Active Directory Migration Tool

Use Active Directory Migration Tool to migrate user accounts, groups, and computer accounts between domains and to analyze the migration impact both before and after the actual migration process.

  • Before you begin using Active Directory Migration Tool, see Checklist: Before using Active Directory Migration Tool.
  • For tips about using Active Directory Migration Tool, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.

Copyright © 1985-2003 Microsoft Corporation.
All rights reserved


Checklist: Before Using Active Directory Migration Tool

Step | Reference
Verify that Active Directory Migration Tool is installed on computers with sufficient resources. | Migration requirements
Verify that the computers to which Active Directory Migration Tool agents will be dispatched have sufficient resources and are running a correct version of Windows NT, Windows 2000, or Windows Server 2003 family. | Migration requirements
Verify that the source and target domains are properly configured. | Before performing an interforest migration Before performing an intraforest migration
Review the concepts of domain migration. | The migration process Interforest migration Intraforest migration
Review the security concepts. | Understanding security
Review the concepts of trust relationships. | Understanding trust relationships
Review the concepts of how users, groups, and computers are migrated between domains. | Migrating user accounts and groups Migrating computers
Review the concepts of security translation. | Security identifier (SID) translation
Review the Active Directory Migration Tool best practices. | Best practices
Review the procedures for the various types of domain migration. | Perform an interforest account domain migration Perform an interforest resource domain migration


Best practices
  • Carefully review the following topics:
    • Migration requirements
    • Before performing an interforest migration
    • Before performing an intraforest migration
  • Follow the migration procedures detailed in the following topics:
    • Perform an interforest account domain migration
    • Perform an interforest resource domain migration
  • Synchronize the time on all computers participating in the migration.

    This helps when using the event log while troubleshooting.

  • Before migrating user profiles, empty the Recycle Bin on any computer that is used by a user whose profile will be migrated.

    Failure to empty the Recycle Bin results in a benign "Recycle Bin corrupted" error. To clear this error, click Yes when prompted to empty the Recycle Bin.

  • Allow the migration process to finish without interruption.

    If you interrupt the migration process before it is finished, accounts may exist without correctly set properties.

  • When performing a lengthy migration, always run Active Directory Migration Tool from the same domain controller.

    Active Directory Migration Tool stores information used during the migration process in a file on the computer on which the tool is run. If you must change domain controllers during the migration, you can move this information to the new domain controller by copying the Protar.mdb file to the Active Directory Migration Tool folder on the new domain controller.

  • When migrating user accounts between domains in the same forest, user passwords are migrated to the target domain. Verify that the passwords of the source domain user accounts match the password policy of the target domain.

    If the source user accounts have passwords that violate the password restrictions (such as minimum length) in the target, then the affected migrated accounts cannot log on until the password has been set to a value that fits the target domain password policy and until the affected migrated accounts have been marked as enabled.

  • If you perform an intraforest migration of service accounts, ensure that all computers with the services on them are available when you perform the migration.

    When you perform an intraforest migration of accounts, you are actually moving the account because the two accounts cannot exist in the same forest. If a computer that uses one of these service accounts is not available, the service on that computer may stop working until it gets the service account updates.

  • To read Active Directory Migration Tool event log entries, read the log from a computer on which Active Directory Migration Tool is installed.

    The Active Directory Migration Toolagent may write event log entries to the computer on which it runs. Since the agent software is removed when the agent is finished, you can view the event log entries on a remote computer where the agent has run by running the Windows 2000 Event Viewer from the computer on which Active Directory Migration Tool is installed.

  • Two or more users in the same domain should not run Active Directory Migration Tool at the same time.

    Active Directory Migration Tool collects information about the objects to be migrated in a database. The tool then uses this information to perform the migration tasks. If two or more people try to use Active Directory Migration Tool at the same time, a database access conflict results.

  • Because agents are dispatched to remote computers, you should verify that replication is up to date across all domain controllers in the target domain before running the Computer Migration and Security Translation Wizards.

    Remote computers might look to a domain controller other than the one on which Active Directory Migration Tool is running to get the account and group information on which the operation is dependent. If a particular change has not replicated to all of the domain controllers in the domain, then the agent might receive outdated information and the computer migration or security translation might fail.

  • Install the Windows 2000 Support Tools and use Active Directory Administration Tool to help verify and troubleshoot correct object migration.

    For more information about the Windows 2000 Support Tools, see Windows 2000 Server Help.

  • Use the Migration.log and Dispatch.log files to help troubleshoot the Computer Migration Wizard.

    You can also use Event Viewer to view the Application and Security entries on both the source and target computers and on any computer to which an agent has been dispatched.


How to...

This section provides instructions for performing specific tasks:

  • Start a wizard
  • Perform an interforest account domain migration
  • Perform an interforest resource domain migration
  • Create the TcpipClientSupport registry entry
  • Enable auditing on a Windows 2000 domain
  • Enable auditing on a Windows NT domain
  • Create a new Group Policy object
  • Change domain mode of the target domain
  • Generate reports
  • Update Exchange after migrating users
  • Retry a task involving an agent
  • Undo the last operation


Start a wizard

To start a wizard

  1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Migration Tool.
  2. In the console tree, right-click Active Directory Migration Tool, and then click the desired wizard.

    Or, on the Action menu, click the desired wizard.

Related Topics


Perform an interforest account domain migration

To perform an interforest account domain migration

  1. Create the Active Directory target domain.

    2. More information

    • For instructions on how to set up an Active Directory domain or forest, see your Windows server operating system's Help.
    • The target domain must be operating in native mode.
  2. Establish needed trusts between the domains.

    3. More information

    • Although the Trust Migration Wizard can be used to create trusts between the resource domains and the target domain, you need to use Active Directory Domains and Trusts to manually create trusts between the source and target domain. Migrate the trusts before you migrate user accounts, service accounts, or local groups.
    • For details about creating trusts between domains, see the Help and Support Center for the Windows server operating system you are using.
  3. Migrate global groups by using the Group Migration Wizard.

    4. More information

    • If you have mapped a group to a different group in the target domain, and then you migrate that group from the source domain to the target domain, the mapping information is replaced. The group is then mapped to the migrated group in the target domain.
    • If you are migrating a distribution group (these only exist in Active Directory domains) from the source domain to the target domain and the group exists in the target domain as a security group, then the target group remains a security group even if the Replace option is selected.
    • If there is a large number of users in the domain, then enumerating the users might take a significant amount of time and might impact your network bandwidth. To migrate many thousands of users, you can instead migrate global groups and select to migrate their members with them. You can also migrate organizational units or domains as a whole to avoid enumerating individual users.
  4. Identify and migrate user accounts by using the User Migration Wizard.

    5. More information

    • You can migrate user accounts incrementally. Begin with a small number of users as a pilot project to verify whether the new domain environment and all resource access works correctly. Then, migrate the remaining users in one or more groups.
    • If there is a password complexity defined in the target domain and ADMT migrates passwords, then the complexity rules of the migrated password cannot be enforced. Therefore, ADMT in any case configures the migrated user account so that the user has to change his or her password after the first time the user logs on.
    • When the tool migrates user accounts, users are prompted to change their passwords the first time they log on to the network. The tool overrides the Password never expires option, unless the account has been marked as a service account by using the Service Account Migration Wizard.
    • If the User cannot change password check box is selected for a user account, then that migrated user account is locked until the Administrator resets the password, because the user is not able to reset the password.
    • Active Directory Migration Tool cannot determine if a particular user account is used by one or more services. If any user accounts in the source domain are used to allow services to log on, then you must run the Service Account Migration Wizard and select any servers that are running service accounts. Then, Active Directory Migration Tool can build a list of the service accounts to be migrated before you run the User Migration Wizard. If the Password never expires property is set for a user account, the User Migration Wizard clears the Password never expires check box, unless you use the Service Account Migration Wizard first.
    • If there is a large number of user accounts in the domain, then when the User Migration Wizard builds the list of user accounts in a domain, retrieving this information can take a significant amount of time and can cause a significant impact on your network traffic.
    • Active Directory Migration Tool only migrates user rights in additive mode. This means that the user rights of any existing users and groups in the target domain will not be removed during a migration operation.
    • The user principal name suffix attribute of migrated user accounts is left empty by default, but an implicit user principal name suffix of the current domain exists by default for each domain. For example, if the target domain is microsoft.com, then the implicit user principal name for users migrated to that domain is UserName@microsoft.com.
  5. Do one of the following:
    • If you plan to migrate resource domains as part of the same migration process, see To perform an interforest resource domain migration.
    • Decommission the source account domain.

    6. More information

    • If you plan to migrate resource domains as part of the same migration process, then you should delay decommissioning the source account domain until the resource domain migration is complete. This ensures that the source account domain controller is available for service account migration, migration of shared local groups, and local workstation profile migration that might depend on a domain controller from the source account domain.
    • After all of the user accounts in an account domain have been migrated, you can migrate its domain controllers into the target domain just as you would in a resource domain migration.

Important

  • When performing an interforest migration, first migrate account domains, and then migrate resource domains.
  • For best results, run the wizards in the order listed.

Notes

  • If SID History is migrated, then the user running ADMT needs to be a member of the Domain Admins group in the target domain.
  • The target domain must trust all domains that are trusted by the source domain, and must be trusted by all domains that trust the source domain. You can use the Trust Migration Wizard to compare and create the source and target domain trusts.
  • When migrating a user, group, or computer account that exists in both the source and target domains, if the account in the target domain already has a value for a particular property and the account in the source domain does not have a value for that property, then the value of the property in the target domain is preserved. It is not overwritten by the null value of the property in the source domain.
  • You should migrate the security IDs (SIDs) to the target domain when migrating users and groups. This updates the SID History of the accounts. If you migrate accounts and do not update SID History for those accounts, the new accounts do not have the access the original accounts had until you translate security and the Exchange directory.
  • During the migration process, this tool truncates user account names that are more than 20 characters long.
  • Password complexity functions might limit the passwords that the tool can assign to a user account. The tool can generate complex passwords that meet the minimum password length requirement and contain at least three lowercase letters, three uppercase letters, three numerical digits, and three symbols. If the generated password does not comply with the password complexity rules in the target domain, then the tool disables the migrated user account.

Related Topics


Perform an interforest resource domain migration

To perform an interforest resource domain migration

  1. Establish trusts between domains using the Trust Migration Wizard.

    2. More information

    • You might also need to use Active Directory Domains and Trusts to manually create trusts between the source and target domain. Migrate the trusts before you migrate user accounts, service accounts, or local groups.
    • For details about creating trusts between domains, see your Windows server operating system Help.
  2. Identify service accounts not running under local system authority using the Service Account Migration Wizard.

    3. More information

    • Active Directory Migration Tool cannot determine if a particular user account is used by one or more services. If any user accounts in the source domain are used to allow services to log on, you must run the Service Account Migration Wizard and select any servers that are running service accounts. Then, the Active Directory Migration Tool can build a list of the service accounts to be migrated before you run the User Migration Wizard.
    • Many applications, including Exchange Server 5.5, use service account mappings that Active Directory Migration Tool cannot change. These service accounts usually require configuration through registry settings or from within the application itself. You must manually update these accounts after the domain migration is complete.
    • When asked for user account credentials, use credentials with Administrator rights on the specific computer that is using the service accounts.
  3. Migrate workstations and member servers by using the Computer Migration Wizard.

    4. More information

    • At this time, you can choose to migrate the local profiles of previously migrated accounts from the same domain as the computer from which they will be translated. To translate previously migrated accounts from other domains, use the Security Translation Wizard and select each of the domains.
    • When migrating computer accounts from Windows NT domains, Active Directory Migration Tool does not migrate computer descriptions because the computer description attribute is not stored in the Windows NT domain security account manager. The description is stored on the local computer. Active Directory Migration Tool migrates non-null computer descriptions from computer accounts in Windows 2000 and Windows Server 2003 family source domains.
    • The Computer Migration Wizard dispatches anagent to each computer being migrated. The agent restarts each computer after the computers join the target domain. Verify that the default startup menu option on the migrated computers is the desired operating system.
  4. Migrate local profiles by using the Security Translation Wizard.

    5. More information

    • On the Translate Objects wizard page, select User Profiles.
  5. Migrate shared local groups by using the Group Migration Wizard.

    6. More information

    • On the Group Options wizard page, make sure that Migrate group SIDs to target domain and Do not rename accounts are the only options selected.
  6. Migrate service accounts by using the User Migration Wizard.

    7. More information

    • Service accounts are user accounts used to run services on servers with a set of credentials other than local system authority. These accounts may exist both in a master account domain and in the same resource domain as the server. If the service account is in an account domain, this procedure would be completed by selecting the account domain as the source domain.
  7. Update service account user rights using the Security Translation Wizard.

    8. More information

    • Select the computers in the source domain from which to translate the user rights. When selecting the source domain, select the domain of the service accounts, not the domain of the computer on which the service accounts are running.
    • On the Translate Objects wizard page, select Local groups and User rights.
    • On the User Account wizard page, type the name of an account with Administrator permissions in the target domain.
  8. Manually move domain controllers into the resource domain.

    9. More information

    • Active Directory Migration Tool cannot change the domain affiliation of any domain controllers. All domain controllers must be migrated manually so the Computer Migration Tool cannot migrate domain controllers. However, you can use all of the other Active Directory Migration Tool wizards on all domain controllers.
    • If the source domain is a Windows NT domain, upgrade the domain controllers starting with the primary domain controller. The Active Directory Installation Wizard runs automatically as part of the upgrade process. When the upgrade is complete, demote the domain controller to a member server and then join the target domain.
    • If the source domain is a Windows 2000 or Windows Server 2003 family domain, demote the domain controllers and join them to the target domain.
    • After a successful move operation, you should check the user access to resources on the computer that was moved. To correct the local permissions, you might need to run the Security Translation Wizard again on the moved computers.
  9. Decommission the source account domain.

    10. More information

    • When the migration process is complete, the source account domain can be decommissioned. At this time, the domain ceases to exist.
    • Remove all trusts between this domain and all other domains.
    • For information about decommissioning a Windows NT domain, see the Windows NT product documentation.
    • For information about decommissioning a Windows 2000 domain, see Windows 2000 Server Help.
  10. Decommission the source resource domain

    11. More information

    • When the migration process is complete, the source resource domain can be decommissioned. At this time, the domain ceases to exist.
    • Remove all trusts between this domain and all other domains.
    • For information about decommissioning a Windows NT domain, see the Windows NT product documentation.
    • For information about decommissioning a Windows 2000 domain, see Windows 2000 Server Help.

Important

  • When performing an interforest migration, first migrate account domains, and then migrate resource domains.
  • Run the wizards in the order listed for best results.

Notes

  • When running the Service Account Wizard or Computer Migration Wizard, you must be logged on to the source domain as an administrator or member of the Administrators group.
  • If SID History is migrated, the user running ADMT needs to be a member of the Domain Admins group in the target domain.
  • The target domain must trust all domains that are trusted by the source domain and that contain accounts that are members of local groups you migrate from the source domain. You can use the Trust Migration Wizard to compare and create the source and target domain trusts.
  • During the migration process, ADMT truncates service account names that are more than 20 characters long.
  • When migrating a user, group, or computer account that exists in both the source and target domains, if the account in the target domain already has a value for a particular property and the account in the source domain does not have a value for that property, the value of the property in the target domain is preserved. It is not overwritten by the null value of the property in the source domain.

Related Topics


Create the TcpipClientSupport registry entry

Windows Tools

Create the TcpipClientSupport registry entry automatically

To create the TcpipClientSupport registry entry automatically

  1. Run a trial migration.
    ADMT checks for the prerequisite system changes including the TCPIPClientSupport registry key.
  2. When prompted for permission to make changes, click OK.

