Need Guidance for Cross forest SCCM design and implementation... this is a good one for all you design gurus !!
Hello all,I am working with a client that has a unique scenario. They have two domains in two seperate forests. Domain A in Forest A and Domain B in Forest B. Domain A is the primary domain as of now, however, in the next 3 months, they will be migrating all computer accounts to Domain B to coincide with their legal name change. Domain A will be decommissioned. SCCM must be implemented before the migration and all machines must be able to be managed before and after the migration. Operating Systems deployment is to be a primary design consideration. Other considerations are remote control and reporting. The environment is only for 200 clients, but will be extended to over 4000 in the next 5 years.Here is what I am thinking so far:I will install the core SCCM infrastructure (central site, child primary, child secondaryetc, etc) in Domain B, the one that will be migrated to. Using the SCCM infrastructure in Domain B, we'll manage the machines in Domain A across forests and the SCCM site will span both forests. By doing this, we can effectively manage computers in both forests before, during, and after the migration as they move their computer accounts across and join them to the new domain. I'm aware that this setup isn't the best, but because of the small environment, I do not think performance will be a major concern. And after the migration takes place, things will be fine as the clients are 'reassigned' to the new domain.I'm familiar with the documentation, but I'm a bit shaky on some of the steps necessary to complete this setup. Not so much the steps for Domain B, but for 'extending' management to domain A with no SCCM infrastructure. Here are the questions I have:1. First, does this sound feasible?2. Will I need a server locator point in Domain A? How can I do that with no SCCM servers in Domain A?3. I'm a bit confused by what the documentation means by 'other means for site compatibility check'... can anyone elaborate?4. I'm aware that if we don't put a primary site server in Domain A, we will not be able to leverage SCCM reporting. Am I correct in stating this?5. I am going to build out the secondary sites in Domain B as if Domain B is going to be leveraged right from the get go. We'll push packages out to these as they will be configured as distribution points. I somewhat understand how roaming works, but my question is that even though secondary sites cannot span multiple forests, would a client in Domain A be able to roam to one of those secondary sites configured as a distribution point in Domain B if they are on the same subnet, even though logically, they are in seperate environments? Also, is this possible for OSD?6. I am going to leverage AD Sites in Domain B for site boundaries. However in Domain A, I am going to leverage IP subnets. These will essentially be the same. For example, I want to configured a site boundary for Domain B in SCCM for an AD site Balitmore, and also configure a site boundary for Domain A in SCCM for 10.10.10.x, which is also the same Balitmore location. As long as the clients are not moved over to Domain B, I don't think this will be a problem. Does anyone see a problem with this? How would I go about creating this scenario so that once the machines are migrated, there will be no additional work necessary in AD or SCCM?Thanks to anyone who replies..... unfortunately, the timeline for this project is rather aggressive and build starts next week !!-M
May 6th, 2009 5:39pm

Hi,That sounds like an interessting setup.1) It's sounds OK to me2) I would install the SLP in domain B. You don't need any Config Mgr. servers in Domain A. Just threat the clients in Domain A as workgroup clients.3) compatibility check? I am not sure what you mean about that4) No, you will be able to use reporting. Inventory data will be send from the clients to the DB.5) The clients in Site A should be able to perform regional roaming (roaming as if the schema is not extended). Regional romaing allows them to roam to any child site of their own assigned site6) hmm, overlapping boundaries are not supported. But in this scenario I think it will work since you are just creating double boundaries for the same site. I hope the answers are clear, if not let me know.Kent Agerlund | http://agerlund.spaces.live.com/blog/
Free Windows Admin Tool Kit Click here and download it now
May 6th, 2009 6:28pm

Thanks Kent !!So how about all this with OSD being the primary design consideration? If at all possible, I'd like to avoid putting a child primary in Domain A, but I have a feeling that the OSD peformance would be horrible in the scenario above since traffic would be over the WAN for every client in Domain A.But you are right, this is a tough one because they'd like management functionality, but I believe the risk outweighs the reward since they will be migrating and decomming Domain A iover the next3 months.
May 6th, 2009 7:03pm

Hi,I have a setup at a customer site where OSD works great in another forest. So I don't think it is going to cause any problems for you. BTW I did mean interesting like in a good challenge :-)Kent Agerlund | http://agerlund.spaces.live.com/blog/
Free Windows Admin Tool Kit Click here and download it now
May 6th, 2009 7:29pm

Thanks a ton Kent !! This information helps a great deal !! If I run into any issues, I'm sure I'll be posting here, so stayed tuned !!! :)
May 6th, 2009 9:23pm

Hi Kent, I have a similar scenario, however, I want to use AD Sites from both Forests. How do I go about doing that? Or can't I? I've tried browsing for the AD Site in the second forest but only see sites from the first forest. Thanks
Free Windows Admin Tool Kit Click here and download it now
January 19th, 2011 10:20am

Please avoid double postings in the future, see http://social.technet.microsoft.com/Forums/en-US/configmgrsetup/thread/e4bd6c0a-fc1e-480b-bdf3-b51bf79a000c/.
January 19th, 2011 10:41am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics