Merge windows domain to UCS current new domain

UCS - Univention Corporate Server
#1

I have 4 domains (domain1 domainX, domainY and domainY) and i want merge them to only DOMAIN1.

I use ad takeover so now i have one UCS server with DOMAIN1 and is up and running ok.
The next step i need to do is merge the other domains (x,Y and Z) to domain1, any clue what should i do?
I guess i can’t use takeover again… or should i do AD takeover in domainX and then is some process to merge UCS domain1 and ucs domainX ?

Mergen von UCS AD domains
Mergen von UCS AD domains
#2

I’d recommend to merge the domains and to do the ucs migration with takeover as last step.
Honestly, I have no idea how to proceed, but I’m confident that it’s possible.

Perhaps this already helps: windowsitpro.com/windows-server/ … ger-part-1

edit: Perhaps a multi-instance ad connector setup would also be a nice alternative!

#3

I have done the first ad takeover. It was need to do first.

So now i have 3 windows domains, and 1 ucs samba domain.

#4

I’m assuming that you want to do this migration exactly once and ditch the old WIndows domains afterwards. For this you can use the Univention ActiveDirectory Connector. It can implement a one-way synchronization of users and groups from a Windows domain to a UCS domain.

So for your case I’d suggest you install the AD connector, configure it against the second AD domain, and let it sync. Then you re-configure the AD connector against the third Windows domain and let it sync once more. Finally repeat this for the fourth AD domain. Afterwards the AD connector can be uninstalled again.

The result should be a UCS domain that contains all users and groups of the four former AD domains.

Note that name conflicts may cause problems, e.g. the members of well-known groups like Administrators will probably be overwritten by subsequent syncs.

I haven’t implemented such a scenario yet, but it should work.

What you cannot do in such a scenario is migrate the computer accounts from the other three domains if I’m not mistaken.

#5

Well i’m not sure to try that :frowning: because is a fact that i will have users with same name. Ad connector don’t allow for instance sync to inside a OU or a subdomain to avoid conflicts?

#6

Not at the moment, no. It’s a known bug/missing feature/whatever you want to call it.

Mastodon