To create the TcpipClientSupport registry entry by editing the registry

  1. While logged on to the primary domain controller (PDC) or the PDC emulator in the source domain, click Start, then click Run
  2. In the Open field, type regedit, and then click OK.

    3. Caution

    • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer. You can also use the Last Known Good Configuration startup option if you encounter problems after manual changes have been applied.
  3. In Registry Editor, navigate to the following registry key:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA

  4. On the Edit menu, click New and select DWORD Value.
  5. On the Edit menu, click Rename and type TcpipClientSupport.
  6. Double-click TcpipClientSupport.
  7. In Value data, type 1 (the numeral one). In Base, click Hexadecimal, and then click OK.
  8. Close Registry Editor, and then restart the computer.

Notes

  • This registry entry is needed only for interforest migrations that use SID History.
  • You must be logged on as an administrator or a member of the Administrators group to complete this procedure.


Enable auditing on a Windows 2000 domain

Windows Tools

Enable auditing on a Windows 2000 or Windows Server 2003 family domain

To enable auditing on a Windows 2000 or Windows Server 2003 family domain

  1. On a computer with administrative access to the domain, click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
  2. In the console tree, right-click Domain Controllers, and then click Properties.
  3. On the Group Policy tab , click Default Domain Controller Policy, and then click Edit.
  4. In the Group Policy console tree, double-click Audit policies.

    Where?

    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Local Policies
    • Audit policies
  5. Right-click Audit account management, and then click Security.
  6. Select the Success and Failure check boxes, and then click OK.
  7. Using Active Directory Sites and Services, replicate the changed Group Policy object to all domain controllers in the domain or wait for the normal replication cycle.

Notes

  • You must be logged on as an administrator or a member of the Administrators group in order to complete this procedure.
  • To apply the new Group Policy on every domain controller in the domain, run the Secedit tool with the /refreshpolicy machine_policy command line option on each domain controller.
  • For information about forcing replication, see the operating system's Server Help.


Enable auditing on a Windows NT domain

To enable auditing on a Windows NT domain

  1. On a computer with administrative access to the Windows domain, click Start, point to Programs, point to Administrative Tools, and then click User Manager for Domains.
  2. On the Policies menu, click Audit.
  3. Click Audit These Events, and then next to User and Group Management, select the Success and Failure check boxes.

Note

  • You must be logged on as an administrator or a member of the Administrators group in order to complete this procedure.


Create a new Group Policy object and apply it to the source organizational unit

Windows Tools

Create a new Group Policy object and link it to the source organizational unit

To create a new Group Policy object and link it to the source organizational unit

  1. On a computer with administrative access to the domain containing the Group Policy, click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
  2. In the console tree, right-click the organizational unit containing the servers and workstations to be migrated, and then click Properties.
  3. On the Group Policy tab, click New, type the name of the new Group Policy object, and then click Edit.
  4. In the Group Policy console tree, double-click Audit Policy.

    Where?

    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Local Policies
    • Audit Policy
  5. Right-click Audit account management, and then click Security.
  6. Select the Success and Failure check boxes, and then click OK.
  7. Using Active Directory Sites and Services, replicate the changed Group Policy object to all domain controllers in the domain or wait for the normal replication cycle.

Notes

  • You must be logged on as an administrator or a member of the Administrators group in order to complete this procedure.
  • To refresh the security settings on every domain controller in the domain, run the following command on each domain controller: secedit/refreshpolicy machine_policy
  • For information about forcing replication and applying Group Policy, see Server Help in Windows 2000 or Windows Server 2003 family.


Change domain mode of the target domain

To change domain mode of the target domain

  1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Domains and Trusts.
  2. In the console tree, right-click the name of the domain you want to administer, and then click Properties.
  3. On the General tab, click Change Mode, and then click Yes.

Caution

  • Do not change domain mode if you have or will have any Windows NT 4.0 domain controllers in this domain. You can only change the mode from mixed mode to native mode. After a domain is running in native mode, it cannot be changed back to mixed mode.

Note

  • To complete this procedure, you must be connected to the domain you want to administer and logged on as an administrator or a member of the Domain Administrators group of the target domain.


Generate reports

To generate reports

  1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Migration Tool.
  2. In the console tree, right-click Active Directory Migration Tool, and then click Reporting Wizard.
  3. Follow the instructions until you have finished generating the desired reports.

Note

  • For more information about an option, click the Help button.


Update Exchange after migrating users

To update Exchange after migrating users

  1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Migration Tool.
  2. In the console tree, right-click Active Directory Migration Tool, and then click Exchange Directory Migration Wizard.
  3. Follow the instructions until you have finished resolving the related Exchange directory migration issues.

Note

  • For more information about an option, click the Help button.

Related Topics


Retry a task involving an agent

To retry a task involving an agent

  1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Migration Tool.
  2. In the console tree, right-click Active Directory Migration Tool, and then click Retry Task Wizard.
  3. Follow the instructions until you have finished retrying tasks involving agents.

Note

  • Security translation and computer migration are tasks that use agents on remote computers.


Undo the last operation

To undo the last operation

  1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Migration Tool.
  2. In the console tree, right-click Active Directory Migration Tool, and then click Undo Wizard.
  3. Follow the instructions until you have finished undoing the last operation.

Note

  • Only user migration, group migration, and computer migration can be undone.


Concepts

This section provides general background information about migrating objects between domains.

  • Active Directory Migration Tool overview
  • Understanding Active Directory Migration Tool
  • Using Active Directory Migration Tool
  • Wizard Page Descriptions
  • Resources


Active Directory Migration Tool overview

Use Active Directory Migration Tool to migrate user accounts, groups, and computer accounts:

  • From Windows NT 4.0 domains to an Active Directory domain environment (interforest).
  • Between Active Directory domains in different forests (interforest).
  • Between Active Directory domains in the same forest (intraforest).

Domain migration is achieved by upgrading a Windows NT domain structure to to an Active Directory environment or as part of an Active Directory domain restructure. Active Directory Migration Tool is used to migrate existing Windows NT 4.0 domains into Active Directory environments. It can also be used to consolidate one or more Active Directory domains into a single domain.

By using a domain restructure, you can redesign your existing domain structure to better meet the needs of your organization. Though restructure can result in any number of different outcomes, typically the result is a change in the logical relationship between your domains, and often fewer domains.

The recommended way to redesign your domain structure is to design and build a new Active Directory forest separate from your existing domain structure and then, using Active Directory Migration Tool, migrate user accounts, groups, and computer accounts in stages from your production environment to the new Active Directory forest. Eventually, you decommission the old domain structure.

Domain upgrade, or in-place upgrade, involves upgrading each domain's primary domain controller and eventually upgrading all of the backup domain controllers. Using this method, you can upgrade all of your domains directly into a new Active Directory forest. A domain upgrade retains your current domain structure and no migration takes place. Active Directory Migration Tool does not support this process. However, after upgrading all Windows NT domains, you can redesign your upgraded domain structure by creating a new forest and using Active Directory Migration Tool to migrate the upgraded domains into the new forest. For more information about domain upgrade, see Windows Server 2003 Help.

When migrating objects from computers in a source domain to a target domain, Active Directory Migration Tool installs services, called agents, on the source computers. These agents are dispatched from the computer on which Active Directory Migration Tool is running and are installed on other computers using the security credentials of the user account used to run Active Directory Migration Tool. Once installed, the agents run as a service using the local system security credentials. There is no need to load software on the source computers prior to the migration.

For more information on Active Directory Migration Tool, see Understanding Active Directory Migration Tool.


Understanding Active Directory Migration Tool

This section includes:

  • The migration process
  • Interforest migration
  • Intraforest migration
  • Understanding security
  • Security identifier (SID) translation
  • Migrating user accounts and groups
  • Migrating computers
  • Understanding trust relationships


The migration process

Migrating a domain is a complex process that should not be undertaken without proper planning and testing.

Before the migration

Before migrating a domain, you should:

  • Inventory the domains in your network and the trusts between them.
  • Inventory the groups.
  • Inventory the user accounts.
  • Inventory the service accounts.
  • Inventory the computers.
  • Perform a test run.
  • Generate and analyze migration reports.

The Active Directory Migration Tool supplies wizards to simplify parts of the process. You can run many of the wizards without actually making any changes in your network by clicking Test the migration settings and migrate later. You can then review the log files and reports generated by the wizards to identify and fix any potential problems before performing the actual migration.

For more information about what to do before you begin the migration, see Checklist: Before using Active Directory Migration Tool, Before performing an interforest migration, and Before performing an intraforest migration.

The migration

Once you have verified that migration will proceed as desired, use the wizards to migrate groups, users, and computers, and then use the Security Translation Wizard to update the access control lists (ACLs) on the computers. Throughout the migration process you should:

  • Generate migration reports.
  • Analyze the reports.
  • Fix problems as necessary.

Repeat this process of migration, analyzation, and fixing any problems until your migration is complete.

Note

  • During a migration operation, Active Directory Migration Tool establishes a connection with a specific domain controller in the target domain. If the target domain controller goes off the network, the migration operation will fail, even if another domain controller is available in the target domain. Active Directory Migration Tool will not switch target domain controllers while performing a migration operation. Restarting the migration operation will connect to a new domain controller in the target domain and will work normally.

For more information about performing the migration, see To perform an interforest account domain migration, To perform an interforest resource domain migration.

After the migration

The last step in the migration process is to decommission the source domains. When you decommission a domain, that domain ceases to exist.

Note

  • Active Directory Migration Tool cannot change the domain affiliation of Windows NT primary domain controllers (PDCs) and backup domain controllers (BDCs) or Windows 2000 domain controllers. PDCs, BDCs, and Windows 2000 domain controllers must be migrated manually.

To decommission a Windows NT domain, once you have migrated all of the necessary accounts and resources and removed all trusts, you can simply turn off the last remaining domain controller in the domain. Then, you can install the desired operating system on that computer and join it to an existing domain. If you install Windows 2000 or Windows Server 2003 family, you can promote that computer to be a domain controller in another domain.

To decommission a Windows 2000 or Windows Server 2003 family domain, use the Active Directory Installation Wizard (Dcpromo.exe) to demote the last domain controller to a stand-alone server. You can then join that computer to another domain or promote it to be a domain controller in another domain.

For more information about promoting a domain controller and the Active Directory Installation Wizard, see Help for the Windows server product you are installing.


Interforest migration

Active Directory Migration Tool can be used to migrate users, groups, and computers between Windows NT domains and Active Directory domains. The process of migrating users, groups, and computers is referred to as domain migration.

An interforest migration is any move from a domain outside of a particular forest to a Active Directory domain inside that forest. Because Windows NT domains are not part of a forest, migrating users, groups, and computers from a Windows NT domain into an Active Directory domain is considered an interforest move.

Interforest migration flowchart

As shown in the illustration, moving security principals or resources from any of the domains on the left of the forest boundary (source domains) into any of the domains on the right (target domains) is an interforest move because the source and target domains are not in the same forest.

Interforest migration flowchart

Most organizations that are currently using Windows NT have account domains and resource domains. As shown in the illustration, the steps to perform an interforest migration include migrating the user and group accounts in the account domains; migrating the service accounts, local profiles, and shared local groups in the resource domains; and then updating the rights of the migrated users. When the migration is complete, the source domains can be decommissioned, and the computers can be moved into the target domain. Essentially the same steps can be used to migrate Active Directory domains from one forest into Active Directory domains in a different forest.

For information about preparing domains for migration, see Migration requirements and Before performing an interforest migration.

For details about migrating domains between forests, see To perform an interforest account domain migration, To perform an interforest resource domain migration, and the Domain Upgrades & Active Directory Web site (http://www.microsoft.com/windows2000/techinfo/planning/pds-cduadtoc.asp).


Password Migration

ADMT supports migration of current user passwords from the source to the target domain, however, a setup is required to enable it.

In the target domain

  • Install the 128-bit high-encryption pack.

    If the target domain is Windows 2000 or Windows Server 2003 family, the pack is included as standard and does not need to be installed.

  • If the target domain is Windows Server 2003 family, change the Default Domain Controllers Policy.
    1. Open the Users and Computers snap-in.
    2. Open the Computer Configuration/Windows Settings/Security Settings/Local Policies/Security Options/Network access container.
    3. Enable Let Everyone permissions apply to anonymous users.
  • Add the Everyone group to the built-in group Pre-Windows 2000 Compatibility Access.
    1. On one of the domain controllers in the target domain, enter the following at the command prompt:

      2. net localgroup "Pre-Windows 2000 Compatible Access" Everyone /Add

    2. Reboot the domain controller.
  • Verify that the passwords of the source domain user accounts match the password policy of the target domain.

    ADMT cannot verify password policies in the target domain. If the source user accounts have passwords that violate the password restrictions (such as minimum length) in the target, then the affected migrated accounts can log on, but they will be forced to change their password the next time they log on.

  • Save the password file.
    1. At the command prompt, change to the drive on which ADMT is locally installed.
    2. Change directories to the path on which ADMT is locally installed.
    3. Enter a command that uses the following syntax:
      admt key SourceDomainName DriveLetter [Password]

      4. Notes

      • Although the password file can be saved to any drive, it is recommended that it be saved to a floppy disk for better security.
      • If you type an asterisk (*) instead of the password, a dialog box prompts you for a password.
      • SourceDomainName must be the NetBIOS name of the domain.

In the source domain

  • Run the password installation file.
    1. On the Microsoft Windows Server 2003 family CD, in the \i386\Admt directory, double-click Pwdmig.exe.
    2. When prompted, insert the floppy disk created on the target domain. If prompted, enter a password and then click OK.

  • Prepare the Password Export Server.
    1. Select a BDC in the source domain to act as the Password Export Server.
    2. Ensure the Password Export server meets the minimum software requirements, which are: Windows NT 4.0 with Service Pack 5, or Windows 2000 with the 128-bit high-encryption pack installed.
    3. In the registry of the Password Export server under HKLM/System/CurrentControlSet/Control/Lsa, change the value of following entry from 0 to 1:
      AllowPasswordExport:REG_DWORD
    4. Reboot the domain controller.

    Caution

    • The registry editor bypasses standard safeguards, allowing settings that can damage your system, or even require you to reinstall Windows. If you must edit the registry, back it up first and see the Registry Reference in the Resource Kit CD or at the Windows Resource Kits Web site (http://www.microsoft.com/windows2000/techinfo/reskit/default.asp).


Intraforest migration

Active Directory Migration Tool can be used to migrate the users, groups, and computers from multiple domains into one or more Active Directory domains. The process of migrating users, groups, and computers is referred to as domain migration.

As shown in the illustration, moving users, groups, and computers from the source domain to the target domain is an intraforest move because both domains are in the same forest.

Intraforest migration flowchart

By migrating multiple domains into a single Active Directory domain, administrators can consolidate the number of domains, simplify user and group administration, and simplify Group Policy administration.

The steps to perform an intraforest migration include migrating the global groups, service accounts, workstations, and member servers from the source domain to the target domain. When the migration is complete, the source domains can be decommissioned and the domain controllers can be moved into the target domain.

For information about preparing domains for migration, see Migration requirements and Before performing an intraforest migration.


Understanding security

Security principals (user accounts, groups, and computer accounts) are represented by unique security identifiers (SIDs). Part of each SID identifies the domain to which the security principal belongs. The SID is independent of the security principal name and is used to identify the individual security principals and to control access to resources.

Access to network resources (printers, files, folders, and shares) is protected by access control lists (ACLs) that list individual SIDs and the rights and permissions that each has been granted.

