Discussion Locked

Adding a Server box from another domain

0 helpful
13 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
The company I work for just acquired another business. I need to add an NT 4.0 Server box from under their domain name to my Windows 2000 mixed domain environment. It is not required to keep their domain name. The desired result is to add the boxto my domain and gain access to the information from programs currently used on my domain. I would greatly appreciate any tips and tricks, do's and don'ts, and any information that would point me in the right direction so I can start down the best path to accomplish the task. Thanks, Robert

13 replies

by joseph moore

I am going to guess that the new NT4 Server is NOT a PDC/BDC. It does not sound like it is from your description.
Ok. 1) Right-click Network Neighborhood -> Properties -> Protocols -> TCP/IP.
Give the NT box an IP address, subnet mask and default gateway that are compatible with your network. Reboot.
2) Right-click Network Neighborhood -> Properties -> General tab. Click the Change button. Select Workgroup option. Reboot
3) Right-click Network Neighborhood -> Properties -> General tab. Select Domain. Put in the NetBIOS name of your Windows 2000 mixed mode domain in the box. Reboot

That is it. The server is now a member server of your 2000 domain. Log in as your Domain Administrator, and start making any necessary security changes. Applications will run on the box as normal, as long as no services/applications run under preconfigured NT accounts from the old domain. For example, if they configured a Service to run under the old domain's Administrator account, you would have to go and change it to your Domain Admin account. If there is an error on startup, check Servies, the Log On As section of any faied service.
I really can't think of any "gotchas" involved in switching domains like this.

Hope this helps.

by robertd.

Joseph, Thanks for the super answer. The NT 4.0 box was/is the PDC for the former company (sorry, should have included that info). If you can give me further instructions that would be great, either way I'll be sending you some points. Thanks, Robert

by chris hirst

As the server was a PDC the solution will be quite easy. You simply set up a trust to your domain and add the required user groups to the share permissions.
If you want it to join your domain (as a BDC) the solution can get quite involved. Ideallyyou could do with a BDC from the same domain which you then promote to the PDC (you cannot easily change domains on a PDC ), Then isolate your [now BDC] server from the PDC (this will be your fallback should something go wrong) and delete all the users apart from Administrator, Change the password to the same as your domain, Take Ownership of ALL folders and files and reset all share\ntfs permissions to 'Everyone'
Stop the Netlogon and Replication services, also if WINS, DNS, DHCP are on this server stop them and set the startup to be Disabled and check what services are using domain accounts to logon to.
If at all possible you should just have this server and your PDC only connected (just to minimize any possible network disruption). You now have to add the machine name to Server Manager as a Backup Controller ( on your PDC) and restart Netlogon
At this point you should be able to goto network properties and from the Identification tab click the change button and enter your domain name, You will have to supply credentials allowing the machine to join the domain and you will get warnings about why it is not a good idea to do this, If everything has worked at this point you will need to restart your machine. When the machineis back up you should be able to logon (as administrator) and Synchronize with the PDC, put the machines back onto the network and Synchronize the domain. You can then set all permissions on shares, folders etc. One point to note is that if the server is running Exchange or SQL etc changing domains will stop these working until you have patched the exchange database and reset permissions on SQL.

Hope this helps

Chris

by chris hirst

Had to add a comment ran over length

I've read this through twice I don't think I missed anything out. All in all the trust is easier and can be achieved in about 15 mins

Chris

by curacao_dejavu

I do agree with both answers, however I would consider one more thing.
From an "inherited" system you would not know for example which patches are implemented, if the system was comprised in any way (hacked) , which drivers are installed and way etc.
The procedure of the previous answers would not take long to implement (+ 30 min), reinstalling etc would take obviously much more time but you have the "benefit" that know it's a clean system.
I have myself expererinced twice already that a "inherited" system wasn't configured accordingly to our situation and after trying to convert it to our situation, we installed the system from scracth, and now our policy is to install every new system from scratch.

Just giving you some food for thought.

Leopold

by sativocomputerservices

just my 2 sense, run dcpromo and get rid of the domain controller aspect of the box first. The best situation you can do is to trust the old company's domain with yours and disable all their accounts after you add yours in. If you are going to merge, definitely demote it so you won't have two leveles of security to deal with.

This discussion is closed to new replies.