Migrating Accounts Without Using SID History
3. When the wizard finishes, click View Log, and review the migration log for any errors
4. Open Active Directory Users and Computers, and verify that the user accounts exist in the appropriate OU in the target domain.
To migrate user accounts by using the ADMT command-line option 1. On the computer in the target domain on which ADMT is installed, log on by
using the ADMT account migration account.
2. At the command line, type the ADMT User command with the appropriate parameters. For example:
ADMT USER /N "user_name1" "user_name2" /SD:"source_domain"
/TD:"target_domain" /TO:"target_OU" /MSS:YES /TRP:YES /UUR:YES
Alternatively, you can include parameters in an option file that is specified at the command line as follows:
ADMT USER /N "user_name1" "user_name2" /O "option_file.txt"
The following table lists the common parameters used for migrating user accounts, along with the command-line parameter and option file equivalents.
Parameters Command-Line Syntax Option File Syntax
Source domain /SD:"source_domain" SourceDomain="source_domain"
Source OU location
/SO:"source_OU" SourceOU="source_OU"
Target domain /TD:"target_domain" TargetDomain="target_domain"
Target OU location
/TO:"target_OU" TargetOU="target_OU"
Migrate SIDs /MSS:YES MigrateSIDs=YES
Conflict management
/CO:IGNORE (default) ConflictOptions=IGNORE
Translate Roaming Profile
/TRP:YES (default) TranslateRoamingProfile=YES
Update User Rights
/UUR:YES UpdateUserRights=YES
Password Options
/PO:COMPLEX (default) PasswordOption=COMPLEX
3. Review the results that are displayed on the screen for any errors.
4. Open Active Directory Users and Computers and locate the target OU. Verify that the users exist in the target OU.
To migrate user accounts by using a script
• Prepare a script that incorporates ADMT commands and options for migrating users by using the sample script shown in the following listing. Copy the script to Notepad, and save the file with a .wsf file name extension in the same folder as the AdmtConstants.vbs file.
<Job id=" MigratingAllUserAccountsBetweenForests" >
<Script language="VBScript" src="AdmtConstants.vbs" />
<Script language="VBScript" >
Option Explicit
Dim objMigration Dim objUserMigration
'
'Create instance of ADMT migration objects.
'
Set objMigration = CreateObject("ADMT.Migration" ) Set objUserMigration = objMigration.CreateUserMigration
'
'Specify general migration options.
'
objMigration.SourceDomain = "source domain"
objMigration.SourceOu = "source container"
objMigration.TargetDomain = "target domain"
objMigration.TargetOu = "target container"
objMigration.PasswordOption = admtComplexPassword objMigration.ConflictOptions = admtIgnoreConflicting
'
'Specify user migration specific options.
'
objUserMigration.MigrateSIDs = True
objUserMigration.TranslateRoamingProfile = True objUserMigration.UpdateUserRights = True objUserMigration.FixGroupMembership = True objUserMigration.MigrateServiceAccounts = False
'
'Migrate specified user objects.
'
objUserMigration.Migrate admtData, Array("user name1" , "user name2" )
Set objUserMigration = Nothing Set objMigration = Nothing
</Script>
</Job>
Translating Security in Add Mode
Translate security on servers to add the SIDs of the user and group accounts in the target domain to the access control lists (ACLs) of the resources. After objects are
migrated to the target domain, the objects contain the ACL entries from both the
source and the target domains. Use the Security Translation Wizard in ADMT to add the target domain SIDs from the migrated objects. Run the Security Translation Wizard on all files, shares, printers, local groups, and at least one domain controller (to translate security on shared local groups).
You can translate security in add mode on objects by using the ADMT console, the ADMT command-line option, or a script.
To translate security in add mode on objects by using the ADMT console 1. On the computer in the target domain on which ADMT is installed, log on by
using the ADMT account migration account.
2. Use the Security Translation Wizard by following the steps provided in the following table.
Wizard Page Action
Security Translation Options Click Previously migrated objects.