Accessing resources

When users successfully log on to the network, they are assigned an access token that lists their primary SID and also lists the SIDs of all of the groups to which they belong. When a particular user tries to access a resource, the security system compares the SID in the access token and the access sought, with the SID in the ACL and the access granted or denied, then grants the appropriate rights. For example, if the user requests read rights and the ACL can grant the user both read and write rights, the system will only grant the user read rights.

Migrating security principals

When you migrate a security principal from domain A to domain B, a new security principal is created (or cloned) in domain B. SIDs contain a component that specifies the domain to which the security principal belongs, so this new security principal has the same name as the original security principal, but it has a different SID.

The new security principal is not a member of the same groups and its SID does not appear in the security descriptors of the various resources, so the new security principal does not have the same rights and permissions as the original.

In order for these new security principals to keep their existing access to resources, a SID History is created. This SID History contains SIDs previously associated with the original security principal. When the user logs on to the system, the system retrieves the SID History entries and adds them to the user's access token. The access token then contains the SID of the new security principal and the SIDs associated with the original security principal. This provides the new security principal the same access to resources as the original.


Security Identifier (SID) Translation

Access to network resources (printers, files, folders, and shares) is protected by access control lists (ACLs) contained in security descriptors associated with each resource. Active Directory Migration Tool can change security descriptors that reference a user account or a group in a source domain to reference another user account or group in a target domain.

For example, when you migrate a user account or group from domain A to domain B, a new account is created (cloned) in domain B. This new account can have the same name as the original account in domain A, but the new account has a different security identifier. Active Directory Migration Tool changes the security descriptors for various resources to refer to the SID for the new account in domain B. This process ensures the new user account or group provides the same access to resources that the original user account or group provided. The process of changing the security descriptors, which is called security translation, is performed by the Security Translation Wizard.

Note

  • If Active Directory Migration Tool finds a SID from the source domain that it cannot resolve, such as a SID for a user account that does not have a matching user account in the target domain, the tool leaves the SID unchanged.

The security on resources does not need to be translated before the source account is deleted. However, for cosmetic reasons, you probably want to translate security before deleting the source account. After the source account is gone, the resource can no longer resolve the SID to a name. The security properties show as "account unknown." The access still works, but you cannot resolve the SID name. If you upgrade the resource domain to Windows 2000 or Windows Server 2003 family, these operating systems can detect the SID History and resolve the name properly. Because of this, over time you should manually clean up SID History and grant access to the new security principals.

Creating a SID mapping file

When security is translated, ADMT uses its internal information about migrated accounts to decide which Access Control Lists need to be translated and how. You can use a SID mapping file to overwrite this information and map a source object to a target object. This SID mapping file can be used as an input file for security translations. By using it, you can translate security for accounts that were not migrated with ADMT, such as Domain Admins that were referenced in an Access Control List, or to perform security translations independent of migrated objects.

A SID mapping file specifies the name or SID of a source object followed by a comma, then the name or SID of a target object. Each source/target pair must be placed on its own line.

The following example shows one line in a SID mapping file that uses a SID to identify the source object and a name to identify the target object:

S-1-5-21-397955417-626881126-188441444-1234, HAY-BUV\JoeD
S-1-5-21-397955417-626881126-188441444-1234, HB-ACCT\JimS

Exchange directory translation

Active Directory Migration Tool can also change the security descriptors for Exchange mailboxes, distribution lists, custom recipients, organizations, sites, and containers, as well as the primary user account for each mailbox, to reflect the SID for the new security principal in the target domain. This process ensures that the new security principal has the same access to resources and Exchange components as the original.

To translate Exchange security, you must install Microsoft Exchange Administrator on a computer running Active Directory Migration Tool. If you want to translate Exchange security for Exchange mailboxes, distribution lists, custom recipients, organizations, sites, and containers, the account credentials you specify during the translation process must be a Permissions Admin in the Exchange site of the specified Exchange server.

For more information about security descriptors, SIDs, and general security issues, see Understanding security.


Migrating user accounts and groups

Use Active Directory Migration Tool to migrate user accounts and groups from a source domain to a target domain. While migrating, the users can retain access to resources. After all of the users, groups, computers, and resources have been migrated, the source domain can be decommissioned. Before performing the migration, you can test the process without actually migrating the accounts by clicking Test the migration settings and migrate later in the wizards.

User accounts

Because objects must exist in the target domain before their properties are referenced, Active Directory Migration Tool migrates all the account objects to the target domain before it migrates their properties. For example, Peter is the manager of Robert. Before Peter's account object can be referenced by the Manager property of Robert's user account, both Peter's and Robert's account objects must exist. So, when migrating user accounts, first Peter's and Robert's user accounts are migrated to the target domain, then the properties of each account are migrated.

When migrating accounts, you must migrate the security IDs (SIDs) to the target domain. This updates the SID History of the accounts. If you migrate accounts and do not update SID History for those accounts, the new accounts do not have the access that the original accounts had until you translate security and the Exchange directory.

Service accounts

Service accounts are user accounts that are used to run services with a set of credentials other than local system authority. This is usually done because even though the local system authority security context has absolute rights on the computer on which it operates, it has no rights on any other computers on the network. Many applications, for example Microsoft Exchange, use service accounts to run services with the same set of credentials on several networked computers.

Groups

Global groups can only have users from their own domain as members. So, when you migrate user accounts from one domain to another, the new accounts created by Active Directory Migration Tool in the target domain cannot be members of the global groups in the source domain. When you migrate global groups, group affiliation is restored. However, if you migrate users before migrating global groups, it might be possible for the users to log on to the target domain by using the migrated accounts, but the migrated user accounts will not have any group affiliation. Therefore, to ensure a smooth migration, you should migrate global groups before migrating users.

Migrating global groups before migrating users accounts creates a corresponding global group in the target domain for each global group that exists in the source domain. The newly created global group in the target domain receives a new primary SID that contains the domain identifier of the target domain as part of the SID. The primary SID of the global group in the source domain is added to the SID History attribute of the newly created group.

Local groups can contain members defined in other domains. Therefore, processing local groups can be a bit more complicated than processing global groups and user accounts. When adding a local group member in the target domain, Active Directory Migration Tool processes the group members in the following order:

  1. If the source member is also being migrated, Active Directory Migration Tool adds the copied account to the local group in the target domain.
  2. If the source member is known in the target domain, it is added by its security identifier. To be known by the target domain, the user account or group must be defined in a domain trusted by both the source and target domains.
  3. If the source member name exists in the target domain, this name is resolved to the target domain security identifier.
  4. If the source member name does not exist in the target domain, domains trusted by the target domain are searched for the name and the name is then resolved to its security identifier. If this search fails, Active Directory Migration Tool does not add the member.

shared local groups are sometimes used on domain controllers to organize access rights. If shared local groups are used, you should migrate all shared local groups to the target domain by using the Group Migration Wizard, upgrade the domain controllers, and then move them to the target domain.

Before migrating groups, you can use the Group Mapping and Merging Wizard to map a group in the source domain to a different group in the target domain. Mapping one group to another essentially moves the membership of a group in the source domain into a new or different group in the target domain. You can also merge the memberships of multiple groups into a new or different group in the target domain. Merging multiple groups into one group combines the memberships of several groups in the source domain into one group in the target domain.

Notes

  • If you have mapped a group to a different group in the target domain, and then you migrate that group from the source domain to the target domain, the mapping information is replaced. The group is then mapped to the migrated group in the target domain.
  • In an intraforest migration, when global groups are migrated from a native mode source domain, the groups are migrated over correctly, but are created as universal groups in the target domain so that they can contain members from the source domain that have not been migrated yet.

Copying group memberships

Active Directory Migration Tool also copies local and global group memberships and user rights for migrated user accounts. If you migrate a local group and its members to another domain, Active Directory Migration Tool copies the local group to the target domain. Membership is maintained through SID History. When migrating users who are members of groups in the source domain that also exist in the target domain, the source domain groups are not actually migrated, but the users are made members of the target domain groups.

Local groups can only contain SIDs from other local groups. Global groups can only contain SIDs from other global groups. Universal groups can only contain SIDs from global groups or other universal groups. If Active Directory Migration Tool finds a SID from the source domain that it cannot resolve, such as a SID for a user account that does not have a matching user account in the target domain, Active Directory Migration Tool leaves the SID unchanged and continues searching.

When Windows 2000 is the source domain in a migration, the Default Domain Policy rights granted for objects are not migrated. However, the Windows 2000 Default Domain Controller Policy rights are migrated.

For more information about security issues related to domain migration, see the Domain Upgrades & Active Directory Web site (http://www.microsoft.com/windows2000/techinfo/planning/pds-cduadtoc.asp). Other references available at the Microsoft Web site include help on the server products and the Resource Kit.


Migrating computers

Use Active Directory Migration Tool to migrate computer accounts from a source domain to a target domain. While migrating, users can retain access to resources on the computers. Once all of the computers and resources have been migrated, the source domain can be decommissioned. Before performing the migration, you can test the process without actually migrating the accounts by clicking Test the migration settings and migrate later in the wizards.

Domain controllers cannot be moved between domains. Windows NT domain controllers must either be upgraded and, in the process, joined to the target domain or, you must reinstall Windows NT to join them to the target domain. Active Directory domain controllers can be demoted to member servers, joined to the target domain and promoted to domain controller in in the target domain. Any domain local groups referenced by security descriptors on the domain controller being moved must be moved before joining the server to the target domain.

Workstations and member servers have their own security account manager (SAM) databases. When they are moved between domains, their SAM database moves with them. Local user and group accounts are not affected when moving a computer.

When migrating computer accounts from Windows NT domains, Active Directory Migration tool will not migrate computer descriptions because the computer description attribute is not stored in the Windows NT domain SAM. The description is stored on the local computer. Active Directory Migration Tool will migrate nonnull computer descriptions from computer accounts in Windows 2000 or Windows Server 2003 family source domains.


Understanding trust relationships

A trust relationship connects two domains and allows users in the trusted domain to access resources in the trusting domain. Groups can contain members from trusted domains. To migrate groups with member accounts from trusted domains, you must first establish the same trust relationships in the target domain that exist in the source domain. These trusts will allow authentication to continue to operate as it did before the migration.

For example, a resource domain usually trusts an account domain. This is usually a one-way trust. When you migrate users from an account domain into a target domain, the resource domain temporarily remains outside of the forest. To allow the migrated users access to the resources in the resource domain, you must establish a new one-way trust from the resource domain to the target domain in a Windows 2000 or Windows Server 2003 family forest. This trust will remain active until the resource domain is migrated into the forest and finally decommissioned.

The Trust Migration Wizard does this by comparing the trust relationships in the source domain to the trust relationships in the target domain. The Trust Migration Wizard mirrors in the target domain any trust relationships that exist in the source domain, but not in the target domain. This wizard does not affect any trusts that exist in the target domain, but not in the source domain.

Migrating an account domain

In a typical account domain and resource domain relationship, as shown in the illustration, the Windows NT resource domains trust the source account domain. Resource domains must also trust the new target account domain. This allows users in the account domain to access resources in the resource domains.

Resource domains trust the source account domain. They must also trust the new target account domain.

Before migrating user accounts from the Windows NT account domain to the Windows 2000 target domain, you must create trusts from each of the resource domains that trust the account domain to the Windows 2000 target domain. This will allow user accounts migrated to the target domain to access resources in the resource domains. Once the new trusts are established, you can clone the global groups and the users from the source account domain to the target domain.

Remove trusts to source domain and decommission the source domain.

As shown in the illustration, once you have migrated the users and global groups to the target domain, you can decommission the Windows NT 4.0 account domains. Because of the trusts created between the resource domains and the Windows 2000 target domain, the newly cloned users in the target domain can continue to access resources in the resource domains.

Migrating a resource domain

For increased manageability, resources can be migrated into organizational units in the target domain.

Resource domains trust the account domain. The target domain must also trust the account domain.

As shown in the illustration, when migrating a Windows NT 4.0 resource domain, you must create trusts between the target Windows 2000 domain and the account domain trusted by that resource domain. Once the trusts are in place, you can clone the local groups that control access to the various resources, demote the backup domain controllers in the resource domain and, if desired, move them to the target domain.

Remove trusts to source domain and decommission the source domain.

As shown in the illustration, when all resources have been transferred, you can decommission the original resource domain.


Using Active Directory Migration Tool

This section includes:

  • Migration requirements
  • Before performing an interforest migration
  • Before performing an intraforest migration


Migration requirements

Listed below are the requirements for the objects to be migrated, the computer on which to install Active Directory Migration Tool, and any computer to which an Active Directory Migration Tool agent will be dispatched.

Source objects

Objects to be migrated must meet the following criteria:

  • Source objects must be of one of the following types:
    • User account.
    • Security-enabled group including: local group (for Windows NT, only a domain controller's shared local groups can be migrated); domain local group (available in Windows 2000 and Windows Server 2003 domains operating in native mode); global group.
    • Computer account.
  • Source objects cannot be a built-in account (such as local Administrators, Users, and Power Users). Built-in account Security IDs (SIDs) are identical in every domain, so adding them to a SID History violates the SID-uniqueness requirement of the forest.
  • The SIDs of the source objects must not already exist in the target forest, either as primary account SIDs or in the SID History of an account.

Active Directory Migration Tool

ADMT must have connectivity to the RID Pool Master. Installing ADMT on the RID Pool Master will save on network traffic.

Active Directory Migration Tool can be run from any computer and can be run using Terminal Server.

Make sure that the computer on which Active Directory Migration Tool is installed meets the following requirements:

  • Pentium II or later central processing unit (CPU).
  • Enough memory to accommodate the migration process. The minimum amount of available RAM is 10 megabytes (MB), plus 4 kilobytes for each user to be migrated.
  • A hard disk partition with at least 35 MB of free space, which includes 7 MB for Active Directory Migration Tool installation and 25 MB for data and log files.

The Exchange migration requires a user account which has Exchange Administrator privileges. The Exchange Migration Wizard within the Active Directory Migration Tool will prompt you for these credentials.

Active Directory Migration Tool agent

The Active Directory Migration Tool agent can operate on computers running the following operating systems:

  • Windows NT 3.51 with Service Pack 5 (both x86-based and Alpha-based computers)
  • Windows NT 4.0 with Service Pack 4 or later (both x86-based and Alpha-based computers)
  • Windows 2000
  • Windows XP
  • Windows Server 2003 family

Computers on which the Active Directory Migration Tool agent will operate must meet the following requirements:

  • A hard disk partition with at least 15 MB of free disk space for the agent and agent log files.
  • The ADMIN$ share must exist on computers running Windows 3.51 for the agent to install successfully.
  • Active Directory Migration Tool user must be logged on with a user account that has Administrator or equivalent permissions on the target computer. Note that the built-in Administrators group normally contains the Domain Administrators group from the computer's domain.
  • Remote registry access must be enabled. For information on how to enable or disable remote registry access, see the Microsoft Web site (http://www.microsoft.com/).
  • NetBIOS should be enabled.
  • The (NetBIOS) Server service should be running.
  • The target computer must be a valid member of a valid domain. Note that some computers might have expired passwords, for example, the computer might have been disconnected from the domain for some time and its computer password has expired.


Before performing an interforest migration

This topic lists the domain and security configurations necessary before you can use Active Directory Migration Tool to migrate users, groups, and computers between a Windows NT domain and a Windows 2000 domain or between two Windows 2000 domains in different forests.

