Preeminent Solutions, Inc. home

Active Directory Migration and Consolidation

For organizations with several directories after years of growth or acquisitions, where people juggle several accounts.

We move several Active Directory domains into one new forest, which means one account for each person. Users and workstations move in nightly waves while the old forests coexist, planned so sign-in keeps working throughout.

Request a meetingRead the case study
Technologies
Active DirectoryMicrosoft Entra IDMicrosoft Entra ConnectMicrosoft Identity ManagerConfiguration ManagerMicrosoft IntuneMicrosoft Defender for EndpointServiceNow

How we help

The consolidation runs from design through the last server, and identity provisioning from your HR or student system keeps the new directory clean afterwards.

Directory consolidation

A new forest with coexistence to the old, users and workstations moved in nightly waves, servers and applications by group, and the old forest retired.

What you get

  • Design document, migration process, and master spreadsheet
  • Group Policy copied, remediated, and frozen during the move
  • Entra Connect set so each object syncs from one forest
  • A pilot per domain, then nightly waves of an agreed size
  • Profile-preserving workstation moves, a nightly report to the help desk
  • Servers and applications by group, privileged accounts last

Best for

A root forest with a dozen child domains, and tens of thousands of users who must not notice on Monday morning.

Identity provisioning from your systems

Accounts created, updated, and removed from your HR or student system after the move, delivered as the identity lifecycle automation in Identity and Access.

What you get

  • Provisioning design and runbook
  • Synchronization rules for joiners, movers, and leavers
  • Attributes for department, manager, location, and title
  • QA with your systems team, then production

Best for

A new directory that should take its accounts from HR or the student system, not by hand.

See Identity and Access

Case studies

All case studies

Questions we get

How long does a directory consolidation take?

It depends on how many domains, accounts, and applications move, so the proposal sets the schedule. The Assess phase typically takes 3–4 weeks, then a pilot runs for each domain, followed by nightly waves.

Will people notice?

The goal is that Monday morning looks like Friday: the same profile, the same drives, the same applications. Where sign-in names change, we tell people a week before and the day before, and the help desk gets a report each night of who moved.

What is the biggest risk?

Changing sign-in name, email, and account name at once, and letting an object sync to Entra ID from two forests. The design holds legacy names as stable attributes for applications, freezes Group Policy changes during the move, and locks each object to one sync source.

Can applications keep working during the move?

Yes, each by its own method: Windows applications through a trust and SID history, cloud applications through substitute claims or SCIM, LDAP applications through a multi-directory configuration or a parallel instance. LDAP applications cannot use SID history, so they are planned first.

What changes the size of a consolidation?

Mostly how many domains, accounts, and workstations move, and how many Group Policy objects and applications need remediation. The number of sites we work with and whether identities are created automatically afterwards add to it.

Do we need new domain controllers?

Usually, sized for the combined load. Undersized domain controllers put a consolidation at risk, so the design states the sizing and your team builds or funds them before the pilot.

Talk to us about Active Directory Migration and Consolidation

It starts with a 60-minute call. If we need more to scope it, a short questionnaire follows. Then a written proposal and statement of work. Once you approve, we begin with the Assess phase.

Request a meetingOr call (516) 240-8079