Migrating .local AD Domain to .com AD Domain While Preserving Entra ID Sync

Question

What are the key considerations and potential issues when migrating a WS2012R2 Active Directory .local domain to a WS2025 .com domain? Is it advisable to use ADMT for this migration, and how can the existing Entra ID sync be maintained given that the UPNs are already in use for syncing to Entra ID?

Answer 1

Hello,

Thank you for posting the question on Microsoft Windows forum!

Based on your query of migrating a WS2012R2 Active Directory .local domain to a WS2025 .com domain which requires careful planning. The followings are key points and potential issues to consider when performing domain migration.

1. Domain Name Change Impact: Changing from .local to .com affects authentication, Group Policy Objects (GPOs), and application dependencies.
2. User Principal Name (UPN) Updates: Since UPNs are already in use for Entra ID sync, ensure that the new domain suffix is properly registered and verified in Microsoft Entra ID.
3. Group Policy Migration: Policies tied to the old domain may need to be recreated or adjusted.
4. Service Account Dependencies: Applications relying on service accounts may need reconfiguration.
5. DNS and Certificate Updates: Ensure that DNS records and SSL certificates reflect the new domain. Regarding the use of Active Directory Migration Tool (ADMT) can be useful for migrating users, groups, and computers between domains. However, ADMT v3.2 has known issues and limited support. You can check the following articles for further reference about ADMT.

• https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/support-policy-and-known-issues-for-admt
• https://www.microsoft.com/en-us/download/details.aspx?id=56570 To maintain existing Entra ID sync, given that the UPNs are already in use for syncing to Entra ID. You can refer to below articles for further information.
• https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/howto-troubleshoot-upn-changes
• https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/user-prov-sync/use-upn-matching-identity-sync
• https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/tshoot-connect-sync-errors#invalidsoftmatch Hope the above information is helpful!