Source and target domain

Verify that your source and target domains are configured as described in the following list:

  • The target domain is running Windows 2000 and is operating in native mode. This is required because the SID History attribute is only available in domains operating in native mode.
  • The source domain is running either Windows NT 4.0 or Windows 2000. If running Windows NT 4.0, the primary domain controller must have Service Pack 4 or later installed.
  • If the source domain is a Windows 2000 domain, it may operate in either mixed or native mode.
  • The source domain must be in a different forest than the target domain or it must be a Windows NT 4.0 domain.
  • A new local group, SourceDomainName$$$ must be created on the source domain. For example, if your source domain is DomainA, you create the local group DomainA$$$. There must be no members in this group. If this group is not present, Active Directory Migration Tool creates this group when needed. If a global group or other kind of group already exists with this name, the tool cannot create the new local group.
  • Any mapped network drives and similar connections between the source domain controller and the target domain controller on which Active Directory Migration Tool is running must be disconnected before running the tool. If they are not disconnected, the migration operation might fail with "credentials conflict" error.
  • The primary domain controller (PDC), or PDC emulator, in the source domain must have the registry value TcpipClientSupport:REG_DWORD:0X1 set for the registry entry HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa. If this entry is not present, Active Directory Migration Tool creates this entry when needed. For details, see To create the TcpipClientSupport registry entry.

Security Requirements

You must meet the following security configuration requirements before running Active Directory Migration Tool.

  • The user account you log on with when you run Active Directory Migration Tool must have the following permissions:

    • Member of the Administrators group in the source domain
    • Administrator rights on each computer you migrate
    • Administrator rights on each computer on which you translate security
    • Domain Admin rights in the target domain if accounts are migrated with SID Histories.

    Gaining administrative access to the objects you intend to migrate can be accomplished in one of two ways:

    • Create a temporary two-way trust between the target domain and the source domain. By creating a two-way trust, you can run the tool while logged on as the administrator of the source domain, an account that already has administrative rights to the objects you migrate from the source domain.
    • Add an account to the local administrators group of every workstation and member server you intend to migrate; use that account to log on while you run the tool. You can automate this process by scripting and by using Active Directory Service Interfaces (ADSI).
  • Auditing for account management (success and failure events) must be enabled in the source and target domains. In Windows NT, account management is referred to as user and group management. For details, see To enable auditing in a Windows NT domain and To enable auditing in a Windows 2000 domain.
  • Administrative shares must exist on the computer where Active Directory Migration Tool is running and any computer to which an agent must be dispatched.
  • The source domain must trust the target domain to provide the security context necessary for Active Directory Migration Tool.
  • Trusts from existing resource domains to the target account domain support resource access for migrated users.


Before performing an intraforest migration

This topic lists the domain and security configurations necessary before you can use Active Directory Migration Tool to migrate users, groups, and computers between two Windows 2000 domains in the same forest.

Source and target domain

Verify that your source and target domains are configured as described in the following list:

  • The target domain is running Windows 2000 and is operating in native mode.
  • The source domain is running Windows 2000 (either in mixed or native mode) and located in the same forest as the target domain.

    • Note

    • It is recommended that the source domain is running Active Directory in native mode. If the source domain is running in mixed mode, the undo feature will not be available and users will not retain group memberships if the user and group are located in different domains.
  • When migrating users and groups between domains in the same forest, Active Directory Migration Tool must communicate with the Relative ID (RID) pool master in the target domain. To improve performance when migrating a large number of users or groups, you should install Active Directory Migration Tool on the RID pool master in the target domain. By default, this is the first domain controller installed in the domain. Use Active Directory Users and Computers or Ntdsutil.exe to locate the domain controller that holds the RID pool master role.
  • Any mapped network drives and similar connections between the source domain controller and the target domain controller on which Active Directory Migration Tool is running must be disconnected before running the tool. If they are not disconnected, the migration operation might fail with a "credentials conflict" error.

Security requirements

You must meet the following security configuration requirements before running Active Directory Migration Tool.

  • The user account you log on with when you run Active Directory Migration Tool must have the following permissions:

    • Member of the Administrators group in both the source and target domains
    • Administrator rights on each computer you migrate
    • Administrator rights on each computer on which you translate security

    Note

    • To migrate users and groups from a child domain to the forest root domain, the user account you log on with when you run Active Directory Migration Tool must have the permissions of the Enterprise Admins group in addition to the security privileges normally needed to run the tool.
  • Administrative shares must exist on the computer where Active Directory Migration Tool is running and on any computer to which the tool must dispatch an agent.


Wizard Page Descriptions

Windows Tools

ADMT Wizards Overview

There are six wizards in the Active Directory Migration Tool. Select a wizard name to find a list of pages in that wizard and help on each.

The topics for the wizards can be displayed by selecting them in the table of contents of this help file or by clicking Help on the wizard pages.


Welcome screen

Identifies the wizard you have selected and the task you have chosen to perform using Active Directory Migration Tool. To continue the selected task, click Next. To exit the wizard and return to the MMC console, click Cancel.


Computer Migration Wizard Overview

Run the Computer Migration Wizard to migrate computer accounts to a target domain. Domain controllers cannot be migrated.

The topics for this wizard can be displayed by selecting them in the table of contents of this help file or by clicking Help on the wizard pages.


Test or Make Changes

Specifies whether you want to test migration settings or actually perform a migration. Click Test the migration settings and migrate later to run the wizard in test mode, or click Migrate now to perform a migration.


Domain Selection

Specifies the source domain and target domain for the selected task. The options are defined as follows:

Source domain

Specifies the name of the source domain. When migrating accounts, the source domain indicates the domain from which the account information is migrated. Specify a valid Windows NT or Windows Server 2003 family domain. You may type the domain name or select it from the list.

In the Security Translation Wizard and the Exchange Directory Migration Wizard, type the domain of the service accounts, not the domain of the computers on which the service accounts are running.

Target domain

Specifies the name of the target domain. When migrating accounts, the target domain indicates the domain to which the account information is migrated. Specify a valid Windows 2000 or Windows Server 2003 family domain that is running in native mode. You may type the domain name or select it from the list.


Computer Selection

Specifies which computers the Active Directory Migration Tool will migrate. To add one or more computers, click Add, and then follow the instructions on the Select Computers page. To remove one or more computers, select the desired computers, and then click Remove.

Note

  • Domain controllers cannot be migrated. To migrate a computer that is operating as a Windows 2000 domain controller, you must first demote that domain controller to a member or stand-alone server. Windows NT domain controllers cannot be migrated. You must either upgrade them to Windows 2000 Server or reinstall Windows NT.


Organizational Unit Selection

Specifies the target organizational unit in the target domain.

Target OU

Specifies the target container, such as an organizational unit (OU), to which Active Directory Migration Tool will migrate selected user accounts, groups, or computer accounts. Specify a value in the following format:

Enter the full LDAP URL or Distinguished Name of the target container.

To select the desired container from the list of available containers, click Browse, and then follow the instructions on the Select Container page.

Note

  • The migration will fail if the path of the target organizational unit is longer than 1000 characters.


Translate Objects

Specifies the types of objects for which you want Active Directory Migration Tool to translate security. Select the object types you want the tool to process.

Files and folders

Translates security on files and folders on the computer being migrated.

Local groups

Translates security on the local groups being migrated.

Printers

Translates security on the printers defined on the migrated computer.

Registry

Translates security on registry settings on the computer being migrated.

Shares

Translates security on the shares that exist on the migrated computer.

User profiles

Translates security on the user profiles that exist on the migrated computer.

User rights

Translates security.

For more information, see Security identifier (SID) translation.


Security Translation Options

Specifies how Active Directory Migration Tool handles the security translation process. These fields are defined as follows:

Replace

Replaces the security ID (SID) for the account in the source domain with the SID for the account in the target domain in the access control lists (ACLs) and system access control lists (SACLs) in the security descriptors of the selected objects. This option gives the account in the target domain the same permissions on the selected objects as the account in the source domain. This option also removes these permissions from the account in the source domain.

When performing an intraforest migration, SID History is migrated and the source object is deleted. So, when performing an intraforest migration, Active Directory Migration Tool only allows security translation in Replace mode.

Add

Adds the SID for the account in the target domain to the ACLs and SACLs in the security descriptors of the selected objects that contain the SID for the account in the source domain. This option gives the account in the target domain the same permissions to the selected objects as the account in the source domain.

Remove

Removes the SID for the account in the source domain from the ACLs and SACLs in the security descriptors of the selected objects. This option removes the permissions to the selected objects from the account in the source domain.

For more information, see Security identifier (SID) translation.


Computer Options

Specifies how Active Directory Migration Tool handles computers after migration of the computer accounts to the target domain. The options are defined as follows:

Minutes before computers restart after wizard completion

Specifies how many minutes after migration to wait before restarting the computer.

Do not rename computers

Tries to name the migrated computer account the same name as the computer account in the source domain. If a naming conflict occurs, the options specified on the Naming Conflicts page control how the migrated computer account is named.

Rename with prefix

Adds the specified prefix to the name of each migrated computer account in the target domain.

Rename with suffix

Adds the specified suffix to the name of each migrated computer account in the target domain.


Object Property Exclusion

Allows specified properties to be left out of the migration process. By default all properties migrate. Select properties to excludedand add them to the Excluded Properties list.

Exclude specific object properties from migration

Places a check mark next to specified properties to keep them from being migrated with objects.

Object Type

When you select the type of object being migrated, gets an accurate list of properties for that object.

Included Properties

Lists properties to migrate.

Excluded Properties

Lists properties that will not migrate.


Naming Conflicts

Specifies how the Active Directory Migration Tool handles duplicate account names when migrating from the source domain to the target domain. The options are defined as follows:

Ignore conflicting accounts and don't migrate

Leaves the account in the target domain unchanged and does not migrate the duplicate account from the source domain.

Replace conflicting accounts

Changes properties of existing accounts in the target domain to match the properties of the account with the same name in the source domain.

Note

  • When using the Replace conflicting accounts option to remigrate and update accounts, the user's group memberships in the source domain are checked. The user is made a member of groups in the target domain if the user is a member of those groups in the source domain. However, the wizard does not remove the user from groups in the target domain that no longer exist in the source domain.

Remove existing user rights

Ensures the account in the target domain does not have more user rights than those granted to the account with the same name in the source domain. This check box is available only when Replace conflicting accounts is selected.

Remove existing members of groups being replaced

Ensures the members of the migrated groups in the target domain are the same as the members of the associated groups in the source domain. This check box is available only when Replace conflicting accounts is selected.

Move the existing account to the previously specified target Organizational Unit

Specifies to move the existing user account to the specified target Organizational Unit. If the check box is not selected, the replaced account remains in its original OU. This check box is available only when Replace conflicting accounts is selected.

Rename conflicting accounts by adding the following

Adds the specified prefix or suffix to the name of the migrated account in the target domain to avoid the conflict with the other account with the same name in the target domain. The original account with the same name in the target domain remains unchanged.


Confirmation

Identifies the task you have chosen to perform using Active Directory Migration Tool. This page summarizes the tasks you selected through the wizard. To use these settings and continue the selected tasks, click Finish. To return to the wizard and change one or more tasks, click Back. To exit the wizard and return to the Active Directory Migration Tool console, click Cancel.


Group Account Migration Wizard Overview

Run the Group Account Migration Wizard to migrate groups from a source domain to a target domain.

The topics for this wizard can be displayed by selecting them in the table of contents of this help file or by clicking Help on the wizard pages.


Group Selection

Specifies which groups in the source domain the Active Directory Migration Tool will migrate. To add one or more groups, click Add, and then follow the instructions on the Select Groups page. To remove one or more groups, select the desired groups, and then click Remove.


Group Options

Specifies how Active Directory Migration Tool handles the group migration. These options are defined as follows:

Update user rights

Copies the user rights assigned in the source domain to the target domain.

Copy group members

Copies the group as well as the members of the group to the target domain. If this option is not selected, then the group is created in the target domain but it contains no members.

Update previously migrated objects

Compares previously migrated groups in the source and target domains. Updates changes that have occurred since the last migration from the source to the target domain. This option is available only if the Copy group members check box is selected. This option supports migrations that occur over a period of time.

Fix membership of group

Specifies to add migrated user accounts to target domain groups if they were members of that group in the source domain.

Migrate group SIDs to target domain

Adds the security ID (SID) of the migrated user accounts and groups in the source domain to the SID History of the new user accounts and groups in the target domain. This feature uses a secure connection to the source domain controller. For more information about SID History, see Understanding security.

Select how all migrated accounts should be named

Specifies how ADMT names the newly created groups in the target domain.

Do not rename accounts

Tries to assign the migrated group the same name as the group in the source domain. If a naming conflict occurs, the options specified on the Naming Conflicts page control how the migrated group is named.

Rename with prefix

Adds the specified prefix to the original name of the group as it is migrated to the target domain.

Rename with suffix

Adds the specified suffix to the original name of the group as it is migrated to the target domain.


SID History Credentials

Windows Tools

User Account

Specifies the user account name and password that Active Directory Migration Tool uses to update the SID History for migrated accounts in the target domain. The specified user account must have Administrator rights in the source and target domains. To see how to create a SID mapping file see the Help topic Security identifier (SID) translation. This wizard page only appears if SIDs from the source domain are migrated to the target domain.

The fields are defined as follows:

User account name

Specifies the name of the user account that Active Directory Migration Tool uses to update the SID History for migrated accounts.

Password

Specifies the password for the user account specified in User account name.

Domain

Specifies the domain in which the user account is defined.


Naming Conflicts

Specifies how the Active Directory Migration Tool handles duplicate account names when migrating from the source domain to the target domain. The options are defined as follows:

Ignore conflicting accounts and don't migrate

Leaves the account in the target domain unchanged and does not migrate the duplicate account from the source domain.

Replace conflicting accounts

Changes properties of existing accounts in the target domain to match the properties of the account with the same name in the source domain.

Note

  • When using the Replace conflicting accounts option to remigrate and update accounts, the user's group memberships in the source domain are checked. The user is made a member of groups in the target domain if the user is a member of those groups in the source domain. However, the wizard does not remove the user from groups in the target domain that no longer exist in the source domain.

Remove existing user rights

Ensures the account in the target domain does not have more user rights than those granted to the account with the same name in the source domain. This check box is available only when Replace conflicting accounts is selected.

Remove existing members of groups being replaced

Ensures the members of the migrated groups in the target domain are the same as the members of the associated groups in the source domain. This check box is available only when Replace conflicting accounts is selected.

Move the existing account to the previously specified target Organizational Unit

Overwrites the existing target user account with the user account from the source domain. This check box is only available when Replace conflicting accounts is selected.

Rename conflicting accounts by adding the following

Adds the specified prefix or suffix to the name of the migrated account in the target domain to avoid the conflict with the other account with the same name in the target domain. The original account with the same name in the target domain remains unchanged.


Group Member Options

Specifies how Active Directory Migration Tool handles members of the migrated groups. These options are defined as follows:

Complex passwords

Automatically generates a complex password for each migrated user account. A complex password includes a combination of capital and lowercase letters as well as numbers and symbols. Active Directory Migration Tool records the new passwords in a password file.

Same as user name

Sets the password for each copied user account to the first 14 characters of the user account name. Active Directory Migration Tool records the passwords in a password file.

Migrate passwords

Allows the migration of the original passwords in the source domain to the target domain. Before choosing this option make sure all of the prerequisite setup is completed. For more information on this topic and the setup for it see the Password Migration help file.

Location to store password file:

Enter a path and filename for ADMT to store a password file or accept the default path.


