We have applications that use Active Directory for access control, but our point-in-time test copies have drifted from production. Is there a way to keep a separate test domain current, including OUs and groups but not necessarily every user?
Can we keep a test Active Directory domain in sync with production?
Asked by
vaguely_perpendicular
Answers
Not as a native selective mirror between independent domains. Normal AD replication is between domain controllers in the same domain, so adding another DC gives you another production replica, not a separate environment where changes are safe to test.
For a separate forest, scripted export and import is one option. You could export OUs and groups with the AD PowerShell cmdlets and recreate them on a schedule. Decide how to handle group membership when some users are deliberately omitted, and test the sync process itself. Matching object names and structure does not make the two domains identical.
Reply to this answer
If you need a close copy for a particular test, restore a recent AD backup into an isolated lab along with the application machines you need. Run the test, then discard the lab and build a fresh one next time.
Keep the lab properly isolated from production. A restored copy is useful for realistic testing and recovery exercises, but it is a point-in-time copy rather than a continuously updated independent domain.
Reply to this answer
First pin down what has to match. For application integration, a representative set of users, nested groups and OUs may be enough. If the test is about a production configuration change, a small sample might miss the thing you're trying to catch.
Consider managing the relevant test configuration alongside production changes, so the test environment doesn't depend entirely on occasional refreshes.
Reply to this answer
Do the teams need a separate domain at all? Depending on what they're changing, a development OU with delegated access and test machines might cover it. That is still part of production, though, so it is not a safe substitute for an isolated domain when testing changes with wider effects.
Reply to this answer
If the applications only need a directory interface, look at whether Active Directory Lightweight Directory Services fits their tests. Separate instances could give teams disposable directory data, potentially populated with a subset of AD. Check the application's requirements first, since that is not the same as a full AD domain.
Reply to this answer
Add your answer
Answers are reviewed before publication.
square.one.again:
That distinction matters for access control testing. A group can exist in both places but still behave differently if its members or other relevant settings are missing.