Synchronizing Forests Without Using Trusts

My company has multiple Active Directory (AD) forests for security reasons. We can't have trust relationships between the forests for the same reasons that caused us to divide our AD infrastructure into different forests. However, our employees still need to communicate with and find each other in Microsoft Exchange Server and other applications, no matter what division the employees are in. How can we get the best of both worlds—using multiple forests while having just one Global Catalog (GC)?

The free Microsoft Identity Integration Feature Pack 1a for Windows Server Active Directory, which is a subset of Microsoft Identity Integration Server (MIIS) 2003 Enterprise Edition, lets you take advantage of MIIS's directory synchronization features to synchronize AD forests.

The full MIIS 2003 Enterprise Edition lets a large organization connect scores of different directories and databases for a full identity-management solution. Smaller companies that don't have the resources to roll out a full MIIS implementation can deploy Identity Integration Feature Pack 1a, which supports integration between AD and AD Application Mode (ADAM) installations and comes with a management agent for the AD Global Address List (GAL). The agent is preconfigured with rules for synchronizing data between AD forests in which you've enabled Exchange Server 2003 or Exchange 2000 Server to create a GAL across the entire enterprise.

Identity Integration Feature Pack 1a is great for companies such as yours that require multiple forests and is a lifesaver for companies that merge and want their separate forests to appear as one forest to the users. By upgrading the forests to Windows Server 2003, implementing cross-forest trusts, and connecting the address lists via Identity Integration Feature Pack 1a, the new combined company can reap the benefits of one forest without the rip and repair costs associated with actually merging two forests.

There is one caveat, though: Although there's no charge for Identity Integration Feature Pack 1a, you must have a Windows Server Enterprise Edition system available to run the feature pack and a Microsoft SQL Server Standard Edition or Enterprise Edition server for the database that the feature pack creates and maintains. You can learn more about Identity Integration Feature Pack 1a and download it at http://www.microsoft.com/downloads/details.aspx?FamilyID=d9143610-c04d-41c4-b7ea6f56819769d5&DisplayLang=en.

—Randy Franklin Smith

End of Article