Group Member Transition Options

Specifies how Active Directory Migration Tool handles migrated user accounts in both the source domains and target domains. For example, you can direct this tool to disable the migrated accounts in one or both of the domains. The options are defined as follows:

Target Account State section

Enable target accounts

Enables the newly created user account in the target domain. This option allows a user to log on to the target domain using the new account.

Disable target accounts

Disables the newly created user account in the target domain. This option prohibits anyone from using the target domain account to log on to the target domain. This option can affect migrated service accounts. Do not select this option when migrating accounts that are used by services.

Target same as source

Matches the newly created account in the target domain to the state of the account copied from the source domain whether it is enabled or disabled.

Source Account Disabling Options section

Disable source accounts

Disables the original user account in the source domain. This option prohibits anyone from using the source domain account to log on to the source domain.

Days until source accounts expires:

Sets the number of days after which the source account will no longer be available. This setting prohibits anyone from using the source account to log on to the domain after the specified number of days.

Translate roaming profiles

Migrates roaming profiles from the copied accounts in the source domain to the newly created accounts in the target domain. This process copies the roaming profile to the target domain and associates the profile with the new user account.


Service Account Information

Displays the user accounts that are designated as service accounts.

Use the Skip/Include button to select accounts that will migrate to the target domain.

Migrate all service accounts, and update SCM for items marked include

Migrates all accounts previously marked as service accounts by the Service Account Migration Wizard. Updates the Service Control Manager for accounts marked Include with the Skip/Include button.

Migrate no service accounts

Does not migrate service accounts.

Note

  • A Service Account column containing the display name of the service is hidden on this page. To show the Service Account column place the mouse cursor directly over the column border between the Computer and Account columns. When the cursor changes to double parallel lines, double-click to reveal the hidden Service Account column.


Group Mapping and Merging Wizard Overview

To collapse groups in the source domain into a single group in the target domain, run the Group Mapping and Merging Wizard. By running the wizard multiple times, you can map groups from different source domains to a single group in the target domain.

Note

  • Although multiple Windows NT groups can be mapped to one group in the target domain, a single group in a source domain cannot be mapped to more than one group in the target domain.

The topics for this wizard can be displayed by selecting them in the table of contents of this help file or by clicking Help on the wizard pages.


Target Group Selection

Specifies the target group that will contain all the members of the selected source group or groups. Specify the name of the desired target group, and then click Next. You can type the group name or use Browse to select a group. If the group does not exist, Active Directory Migration Tool creates it.


Group Options

Specifies how Active Directory Migration Tool handles the group migration. These options are defined as follows:

Copy user rights

Copies the user rights assigned in the source domain to the target domain.

Migrate group SIDs to target domain

Adds the security ID (SID) of the migrated user accounts and groups in the source domain to the SID History of the new user accounts and groups in the target domain. This feature uses a secure connection to the source domain controller. For more information about SID History, see Understanding security.


Report Wizard Overview

Run the Report Wizard to generate reports that aid in planning for future as well as ongoing migrations. The reports are generated by running the wizard and are saved as Web pages. To update the reports the Report Wizard must be run again.

The topics for this wizard can be displayed by selecting them in the table of contents of this help file or by clicking Help on the wizard pages.


Folder Selection

Specifies the folder where Active Directory Migration Tool stores the generated reports. The generated reports are formatted as Web pages. You can type the full path to the folder or use Browse to select a folder.


Report Selection

Specifies the reports you want Active Directory Migration Tool to generate. Select the desired report, and then click Next. To select more than one report, hold down CTRL and then click the desired reports.

The following report types are available:

Migrated Users and Groups Report | Summarizes the results of the user and group migration operations. The results of this report are saved in a file called MigrAcct.htm.
Migrated Computers Report | Summarizes the results of the computer migration operations. The results of this report are saved in a file called MigrComp.htm.
Expired Computers Report | Lists the computer accounts with expired passwords. The results of this report are saved in a file called ExpComp.htm.
Account References Report | Lists accounts that are assigned permissions to resources on a specified computer. The results of this report are saved in a file called AcctRefs.htm.
Name Conflicts Report | Lists the user accounts and groups that exist in both the source and target domains. The results of this report are saved in a file called NameConf.htm.


Computer Selection

Computers

Specifies which computers the Active Directory Migration Tool will migrate. To add one or more computers, click Add, and then follow the instructions on the Select Computers page. To remove one or more computers, select the desired computers, and then click Remove.

Note

  • Domain controllers cannot be migrated. To migrate a computer that is operating as a Windows 2000 domain controller, you must first demote that domain controller to a member or stand-alone server. Windows NT domain controllers cannot be migrated. You must either upgrade them to Windows 2000 Server or reinstall Windows NT.


Retry Wizard Overview

Run the Retry Wizard to retry failed tasks. If you have a failure during a migration due to misconfigured setting the Retry Wizard allows you to easily try the task again without having to rerun the failed wizard.

The topics for this wizard can be displayed by selecting them in the table of contents of this help file or by clicking Help on the wizard pages.


Task Selection

Lists the tasks that have failed in ADMT. The Skip/Include column in the display toggles between Skip and Include. To retry a task select it then click the Skip/Include button so that the task is included in the retry. You can also remove tasks from the list by selecting the task, and then clicking Cancel.

Note

  • This wizard page contains to hidden columns of information in the display. The Job File and Action ID columns contain internal ADMT information usually not needed during a migration. To show the Job File column place the mouse cursor directly over the column border between the Server and Status columns. When the cursor changes to double parallel lines, double click to reveal the Job File column. Repeat this process between the Action and Skip/Include columns to reveal the Action ID column.


Security Translation Wizard Overview

Run the Service Translation Wizard to change SIDs on ACLs and SACLs on migrated objects.

Note

  • Security translation does happen while running the Computer Migration Wizard, but only for accounts and objects that belong to the same domain as the migrated computer. Run the Security Translation Wizard to change ACLs of accounts and objects that do not belong to the migrated computer's domain.

The topics for this wizard can be displayed by selecting them in the table of contents of this help file or by clicking Help on the wizard pages.


Security Translation Options

Specifies how ADMT builds the list of objects that can be selected for security translation. These fields are defined as follows:

Previously migrated objects

Lists objects that were previously migrated.

Other objects specified in a file

Specifies a path and file that ADMT uses to build the list of objects. The specified file is a SID mapping file. To see how to create a SID mapping file, see the Help topic Security identifier (SID) translation.


Computer Selection

Specifies which computers the Active Directory Migration Tool will migrate. To add one or more computers, click Add, and then follow the instructions on the Select Computers page. To remove one or more computers, select the desired computers, and then click Remove.

Additional Trusting Domains

Lists domains that trust the target domain.

Note

  • Domain controllers cannot be migrated. To migrate a computer that is operating as a Windows 2000 domain controller, you must first demote that domain controller to a member or stand-alone server. Windows NT domain controllers cannot be migrated. You must either upgrade them to Windows 2000 Server or reinstall Windows NT.


Service Account Migration Wizard Overview

Run the Service Account Migration Wizard to identify services on computers in the source domain that are not using the LocalSystem account. These accounts are identified so they can later be included in the migration.

The topics for this wizard can be displayed by selecting them in the table of contents of this help file or by clicking Help on the wizard pages.


Update Information

Provides the option to refresh the current service account information. The options are defined as follows:

Yes, update the information

Collects the service account information to use during the migration process.

No, use the previously collected information

Uses the service account information previously collected and stored in the database.


Service Accounts Selection

Windows Tools

Service Account Selection

Creates a list of services that are not using the LocalSystem account. These accounts can then be migrated to the Active Directory environment. To check one or more computer's services, click Add, and then follow the instructions on the Select Computers page. To remove one or more computers, select the desired computers, and then click Remove.


Agent Monitor page

This page opens when ADMT dispatches an agent monitor to a remote computer(s) to complete a migration task. The Agent Monitor page displays the progress of the agent monitor on each remote computer as well as statistics on successes and failures. The Agent Monitor page includes the following tabs:

  • Summary Tab
  • Server List Tab
  • Monitoring Settings Tab


Service Account Information

Displays the service account information you have collected. You can also select which Service Control Manager entries you want to automatically update when the service account is migrated.

If the tool was unable to update a service that uses a migrated service account, this page displays the Update Failed status for that service. When that service is available, you can select the service, and then click Update SCM now to update the Service Control Manager entry.

Note

  • A Service Account column containing the display name of the service is hidden on this page. To show the Service Account column place the mouse cursor directly over the column border between the Computer and Account columns. When the cursor changes to double parallel lines, double click to reveal the hidden Service Account column.


Trust Migration Wizard Overview

The Trust Migration Wizard lists the trusts of the source domain and target domain. Run the Trust Migration Wizard before performing a migration to gather a complete list of trusts that exist in the source domain. If the trusts in the source domain are still needed after the migration they can be copied from the source domain to the target domain in the Trust Migration Wizard.

The topics for this wizard can be displayed by selecting them in the table of contents of this help file or by clicking Help on the wizard pages.


Trust Information

Displays information about the trusts for the source domain and target domain. Options available in the Trust Migration Wizard ensure that the target domain has all the trusts that the source domain has.

To copy a trust for the target domain, select the desired trust, and then click Copy Trust. Active Directory Migration Tool prompts you for a user account and password that has administrative rights in the trusted domain. Specify the user account and password, and then click OK.

When you have finished copying all the trusts you want to copy, click Cancel to close the wizard page. There is no need to click the Next button.


Undo Wizard Overview

Run the Undo Wizard to reverse the effects of a migration task. Only user migration, group migration, and computer migration can be undone.

Note

  • When a migrated user or group's properties are changed in the target domain and that same user or group is remigrated with the Replace conflicting accounts option, the Undo Wizard does not undo the change to the target user or group's properties.

The topics for this wizard can be displayed by selecting them in the table of contents of this help file or by clicking Help on the wizard pages.


Last Migration

Describes the most recently performed user, group, or computer migration. To undo the migration, review the task description and ensure that the described tasks are those that want to undo, and then click Next.

Only user migration, group migration, and computer migration can be undone.


User Account Wizard Overview

Windows Tools

User Account Migration Wizard Overview

Run the User Account Migration Wizard to migrate users from a source domain to a target domain.

The topics for this wizard can be displayed by selecting them in the table of contents of this help file or by clicking Help on the wizard pages.


User Selection

Specifies which user accounts in the source domain Active Directory Migration Tool will migrate. To add one or more user accounts, click Add, and then follow the instructions on the Select Users page. To remove one or more user accounts, select the desired user accounts, and then click Remove.


Password Options

Specifies how Active Directory Migration Tool assigns passwords to migrated user accounts. The options are defined as follows:

Complex passwords

Automatically generates a complex password for each migrated user account. A complex password includes a combination of capital and lowercase letters as well as numbers and symbols. Active Directory Migration Tool records the new passwords in a password file.

Same as user name

Sets the password for each copied user account to the first 14 characters of the user account name. Active Directory Migration Tool records the passwords in a password file.

Migrate passwords

Allows the migration of the original passwords in the source domain to the target domain. Before choosing this option make sure all of the prerequisite setup is completed. For more information on this topic and the setup for it see the Password Migration help file.

The options for the Password Options wizard page change based on the type of password migration selected. If Complex passwords is selected the following option appears at the bottom of the wizard page:

Location to store password file:

Specifies a path and filename for saving the password file. Type in a path or select the Browse button to search for one.

If Migrate passwords is selected the following option appears at the bottom of the wizard page:

Password migration Source DC:

Select a DC from the source domain from the dropdown list. The Browse button is disabled.

Note

  • When users are migrated multiple times the passwords are


Account Transition Options

Specifies the state that Active Directory Migration Tool will leave the source and target accounts in after migration and the migration of security identifiers (SIDs). These options are defined as follows:

Target Account State section

Enable target accounts

Enables the newly created user account in the target domain. This option allows a user to log on to the target domain by using the new account.

Disable target accounts

Disables the newly created user account in the target domain. This option prohibits anyone from using the target domain account to log on to the target domain. This option can affect migrated service accounts. Do not select this option when migrating accounts that are used by services.

Target same as source

Matches the newly created account in the target domain to the state of the account copied from the source domain whether it is enabled or disabled.

Source Account Disabling Options section

Disable source accounts

Disables the original user account in the source domain. This option prohibits anyone from using the source domain account to log on to the source domain.

Days until source accounts expires

Sets the number of days after which the source account is no longer available. This setting prohibits anyone from using the source account to log on to the domain after the specified number of days. The account expires at midnight on the last day.

Migrate user SIDs to target domain

Adds the security ID (SID) of the migrated account in the source domain to the SID History attribute of the new user account in the target domain. This feature uses a secure connection to the source domain controller. For more information about SID History, see Understanding security.


User Options

Specifies how Active Directory Migration Tool handles the user account migration. These options are defined as follows:

Translate roaming profiles

Copies roaming profiles from the source domain to the target domain for the selected user accounts. This process associates the roaming user profile with the new user account in the target domain.

Update user rights

Sets the user rights assigned to the new user account in the target domain to match the user rights assigned to the migrated user account in the source domain.

Migrate associated user groups

Migrates the groups of which the migrated user accounts are members. You can use this option to maintain the group membership information in the target domain.

Update previously migrated objects

Updates the groups of which the migrated user accounts are members, even if those groups were previously migrated. This option is available only if the Migrate associated user groups check box is selected.

Fix users' group memberships

Adds migrated user accounts to target domain groups if they were members of that group in the source domain.

Do not rename accounts

Tries to assign the migrated account the same name as the account in the source domain. If a naming conflict occurs, the options specified on the Naming Conflicts page control how the migrated account is named.

Rename with prefix

Adds a specified prefix to the name of each migrated account in the target domain.

Rename with suffix

Adds a specified suffix to the name of each migrated account in the target domain.


Exchange Directory Migration Wizard Overview

Run the Exchange Directory Migration Wizard to migrate users' mailboxes from a source domain to a target domain.

The topics for this wizard can be displayed by selecting them in the table of contents of this help file or by clicking Help on the wizard pages.


Exchange Server

Name

Specifies the Microsoft Exchange server that Active Directory Migration Tool will migrate. Specify the name of the Exchange server, and then click Next.


User Account

Specifies the user account, password and domain for Exchange migration.

User account name

Enter the name of a user account that has administrative rights in the source domain. For the Exchange Directory Migration enter the name of a user account that can make an LDAP connection to the Exchange Server.

Password

Enter the password of the user account.

Domain

Enter the name of the domain in which the user account resides.


Monitoring Settings tab

These options are defined as follows:

Dispatch log

Specifies the location of the log file in which the agent records its actions. This option is only available after selecting Stop Monitoring.

Refresh interval

Specifies the amount of time, in seconds, the agent waits before sending the latest status information. This option is only available after selecting Stop Monitoring.

Start Monitoring

Enables agent monitoring.

Stop Monitoring

Disables agent monitoring and makes the Dispatch log and Refresh interval options available.


Servers tab

Lists the computers you have selected to send an agent to perform migration tasks that must be completed locally. The dispatcher attempts to install and run the agent on each computer. This page also lists a status summary of the agent on each computer.

Agent Detail

Displays more detail of the status of an agent for an individually selected computer.

View Dispatch Log

Displays the dispatch log file which details the progress of each agent dispatched.


Summary tab

Displays the summary of the agents dispatched to the selected computers. The status options are defined as follows:

Computers started

Shows ADMT's progress on dispatching agents to the listed computers.

Computers finished

Shows ADMT's progress in completing agent monitor migration tasks.

Computers installed

Specifies the number of computers on which the agent has been successfully installed.

Computers running

Specifies the number of computers on which the agent is currently running.

Computers finished

Specifies the number of computers on which the agent has finished the specified actions.