Domain Selection Under Source, in the Domain drop-down list, type or select the NetBIOS or Domain Name System (DNS) name of the source domain. In the Domain controller drop-down list, type or select the name of the domain controller, or select Any domain controller.
Under Target, in the Domain drop-down list, type or select the NetBIOS or DNS name of the target domain. In the Domain controller drop-down list, type or select the name of the domain controller, or select Any domain controller, and then click Next.
Computer Selection Click Select computers from domain, and then click Next. On the Computer Selection page, click Add to select the computers for which you want to translate security, click OK, and then click Next.
- or -
Click Read objects from an include file, and then click Next. Type the location of the include file, and then click Next.
Translate Objects Clear the User Profiles check box.
Select all other check boxes.
Security Translation Options Click Add.
ADMT Agent Dialog Select Run pre-check and agent operation, and then click Start.
3. Review the results that are displayed on the screen for any errors. After the wizard completes, click View Migration Log to see the list of computers, completion status, and the path to the log file for each computer. If an error is reported for a computer, you will need to refer to the log file on that computer to review any problems with local groups. The log file for each computer is named MigrationTask#_ComputerName.log and is stored in the
Windows\ADMT\Logs\Agents folder.
To translate security in add mode on objects by using the ADMT command-line option
1. On the computer in the target domain on which ADMT is installed, log on by using the ADMT account migration account.
2. At the command line, type the ADMT Security command with the appropriate parameters. For example:
ADMT SECURITY /N "computer_name1" "computer_name2"
/SD:"source_domain" /TD:"target_domain" /TO:"target_OU" /TOT:Add
Alternatively, you can include parameters in an option file that is specified at the command line as follows:
ADMT SECURITY /N " computer_name1" " computer_name2" /O
"option_file.txt"
The following table lists the common parameters used for migrating user accounts, along with the command-line parameter and option file equivalents.
Parameters Command-Line Syntax Option File Syntax
Source domain /SD:"source_domain" SourceDomain="source_domain"
Target domain /TD:"target_domain" TargetDomain="target_domain"
Security translation options
/TOT:Add TranslateOption=ADD
3. Review the results that are displayed on the screen for any errors. After the wizard completes, click View Migration Log to see the list of computers, completion status, and the path to the log file for each computer. If an error is reported for a computer, you will need to refer to the log file on that computer to review any problems with local groups. The log file for each computer is named MigrationTask#_ComputerName.log and is stored in the
Windows\ADMT\Logs\Agents folder.
To translate security in add mode on objects by using a script
• Prepare a script that incorporates ADMT commands and options for translating security in add mode on objects by using the sample script shown in the following listing. Copy the script to Notepad, and save the file with a .wsf file name
extension in the same folder as the AdmtConstants.vbs file.
<Job id=" TranslatingSecurityInAddModeOnObjectsBetweenForests" >
<Script language="VBScript" src="AdmtConstants.vbs" />
<Script language="VBScript" >
Option Explicit
Dim objMigration
Dim objSecurityTranslation
'
'Create instance of ADMT migration objects.
'
Set objMigration = CreateObject("ADMT.Migration" )
Set objSecurityTranslation = objMigration.CreateSecurityTranslation
'
'Specify general migration options.
'
objMigration.SourceDomain = "source domain"
objMigration.TargetDomain = "target domain"
objMigration.TargetOu = "Computers"
'
'Specify security translation specific options.
'
objSecurityTranslation.TranslationOption = admtTranslateAdd objSecurityTranslation.TranslateFilesAndFolders = True objSecurityTranslation.TranslateLocalGroups = True objSecurityTranslation.TranslatePrinters = True objSecurityTranslation.TranslateRegistry = True objSecurityTranslation.TranslateShares = True objSecurityTranslation.TranslateUserProfiles = False objSecurityTranslation.TranslateUserRights = True
'
'Perform security translation on specified computer objects.
'
objSecurityTranslation.Translate admtData, _ Array("computer name1" ,"computer name2" )
Set objSecurityTranslation = Nothing Set objMigration = Nothing
</Script>
</Job>