block the
traffic
between PDC and BDC, or else it kills the link. Would keeping a flat
domain
doable?

Appreciate your comments.






.

Relevant Pages

  • Re: AD 2003 Replication Failure/Authentication Failure
    ... >Verify time is synchronized on all DCs. ... users can authenticate to the Seidler-root domain controller, ... users can authenticate to the enterprise domain controller. ...
    (microsoft.public.windows.server.active_directory)
  • Forcing authentication with a specific DC
    ... I take it your PDC ... specific domain controller, that domain controller ... controller that holds the PDC emulator role. ... I want them to authenticate at the main ...
    (microsoft.public.win2000.security)
  • Re: User authenication from remote site ?
    ... There is a domain controller at the Head Quarter ... Users at remote site finds that the response time for accessing data ... Replication of data of AD between HQ and RS ... Users at RS has to authenticate via HQ ...
    (microsoft.public.windows.server.active_directory)
  • Re: NT4 and W2K3 Questions
    ... As long as the NetBIOS domain names are different (XYZ v. XYZ123), ... Is there a way to bring up the W2K3 box (which is right now a stand ... (which will then allow me to demote/shutdown the two NT4 controllers?) ... An AD domain controller for the domain XYZ cannot be contacted, ...
    (microsoft.public.windows.server.general)
  • Re: Native Mode possible problems...help!
    ... >> Todd J Heron, MCSE ... >>> know which domain controller authenticates them if they are tech ... How can I verify which domain controller they authenticate ...
    (microsoft.public.windows.server.general)