Computers failed

Specifies the number of computers on which the agent was not able to complete its tasks.

The following information provides a summary of the agent actions. The rows and columns are defined as follows:

Rows

Files

Specifies the number of files processed by agents.

Directories

Specifies the number of directories processed by agents.

Shares

Specifies the number of shares processed by agents.

Group members

Specifies the number of members in local groups processed by agents.

User rights

Specifies the number of user rights entries processed by agents.

Columns

Examined

Specifies the number of security descriptors that agents searched for SIDs that match the SIDs of the selected accounts.

Changed

Specifies the number of security descriptors that agents changed.

Unchanged

Specifies the number of security descriptors that agents did not change.


ADMigration.msi: Active Directory Migration Tool

Windows Tools

ADMT Command-line Reference

 Open Command Prompt

ADMT uses the following general syntax from the command prompt:

One Step admt Operation Parameters Subparameters

Each task has its own set of operations. The tasks correspond to wizards available in the GUI version of ADMT. The tasks available in ADMT and the purpose of each are:

  • User: To migrate a single user or set of users.
  • Group: To migrate a single group of set of groups.
  • Computer: To migrate a single computer or set of computers.
  • Security: To perform a security translation by replacing source object SIDs with target object SIDs.
  • Service: To identify services within the domain running in the context of the Local System account.
  • Report: To create reports for migration statistics.

System Requirements

The following are the system requirements for ADMT:

  • Windows Server 2003

File Required

  • Admt.exe


ADMT Notes

Windows Tools

ADMT Command-Line Notes

 Open Command Prompt

Installing ADMT version 1 over ADMT version 2

ADMT version 1 installs over and overwrites ADMT version 2 without warning.

Using Option Files

Option files provide the operations and parameters for a migration in a separate file so that they do not have to be typed at the command prompt. Option files are useful during long migrations when a parallel domain is created and objects are migrated over a period of time. Objects such as users and groups can be migrated early in the migration process and updated throughout. You can use migration files to update objects without retyping information at the command prompt.

You can either create a single option file that contains sections for each operation or create separate option files with unique settings for each operation.

The format for each option file is similar to an .ini file. Many of the operations in ADMT need to be repeated for each task. The parameters and operations can be identical. You can create one option file for identical operations and parameters. The first section specifies operations and parameters that apply to all tasks. Subsequent sections are task-specific.

The following is an example of an option file in which HB-ACCT is the source domain and HAY-BUV.TLD is the target domain. HB-ACCT is also the name of the target organizational unit to which the accounts migrate.

    [Migration]
    TestMigration=Yes
    SourceDomain="HB-ACCT"
    TargetDomain="HAY-BUV.TLD"
    TargetOU="HB-ACCT"
    RenameOption=DONT
    PasswordOption=COMPLEX
    PasswordFile="C:\Program Files\Active Directory Migration Tool\Logs\Password.txt"
    ConflictOptions=Ignore

Because the specified actions for RenameOption and ConflictOptions are the default actions, they do not have to be specified.

Options can be commented out by a adding a semicolon at the beginning of a line.

Note

  • When an operation is not specified, the default setting is used.

Duplicate Operations in the Command Line

If an operation is specified more than once, the last value overrides the previous value or values. The only exception is includename, which can be used multiple times.

ADMT Command-Line Errors

Successful commands result in an "operation completed" message. If this message does not appear after entering a command, check the migration log for more information on failures that may have occurred.

The ADMT Agent Process Continues to Run

If a script or command calls the ADMT agent and is then stopped, the Admtagnt.exe process continues to run. Any attempt to start a migration process that uses the agent results in a "Migration in Process" error. To fix this problem, you can wait six minutes for the ADMT agent to time out or you can open Task Manager and end the Admtagnt.exe process.


ADMT User Syntax

 Open Command Prompt

ADMT uses the following general syntax:

One Step admt Operation Parameters Subparameters

Each task has its own set of operations. The tasks correspond to wizards available in the GUI version of ADMT. The tasks available in ADMT and the purpose of each are:

  • User: To migrate a single user or set of users.
  • Group: To migrate a single group or set of groups.
  • Computer: To migrate a single computer or set of computers.
  • Security: To perform a security translation by replacing source object SIDs with target object SIDs.
  • Service: To identify services within the domain running in a context other than the Local System account.
  • Report: To create reports for migration statistics.

ADMT User uses the following general syntax:

One Step admt user Parameters Subparameters

Note

  • Regardless of the number of operations needed, only one line of syntax is needed for the User task. List the operations together on one line of syntax, separating each operation by a space.

Parameters

User optionfile

Uses a file for a list of operations and parameters to perform during the migration. Only one file name can be specified with User optionfile. To specify more than one file name, list the parameter a second time with another file name.

One Step admt user /{o|optionfile}: "FileName"

FileName
The name of the file that contains the operations and parameters for the migration report.

User testmigration

Specifies whether the migration is a test instead of an actual migration of objects.

One Step admt user /{tm|testmigration}: {yes|no}

yes
Does not migrate any objects. Tests settings and reports errors.
no
Migrates objects from the source to the target domain. This is the default setting.

User intraforest

Specifies whether the migration is within a single forest. The default is no.

One Step admt user /{if|intraforest}: {yes|no}

yes
Specifies that the migration is within a single forest. This can include only migrations from an Active Directory source domain.
no
Specifies that the migration is between separate forests. Choose this option if the source domain is a Windows NT 4.0 domain. This is the default setting for this operation.

User sourcedomain

Specifies the name of the domain to migrate. This is always a required operation.

One Step admt user /{sd|sourcedomain}: "SourceDomainName"

SourceDomainName
The NetBIOS or DNS name of the domain to migrate.

User sourceOU

Specifies the name of the organizational unit to restructure. This parameter is used only for Active Directory source domains.

One Step admt user /{so|sourceou}: "Name"

Name
The name of the source organizational unit.

User targetdomain

Specifies the name of the domain to migrate to. This is always a required operation.

One Step admt user /{td|targetdomain}: "Name"

Name
The NetBIOS or DNS name of the target domain to migrate to.

User targetOU

Specifies the name of the organizational unit that accepts migrated objects. This parameter is required for both interforest and intraforest migrations.

One Step admt user /{to|targetou}: "Name"

Name
The name of the organizational unit that accepts migrated objects.

User passwordoption

Determines how ADMT sets the password for the newly created account in the target domain.

One Step admt user /{po|passwordoption}: {name|complex|copy}

name
Sets the password equal to the name of the object.
complex
Generates a random password containing a combination of uppercase and lowercase letters, numbers, and symbols.
copy
Migrates the existing password from the source domain.

User passwordserver

Specifies the name of the source domain controller designated as the password export server. For information on how to set up a password export server, see Password Migration.

One Step admt user /{ps|passwordserver}: "ServerName"

ServerName
The name of a source domain controller that acts as the password server. Enclose the server name in quotation marks.

User passwordfile

Specifies the path and name of the password file created by ADMT. This operation is needed only when the name or complex parameter is used with the User passwordoption operation.

One Step admt user /{pf|passwordfile}: "FileName"

FileName
The path and name of the password file. The password file can be saved only to a floppy disk. Enclose the entire path in quotation marks.

User disableoption

Determines which, if any, accounts to disable after migration.

One Step admt user /{dot|disableoption}: [disablesource+ [{enabletarget|disabletarget|targetsameassource}]]

disablesource+
After successfully migrating the accounts to the target domain, disables the accounts in the source domain.
enabletarget
Enables the accounts in the target domain so they can be immediately used. This is the default setting.
disabletarget
Disables the target accounts after migration.
targetsameassource
Matches the state of the target account to the state of the source account.

User sourceexpiration

Defines the number of days that the source account is valid before it expires.

One Step admt user /{sep|sourceexpiration}: {none|Days}

none
Specifies that the source account does not expire. This is the default setting.
Days
The number of days (1-1095) the system waits after the migration before disabling the source account.

User migrateSIDs

Specifies whether the source account SID migrates to the SID History of the target account.

One Step admt user /{mss|migratesids}: {yes|no}

yes
Migrates the SID from the source account and creates a SID History on the source account.
no
Does not migrate SIDs. This is the default setting.

User translateroamingprofile

Specifies whether to copy the roaming profile from the source domain to the target domain and to associate it with the target domain account.

One Step admt user /{trp|translateroamingprofile}: {yes|no}

yes
Copies the roaming profile when migrating the account and associates it with the target account.
no
Does not copy the roaming profile when migrating the account. This is the default setting.

User updateuserrights

Specifies whether to set the user rights of the target account to match the source account.

One Step admt user /{uur|updateuserrights}: {yes|no}

yes
Changes the user rights on the target account to match those on the source account.
no
Does not change the user rights on the target account. This is the default setting.

User migrategroups

Specifies whether to immediately migrate to the target domain the groups of which the source user is a member. When a group is migrated by using this operation, group members are not also migrated.

One Step admt user /{mgs|migrategroups}: {yes|no}

yes
Migrates groups of which the user account is a member when the user account is migrated.
no
Does not migrate groups associated with the user account. This is the default setting.

User updatepreviouslymigratedobjects

Specifies to update, during this migration, groups that have been previously migrated. This operation is used to keep group memberships of user accounts up to date in the new target domain during a long migration process. Use this operation only when the yes parameter is used with the User migrategroups operation during subsequent migrations.

One Step admt user /{umo|updatepreviouslymigratedobjects}: {yes|no}

yes
Updates the group memberships of the migrated user account in the target domain.
no
Does not update the group memberships of the target account. This is the default setting.

User fixgroupmembership

Specifies whether to add migrated users to target domain groups if they were members of that group in the source domain.

One Step admt user /{fgm|fixgroupmembership}: {yes|no}

yes
Checks group memberships in the source domain and adds the migrated account to those same groups in the target domain. This is the default setting.
no
Does not add the migrated user account to groups in the target domain.

User migrateserviceaccounts

Specifies whether user accounts created for a service should also migrate. These accounts are identified by running the Service Account Migration Wizard.

One Step admt user /{msa|migrateserviceaccounts}: {yes|no}

yes
Migrate user accounts identified by the Service Account Migration Wizard. This is the default setting.
no
Do not migrate user accounts identified by the Service Account Migration Wizard.

User renameoption

Specifies how to rename accounts during a migration. All migrated accounts are renamed with the specified prefix or suffix.

One Step admt user /{ro|renameoption}: {dont|prefix|suffix}

dont
Does not rename accounts. This is the default setting.
prefix
Specifies to add a prefix to the account being migrated.
suffix
Specifies to add a suffix to the account being migrated.

User renameprefixorsuffix

Specifies the prefix or suffix to add to accounts during a migration. Use this operation when the prefix or suffix parameter is used with the User renameoption operation.

One Step admt user /{rt|renameprefixorsuffix}: "PrefixOrSuffix"

PrefixOrSuffix
The prefix or suffix to add to account names. The prefix or suffix will be added to all migrated accounts. Enclose the prefix or suffix in quotation marks.

User conflictoptions

Specifies an action for ADMT to take when an object name is found to already exist in the target domain.

One Step admt user /{co|conflictoptions}: {ignore|replace[+removeuserrights] [+movereplacedaccounts]|prefix|suffix}

ignore
Does not migrate the account that already exists in the target domain and proceeds with the rest of the migration. This is the default setting.
replace
Replaces the account that already exists in the target domain with the account from the source domain.
+removeuserrights
Removes existing user rights from the target account. Use this parameter with the replace parameter.
+movereplacedaccounts
If ADMT finds a previously migrated account's organizational unit has changed, this option causes ADMT to move the account from the original OU to the changed OU in the target domain. Use this parameter with the replace parameter.
prefix
Renames the account from the source domain with a prefix, then migrates the account.
suffix
Renames the account from the source domain with a suffix, then migrates the account.

User conflictprefixorsuffix

Specifies the prefix or suffix to add to a migrated account. Use this operation when using the prefix or suffix parameter with the User conflictoptions operation.

One Step admt user /{ct|conflictprefixorsuffix}: "PrefixOrSuffix"

PrefixOrSuffix
The prefix or suffix to add to all source accounts during the migration. Enclose the prefix or suffix in quotation marks.

User userpropertiestoexclude

Specifies properties to exclude when migrating a user account.

One Step admt user /{ux|userpropertiestoexclude}: {"Property"|"Property1 [,Property2]..."}

Property
The property to exclude. Multiple properties can be listed. Separate each property by a comma and place all properties in a single set of quotation marks.

User includename

Specifies a user or list of users to migrate.

One Step admt user /{n|includename} "Name1"[ "Name2"]...

Name
The name of the account to migrate. Place the name in quotation marks. Separate multiple names by a space.

User includefile

Specifies the name of a file that contains a list of users to migrate.

One Step admt user /{f|includefile}: "FileName"

FileName
The name of the include file. This file can contain the Windows NT SAM account name or the Windows 2000 relative distinguished name of the account. Only one file may be specified with this parameter.

User includedomain

Specifies an entire source domain or organizational unit of accounts.

One Step admt user /{d|includedomain}: [recurse [{+flatten|+maintain}]]

recurse
Specifies how to migrate listed domains or organizational units. If you do not use +flatten or +maintain with recurse, then the default is +flatten.
+flatten
Eliminates child containers in the specified domain(s) or organizational unit(s). If this parameter is used, accounts in the parent and child containers migrate into only one target container. The accounts in the child container migrate, but the child containers do not migrate.
+maintain
Migrates child containers as well as the accounts contained in them.

User excludename

Specifies which accounts to exclude from the migration.

One Step admt user /{en|excludename} "Name1"[ "Name2"]...

Name
The name of the account that must not migrate. Multiple names can be listed. Place each name in quotation marks and separate by a space. By default, all accounts in a specified domain or organizational unit migrate. A maximum of two wildcard characters can be used in each name.

User excludefile

Specifies the name of a file that contains a list of users to leave out of the migration.

One Step admt user /{ef|excludefile}: "FileName"

FileName
The name of the excluded file. This file can contain the Windows NT SAM account name or the Windows 2000 relative distinguished name of the account. Only one file may be specified with this parameter. A maximum of two wildcard characters can be used in each name.


ADMT Group Syntax

 Open Command Prompt

ADMT uses the following general syntax:

One Step admt Operation Parameters Subparameters

Each task has its own set of operations. The tasks correspond to wizards available in the GUI version of ADMT. The tasks available in ADMT and the purpose of each are:

  • User: To migrate a single user or set of users.
  • Group: To migrate a single group or set of groups.
  • Computer: To migrate a single computer or set of computers.
  • Security: To perform a security translation by replacing source object SIDs with target object SIDs.
  • Service: To identify services within the domain running in a context other than the Local System account.
  • Report: To create reports for migration statistics.

ADMT Group uses the following general syntax:

One Step admt group Parameters Subparameters

Note

  • Regardless of the number of operations needed, only one line of syntax is needed for the Group task. List the operations together on one line of syntax, separating each operation by a space.

Parameters

Group optionfile

Uses a file for a list of operations and parameters to perform during the migration. Only one file name can be specified with Group optionfile. To specify more than one file name, list the parameter a second time with another file name.

One Step admt group /{o|optionfile}: "FileName"

FileName
The name of the file that contains the operations and parameters for the migration.

Group testmigration

Specifies whether the migration is a test instead of an actual migration of objects.

One Step admt group /{tm|testmigration}: {yes|no}

yes
Does not migrate any objects. Tests settings and reports errors.
no
Migrates objects from the source to the target domain. This is the default setting.

Group intraforest

Specifies whether the migration is within a single forest. The default is no.

One Step admt group /{if|intraforest}: {yes|no}

yes
Specifies that the migration is within a single forest. This can include only migrations from an Active Directory source domain.
no
Specifies that the migration is between separate forests. Choose this option if the source domain is a Windows NT 4.0 domain. This is the default setting.

Group sourcedomain

Specifies the name of the domain to migrate. This is always a required operation.

One Step admt group /{sd|sourcedomain}: "SourceDomainName"

SourceDomainName
The NetBIOS or DNS name of the domain to migrate.

Group sourceOU

Specifies the name of the organizational unit to restructure. This parameter is used only for Active Directory source domains.

One Step admt group /{so|sourceOU}:"Name"

Name
The name of the source organizational unit.

Group targetdomain

Specifies the name of the domain to migrate to. This is always a required operation.

One Step admt group /{td|targetdomain}:"Name"

Name
The NetBIOS or DNS name of the target domain to migrate to.

Group targetOU

Specifies the name of the organizational unit that accepts migrated objects. This parameter is required for both interforest and intraforest migrations.

One Step admt group /{to|targetou}:"Name"

Name
The name of the organizational unit that accepts migrated objects.

Group updategrouprights

Specifies whether ADMT changes the rights of the target group to match the rights of the source group.

One Step admt group /{ugr|updategrouprights}: {yes|no}

yes
Matches the rights of the target group to the rights of the source group.
no
Does not change the rights of the target group to match the rights of the source group. This is the default setting.

Group fixgroupmembership

Specifies whether to add migrated users to target domain groups if they were members of that group in the source domain.

One Step admt group /{fgm|fixgroupmembership}: {yes|no}

yes
Checks group memberships in the source domain and adds the migrated account to those same groups in the target domain. This is the default setting.
no
Does not add the migrated user account to groups in the target domain.

Group migrateSIDS

Specifies whether to migrate the source account SID to the SID History of the target account.

One Step admt group /{mss|migratesids}: {yes|no}

yes
Migrates the SID from the source account and creates a SID History on the source account.
no
Does not migrate SIDs. This is the default setting.

Group renameoption

Specifies how to rename groups during a migration. All migrated groups are renamed with the specified prefix or suffix.

One Step admt group /{ro|renameoption}: {dont|prefix|suffix}

dont
Does not rename accounts. This is the default setting.
prefix
Specifies to add a prefix to group being migrated.
suffix
Specifies to add a suffix to the group being migrated.

Group renameprefixorsuffix

Specifies the prefix or suffix to add to accounts during a migration. Use this operation when the prefix or suffix parameter is used with the Group renameoption operation.

One Step admt group /{rt|renameprefixorsuffix}: "PrefixOrSuffix"

PrefixOrSuffix
The prefix or suffix to add to group names. The prefix or suffix will be added to all migrated groups. Enclose the prefix or suffix in quotation marks.

Group conflictoptions

Specifies an action for ADMT to take when an object name is found to already exist in the target domain.

One Step admt group /{co|conflictoptions}: {ignore|replace[+removeuserrights] [+movereplacedaccounts]|prefix|suffix}

ignore
Does not migrate the account that already exists in the target domain and proceeds with the rest of the migration. This is the default setting.
replace
Replaces the account that already exists in the target domain with the account from the source domain.
+removeuserrights
Removes existing user rights from the target account. Use this parameter with the replace parameter.
+movereplacedaccounts
If ADMT finds a previously migrated account's organizational unit has changed, this option causes ADMT to move the account from the original OU to the changed OU in the target domain. Use this parameter with the replace parameter.
prefix
Renames the account from the source domain with a prefix, then migrates the account.
suffix
Renames the account from the source domain with a suffix, then migrates the account.

Group conflictprefixorsuffix

Specifies the prefix or suffix to add to a migrated account. Use this operation when using the prefix or suffix parameter with the Group conflictoption operation.

One Step admt group /{ct|conflictprefixorsuffix}: "PrefixOrSuffix"

PrefixOrSuffix
The prefix or suffix to add to the source account that has a duplicate name. Enclose the prefix or suffix in quotation marks.

Group grouppropertiestoexclude

Specifies properties to exclude when migrating a group account.

One Step admt group /{ux|grouppropertiestoexclude}: {"Property"|"Property1 [,Property2]..."}

Property
The property to exclude. Multiple properties can be listed. Separate each property by a comma and place all properties in a single set of quotation marks.

Group migratemembers

Specifies whether ADMT migrates user accounts contained in a migrated group.

One Step admt group / {mms|migratemembers}: {yes|no}

yes
When migrating the group, also migrates the user accounts contained in the group
no
Does not migrate user accounts contained in the migrated group.

Group updatepreviouslymigratedobjects

Specifies whether members of the group are remigrated. This operation keeps group memberships of group accounts up to date in the new target domain during a long migration process. Use this operation only when the yes parameter is used with the Group migrategroups operation during subsequent migrations. Do not use this option unless migrating members of groups.

One Step admt group /{umo|updatepreviouslymigratedobjects}: {yes|no}

yes
Updates the group memberships of the migrated user account in the target domain.
no
Does not update the group memberships of the target account. This is the default setting.

Group passwordoption

Determines how ADMT sets the password for the newly created account in the target domain. Do not use this option unless migrating members of groups.

One Step admt group /{po|passwordoption}: {name|complex|copy}

name
Sets the password equal to the name of the object.
complex
Generates a random password that contains uppercase and lowercase letters, numbers, and symbols.
copy
Migrates the existing password from the source domain.

Group passwordserver

Specifies the name of the source domain controller designated as the password server. For information on how to set up a password export server, see Password Migration.

One Step admt group /{ps|passwordserver}: "ServerName"

ServerName
The name of the password export server. Enclose the server name in quotation marks.

Group passwordfile

Specifies the path and name of the password file created by ADMT. This operation is needed only when the name or complex parameter is used with the Group passwordoption operation.

One Step admt group /{pf|passwordfile}: "FileName"

FileName
The path and name of the password file. The password file can be saved only to a floppy disk. Enclose the entire path in quotation marks.

Group disableoption

Determines which, if any, user accounts to disable after migration. Do not use this option unless migrating members of groups.

One Step admt group /{dot|disableoption}: [disablesource+ [{enabletarget|disabletarget|targetsameassource}]]

disablesource+
After successfully migrating the accounts to the target domain, disables the accounts in the source domain.
enabletarget
Enables the accounts in the target domain so they can be immediately used. This is the default setting.
disabletarget
Disables the target accounts after migration.
targetsameassource
Matches the state of the target account to the state of the source account.

Group sourceexpiration

Defines the number of days that the source user account is valid before it expires. Do not use this option unless migrating members of groups.

One Step admt group /{sep|sourceexpiration}: {none|Days}

none
Specifies that the source user account does not expire. This is the default setting.
Days
The number of days (1-1095) the system waits after the migration before disabling the source user account.

Group translateroamingprofile

Specifies whether to translate security on the roaming profile from the source domain to the target domain. Do not use this option unless migrating members of groups.

One Step admt group /{trp|translateroamingprofile}: {yes|no}

yes
Changes the SIDs on the roaming profile to match the target account's domain.
no
Does not change the SIDs for the roaming profile when migrating the account. This is the default setting.

Group includename

Specifies a group or list of groups to migrate.

One Step admt group /{n|includename} "Name1"[ "Name2"]...

Name
The name of the account to migrate. Place the name in quotation marks. Separate multiple names by a space.

Group includefile

Specifies the name of a file that contains a list of groups to migrate.

One Step admt group /{f|includefile}: "FileName"

FileName
The name of the include file. This file can contain the Windows NT SAM account name or the Windows 2000 relative distinguished name of the account. Only one file may be specified with this parameter.

Group includedomain

Specifies an entire source domain or organizational unit of accounts.

One Step admt group /{d|includedomain}: [recurse [{+flatten|+maintain}]]

recurse
Specifies how to migrate listed domains or organizational units. If you do not use +flatten or +maintain with recurse, then the default is +flatten.
+flatten
Eliminates child containers in the specified domain(s) or organizational unit(s). This parameter migrates accounts in the parent and child containers into only one target container. The accounts in the child container migrate, but the child containers do not migrate.
+maintain
Migrates child containers as well as the accounts contained in them.

Group excludename

Specifies which accounts to exclude from the migration.

One Step admt group /{en|excludename} "Name1"[ "Name2"]...

Name
The name of the account that must not be migrated. Multiple names can be listed. Place each name in quotation marks and separate by a space. By default, all accounts in a specified domain or organizational unit migrate. A maximum of two wildcard characters can be used in each name.

Group excludefile

Specifies the name of a file that contains a list of groups to leave out of the migration.

One Step admt group /{ef|excludefile}: "FileName"

FileName
The name of the excluded file. This file can contain the Windows NT SAM account name or the Windows 2000 relative distinguished name of the account. Only one file may be specified with this parameter. A maximum of two wildcard characters can be used in each name.


ADMT Computer Syntax

 Open Command Prompt

ADMT uses the following general syntax:

One Step admt Operation Parameters Subparameters

Each task has its own set of operations. The tasks correspond to wizards available in the GUI version of ADMT. The tasks available in ADMT and the purpose of each are:

  • User: To migrate a single user or set of users.
  • Group: To migrate a single group or set of groups.
  • Computer: To migrate a single computer or set of computers.
  • Security: To perform a security translation by replacing source object SIDs with target object SIDs.
  • Service: To identify services within the domain running in a context other than the Local System account.
  • Report: To create reports for migration statistics.

ADMT Computer uses the following general syntax:

One Step admt computer Parameters Subparameters

Note

  • Regardless of the number of operations needed, only one line of syntax is needed for the Computer task. List the operations together on one line of syntax, separating each operation by a space.

Parameters

Computer optionfile

Uses a file for a list of operations and parameters to perform during the migration. Only one file name can be specified with Computer optionfile. To specify more than one file name, list the parameter a second time with another file name.

One Step admt computer /{o|optionfile}: "FileName"

FileName
The name of the file that contains the operations and parameters for the migration.

Computer testmigration

Specifies whether the migration is a test instead of an actual migration of objects.

One Step admt computer /{tm|testmigration}: {yes|no}

yes
Does not migrate any objects. Tests settings and reports errors.
no
Migrates objects from the source to the target domain. This is the default setting.

Computer intraforest

Specifies whether the migration is within a single forest. The default is no.

One Step admt computer /{if|intraforest}: {yes|no}

yes
Specifies a migration within a single forest. This can include only migrations from an Active Directory source domain.
no
Specifies that the migration is between separate forests. Choose this option if the source domain is a Windows NT 4.0 domain. This is the default setting for this operation.

Computer sourcedomain

Specifies the name of the domain to migrate. This is always a required operation.

One Step admt computer /{sd|sourcedomain}: "SourceDomainName"

SourceDomainName
The NetBIOS or DNS name of the domain to migrate.

Computer sourceOU

Specifies the name of the organizational unit to restructure. This parameter is used only for Active Directory source domains.

One Step admt computer /{so|sourceou}: "Name"

Name
The name of the source organizational unit.

Computer targetdomain

Specifies the name of the domain to migrate to. This is always a required operation.

One Step admt computer /{td|targetdomain}: "Name"

Name
The NetBIOS or DNS name of the target domain to migrate to.

Computer targetOU

Specifies the name of the organizational unit that accepts migrated objects. This parameter is required for both interforest and intraforest migrations.

One Step admt computer /{to|targetou}: "Name"

Name
The name of the organizational unit that accepts migrated objects.

Computer translateoption

Specifies how to migrate the SIDs between computers so that security translation can be performed on a migrated computer.

One Step admt computer /{tot|translateoption}: {replace|add|remove}

replace
Changes the SID of the migrated computer on all ACLs and SACLs to match the target domain. This is the default setting.
add
Adds the target domain SIDs to the existing source domain SIDs when migrating the computer.
remove
Deletes the source domain SID from the migrated computer, and does not add the SIDs from the target domain.

Computer translatefilesandfolders

Specifies whether to update ACLs for files and folders during migration.

One Step admt computer /{tff|translatefilesandfolders}: {yes|no}

yes
Updates the ACLs for files and folders when migrating this computer.
no
Does not update the ACLs for files and folders when migrating this computer. This is the default setting.

Computer translatelocalgroups

Specifies whether to update ACLs for local groups during migration.

One Step admt computer /{tlg|translatelocalgroups}: {yes|no}

yes
Updates the ACLs for local groups when migrating this computer.
no
Does not update the ACLs for local groups when migrating this computer. This is the default setting.

Computer translateprinters

Specifies whether to update ACLs for printer shares during migration.

One Step admt computer /{tps|translateprinters}: {yes|no}

yes
Updates the ACLs for printer shares when migrating this computer.
no
Does not update the ACLs for printer shares when migrating this computer. This is the default setting.

Computer translateregistry

Specifies whether to update ACLs for registry settings during migration.

One Step admt computer /{trg|translateregistry}: {yes|no}

yes
Updates ACLs for the registry when migrating this computer.
no
Does not update the ACLs for the registry when migrating this computer. This is the default setting.

Computer translateshares

Specifies whether to update ACLs for shares during migration.

One Step admt computer /{tss|translateshares}: {yes|no}

yes
Updates ACLs for the shares when migrating this computer.
no
Does not update the ACLs for the shares when migrating this computer. This is the default setting.

Computer translateuserprofiles

Specifies whether to update ACLs for user profiles during migration.

One Step admt computer /{tup|translateuserprofiles}: {yes|no}

yes
Updates ACLs for user profiles when migrating this computer.
no
Does not update the ACLs for user profiles when migrating this computer. This is the default setting.

Computer translateuserrights

Specifies whether to update ACLs for user rights during migration.

One Step admt computer /{tur|translateuserrights}: {yes|no}

yes
Updates ACLs for user rights when migrating this computer.
no
Does not update the ACLs for user rights when migrating this computer. This is the default setting.

Computer renameoption

Specifies how to rename accounts during a migration. All migrated accounts are renamed with the specified prefix or suffix.

One Step admt computer /{ro|renameoption}: {dont|prefix|suffix}

dont
Does not rename computers. This is the default setting.
prefix
Specifies to add a prefix to the computer being migrated.
suffix
Specifies to add a suffix to the computer being migrated.

Computer renameprefixorsuffix

Specifies the prefix or suffix to add to computer names during a migration. Use this operation when the prefix or suffix parameter is used with the Computer renameoption operation.

One Step admt computer /{rt|renameprefixorsuffix}: "PrefixOrSuffix"

PrefixOrSuffix
The prefix or suffix to add to computer names. The prefix or suffix will be added to all migrated computer names. Enclose the prefix or suffix in quotation marks.

Computer conflictoptions

Specifies an action for ADMT to take when an object name is found to already exist in the target domain.

One Step admt computer /{co|conflictoptions}: {ignore|replace[+removeuserrights] [+movereplacedaccounts]|prefix|suffix}

ignore
Does not migrate the computer that already exists in the target domain, then proceeds with the rest of the migration. This is the default setting.
replace
Replaces the computer that already exists in the target domain with the computer from the source domain.
+removeuserrights
Removes existing user rights from the target account. Use this parameter with the replace parameter.
+movereplacedaccounts
If ADMT finds a previously migrated account's organizational unit has changed, this option causes ADMT to move the account from the original OU to the changed OU in the target domain. Use this parameter with the replace parameter.
prefix
Renames the computer from the source domain by adding a prefix, then migrates the computer.
suffix
Renames the computer from the source domain by adding a suffix, then migrates the computer.

Computer conflictprefixorsuffix

Specifies the prefix or suffix to add to a migrated computer. Use this operation when using the prefix or suffix parameter with the Computer conflictoptions operation.

One Step admt computer /{ct|conflictprefixorsuffix}: "PrefixOrSuffix"

PrefixOrSuffix
The prefix or suffix to add to the source computer that has a duplicate name. Enclose the prefix or suffix in quotation marks.

Computer restartdelay

Specifies the number of minutes that the machine waits before restarting after completion of the migration.

One Step admt computer /{rdl|restartdelay}: Minutes

Minutes
A number of minutes from 1 to 10. The default is 5 minutes.

Computer computerpropertiestoexclude

Specifies properties to exclude when migrating a computer.

One Step admt computer /{ux|computerpropertiestoexclude}: {"Property"|"Property1[, Property2]..."}

Property
The property to exclude. Multiple properties can be listed. Separate each property by a comma and place all properties in a single set of quotation marks.

Computer includename

Specifies a computer or list of computers to migrate.

One Step admt computer /{n|includename} "Name1"[ "Name2"]...

Name
The name of the computer to migrate. Place the name in quotation marks. Separate multiple names by a space.

Computer includefile

Specifies the name of a file that contains a list of computers to migrate.

One Step admt computer /{f|includefile}: "FileName"

FileName
The name of the include file. This file can contain the NetBIOS name or the Windows 2000 relative distinguished name of the computer. Only one file may be specified with this parameter.

Computer includedomain

Specifies an entire source domain or organizational unit of accounts.

One Step admt computer /{d|includedomain}: [recurse [{+flatten|+maintain}]]

recurse
Specifies how to migrate listed domains or organizational units. If you do not use +flatten or +maintain with recurse, then the default is +flatten.
+flatten
Eliminates child containers in the specified domain(s) or organizational unit(s). This parameter specifies that accounts in the parent and child containers migrate into only one target container. Accounts in the child container migrate, but the child containers do not migrate.
+maintain
Migrates child containers as well as the accounts contained in them.

Computer excludename

Specifies which computers to exclude from the migration.

One Step admt computer /{en|excludename} "Name1" [ "Name2"]...

Name
The name of the computer that must not be migrated. Multiple names can be listed. Place each name in quotation marks and separate by a space. By default, all computers in a specified domain or organizational unit migrate. A maximum of two wildcard characters can be used in each name.

Computer excludefile

Specifies the name of a file that contains a list of computers to leave out of the migration.

One Step admt computer /{ef|excludefile}: "FileName"

FileName
The name of the excluded file. This file can contain the NetBIOS name or the Windows 2000 relative distinguished name of the computer. Only one file may be specified with this parameter. A maximum of two wildcard characters can be used in each name.


ADMT Security Syntax

 Open Command Prompt

ADMT uses the following general syntax:

One Step admt Operation Parameters Subparameters

Each task has its own set of operations. The tasks correspond to wizards available in the GUI version of ADMT. The tasks available in ADMT and the purpose of each are:

  • User: To migrate a single user or set of users.
  • Group: To migrate a single group or set of groups.
  • Computer: To migrate a single computer or set of computers.
  • Security: To perform a security translation by replacing source object SIDs with target object SIDs.
  • Service: To identify services within the domain running in a context other than the Local System account.
  • Report: To create reports for migration statistics.

ADMT Security uses the following general syntax:

One Step admt security Parameters Subparameters

Note

  • Regardless of the number of operations needed, only one line of syntax is needed for the Security task. List the operations together on one line of syntax, separating each operation by a space.

Parameters

Security optionfile

Uses a file for a list of operations and parameters to perform during the migration. Only one file name can be specified with Security optionfile. To specify more than one file name, list the parameter a second time with another file name.

One Step admt security /{o|optionfile}: "FileName"

FileName
The name of the file that contains the operations and parameters for the migration.

Security testmigration

Specifies that the migration is a test instead of an actual migration of objects.

One Step admt security /{tm|testmigration}: {yes|no}

yes
Does not migrate any objects. Tests settings and reports errors.
no
Migrates objects from the source to the target domain. This is the default setting.

Security sourcedomain

Specifies the name of the domain to migrate. This is always a required operation.

One Step admt security /{sd|sourcedomain}: "SourceDomainName"

SourceDomainName
The NetBIOS or DNS name of the domain to migrate.

Security sourceOU

Specifies the name of the organizational unit to restructure. This parameter is used only for Active Directory source domains.

One Step admt security /{so|sourceou}: "Name"

Name
The name of the source organizational unit.

Security targetdomain

Specifies the name of the domain to migrate to. This is always a required operation.

One Step admt security /{td|targetdomain}: "Name"

Name
The NetBIOS or DNS name of the target domain to migrate to.

Security translateoption

Specifies how to update the SIDs for security translation after migrating accounts.

One Step admt security /{tot|translateoption}: {replace|add|remove}

replace
Changes the SID of the migrated accounts on all ACLs and SACLs to match the target domain. This is the default setting.
add
Adds the target domain SIDs to the existing source domain SIDs when migrating the account.
remove
Deletes the source domain SID from the migrated account and does not add the SIDs from the target domain.

Security translatefilesandfolders

Specifies whether to update ACLs for files and folders during migration.

One Step admt security /{tff|translatefilesandfolders}: {yes|no}

yes
Updates the ACLs for files and folders when migrating this computer.
no
Does not update the ACLs for files and folders when migrating this computer. This is the default setting.

Security translatelocalgroups

Specifies whether to update ACLs for local groups during migration.

One Step admt security /{tlg|translatelocalgroups}: {yes|no}

yes
Updates the ACLs for local groups when migrating this computer.
no
Does not update the ACLs for local groups when migrating this computer. This is the default setting.

Security translateprinters

Specifies whether to update ACLs for printer shares during migration.

One Step admt security /{tps|translateprinters}: {yes|no}

yes
Updates the ACLs for printer shares when migrating this computer.
no
Does not update the ACLs for printer shares when migrating this computer. This is the default setting.

Security translateregistry

Specifies whether to update ACLs for registry settings during migration.

One Step admt security /{trg|translateregistry}: {yes|no}

yes
Updates ACLs for the registry when migrating this computer.
no
Does not update the ACLs for the registry when migrating this computer. This is the default setting.

Security translateshares

Specifies whether to update ACLs for shares during migration.

One Step admt security /{tss|translateshares}: {yes|no}

yes
Updates ACLs for the shares when migrating this computer.
no
Does not update the ACLs for the shares when migrating this computer. This is the default setting.

Security translateuserprofiles

Specifies whether to update ACLs for user profiles during migration.

One Step admt security /{tup|translateuserprofiles}: {yes|no}

yes
Updates ACLs for user profiles when migrating this computer.
no
Does not update the ACLs for user profiles when migrating this computer. This is the default setting.

Security translateuserrights

Specifies whether to update ACLs for user rights during migration.

One Step admt security /{tur|translateuserrights}: {yes|no}

yes
Updates ACLs for user rights when migrating this computer.
no
Does not update the ACLs for user rights when migrating this computer. This is the default setting.

Security SIDmappingfile

Specifies a file that provides mappings from objects in the source domain to objects in the target domain. For information about how to create a SID mapping file, see Security identifier (SID) translation.

One Step admt security/{smf|sidmappingfile}: "FileName"

FileName
The path and name of the SID mapping file. Enclose the file name in quotation marks.

Security includename

Specifies an account or list of accounts for which security settings change.

One Step admt security /{n|includename} "Name1"[ "Name2"]...

Name
The name of the account to migrate. Enclose the name in quotation marks. Separate multiple names by a space.

Security includefile

Specifies the name of a file that contains a list of accounts that need security translation.

One Step admt security /{f|includefile}: "FileName"

FileName
The name of the include file. This file can contain the Windows NT SAM account name or the Windows 2000 relative distinguished name of the account. Only one file may be specified with this parameter.

Security includedomain

Specifies an entire source domain or organizational unit of accounts.

One Step admt security /{d|includedomain}: [recurse [{+flatten|+maintain}]]

recurse
Specifies how to migrate listed domains or organizational units. If you do not use +flatten or +maintain with recurse, then the default is +flatten.
+flatten
Eliminates child containers in the specified domain(s) or organizational unit(s). Specifies that accounts in the parent and child containers migrate into only one target container. The accounts in the child container migrate, but the child containers do not migrate.
+maintain
Migrates child containers as well as the accounts contained in them.

Security excludename

Specifies which accounts to exclude from the migration.

One Step admt security /{en|excludename} "Name1"[ "Name2"]...

Name
The name of the account that must not be migrated. Multiple names can be listed. Place each name in quotation marks and separate by a space. By default, all accounts in a specified domain or organizational unit migrate.

Security excludefile

Specifies the name of a file that contains a list of accounts to leave out of the security translation.

One Step admt security /{ef|excludefile}: "FileName"

FileName
The name of the excluded file. This file can contain the Windows NT SAM account name or the Windows 2000 relative distinguished name of the account. Only one file may be specified with this parameter. A maximum of two wildcard characters can be used in each name.


ADMT Service Syntax

 Open Command Prompt

ADMT uses the following general syntax:

One Step admt Operation Parameters Subparameters

Each task has its own set of operations. The tasks correspond to wizards available in the GUI version of ADMT. The tasks available in ADMT and the purpose of each are:

  • User: To migrate a single user or set of users.
  • Group: To migrate a single group or set of groups.
  • Computer: To migrate a single computer or set of computers.
  • Security: To perform a security translation by replacing source object SIDs with target object SIDs.
  • Service: To identify services within the domain running in a context other than the Local System account.
  • Report: To create reports for migration statistics.

ADMT Service uses the following general syntax:

One Step admt service Parameters Subparameters

Note

  • Regardless of the number of operations needed, only one line of syntax is needed for the Service task. List the operations together on one line of syntax separating each operation by a space.

Parameters

Service optionfile

Uses a file for a list of operations and parameters to perform during the migration. Only one file name can be specified with Service optionfile. To specify more than one file name, list the parameter a second time with another file name.

One Step admt service /{o|optionfile}: "FileName"

FileName
The name of the file that contains the operations and parameters for the migration.

Service sourcedomain

Specifies the name of the domain to migrate. This is always a required operation.

One Step admt service /{sd|sourcedomain}: "SourceDomainName"

SourceDomainName
The NetBIOS or DNS name of the domain to migrate.

Service sourceOU

Specifies the name of the organizational unit to restructure. This parameter is used only for Active Directory source domains.

One Step admt service /{so| SourceOU}: "Name"

Name
The name of the source organizational unit.

Service includename

Specifies a service or list of services to migrate.

One Step admt service /{n|includename} "Name1"["Name2"]...

Name
The name of the account to migrate. Place the name inside quotation marks. Separate multiple names by a space.

Service includefile

Specifies the name of a file that contains a list of services to migrate.

One Step admt service /{f|includefile}: "FileName"

FileName
The name of the include file. Only one file may be specified with this parameter.

Service includedomain

Specifies an entire source domain or organizational unit to search.

One Step admt service /{d|includedomain}: [recurse [{+flatten|+maintain}]]

recurse
Specifies how to migrate listed domains or organizational units. If you do not use +flatten or +maintain with recurse, then the default is +flatten.
+flatten
Eliminates child containers in the specified domain(s) or organizational unit(s). This parameter migrates the parent and child containers into only one target container. The accounts in the child container migrate, but the child containers do not migrate.
+maintain
Migrates child containers as well as the accounts contained in them.

Service excludename

Specifies which accounts to exclude from the migration.

One Step admt service /{en|excludename} "Name1" [ "Name2"]...

Name
The name of the account that must not migrate. If this parameter is not used, all accounts in a specified domain or organizational unit migrate by default. Multiple names can be listed. Place each name in quotation marks and separate by a space.

Service excludefile

Specifies the name of a file that contains a list of services to leave out of the migration.

One Step admt service /{ef|excludefile}: "FileName"

Filename
The name of the excluded file. Only one file may be specified with this parameter. A maximum of two wildcard characters can be used in each name.


ADMT Report Syntax

 Open Command Prompt

ADMT uses the following general syntax:

One Step admt Operation Parameters Subparameter

Each task has its own set of operations. The tasks correspond to wizards available in the GUI version of ADMT. The tasks available in ADMT and the purpose of each are:

  • User: To migrate a single user or set of users.
  • Group: To migrate a single group or set of groups.
  • Computer: To migrate a single computer or set of computers.
  • Security: To perform a security translation by replacing source object SIDs with target object SIDs.
  • Service: To identify services within the domain running in a context other than the Local System account.
  • Report: To create reports for migration statistics.

ADMT Report uses the following general syntax:

One Step admt report Parameters Subparameters

Note

  • Regardless of the number of operations needed, only one line of syntax is needed for the Report task. List the operations together on one line of syntax, separating each operation by a space.

Parameters

Report optionfile

Uses a file for a list of operations and parameters to perform during the migration. Only one file name can be specified with Report optionfile. To specify more than one file name, list the parameter a second time with another file name.

One Step admt report /{o|optionfile}: "FileName"

FileName
The name of the file that contains the operations and parameters for the migration report.

Report sourcedomain

Specifies the name of the domain to migrate. This is always a required operation.

One Step admt report /{sd|sourcedomain}: "SourceDomainName"

SourceDomainName
The NetBIOS or DNS name of the domain to migrate.

Report sourceOU

Specifies the name of the organizational unit to restructure. This parameter is used only for Active Directory source domains.

One Step admt report /{so|sourceOU}: "Name"

Name
The name of the source organizational unit.

Report targetdomain

Specifies the name of the domain to migrate to. This is always a required operation.

One Step admt report /{td|targetdomain}: "Name"

Name
The NetBIOS or DNS name of the target domain to migrate to.

Report reporttype

Specifies the type of report to create.

One Step admt report/{rpt|reporttype}: {migratedaccounts|migratedcomputers|expiredcomputers|accountreferences|nameconflicts}

migratedaccounts
Summarizes the results of the user and group migration operations. The results of this report are saved in a file called MigrAcct.htm.
migratedcomputers
Summarizes the results of the computer migration operations. The results of this report are saved in a file called MigrComp.htm.
expiredcomputers
Lists the computer accounts with expired passwords. The results of this report are saved in a file called ExpComp.htm.
accountreferences
Lists all accounts that have been assigned permissions. The results of this report are saved in a file called AcctRefs.htm.
nameconflicts
Lists the user accounts and groups that exist in both the source and target domains. The results of this report are saved in a file called NameConf.htm.

Report reportfolder

Specifies the folder to which reports are saved.

One Step admt report/{rpf|reportfolder}: "FolderName"

FolderName
The name of the folder. Place the name in quotation marks. The default folder name is \Reports.

Report includename

Specifies a report or list of reports to generate.

One Step admt report /{n|includename} "Name1"["Name2"]...

Name
The name of the computer on which to generate the report. Place the name in quotation marks. Separate multiple names by a space.

Report includefile

Specifies the name of a file that contains a list of reports to generate.

One Step admt report /{f|includefile}: "FileName"

FileName
The name of the include file. Only one file may be specified with this parameter.

Report includedomain

Specifies an entire source domain or organizational unit to search.

One Step admt report /{d|includedomain}: [recurse [{+flatten|+maintain}]]

recurse
Specifies how to migrate listed domains or organizational units. If you do not use +flatten or +maintain with recurse, then the default is +flatten.
+flatten
Eliminates child containers in the specified domain(s) or organizational unit(s). Migrates the parent and child containers into only one target container. The accounts in the child container migrate, but the child containers do not migrate.
+maintain
Migrates child containers as well as the accounts contained in them.

Report excludename

Specifies which accounts to exclude from the migration.

One Step admt report /{en|excludename} "Name1" [ "Name2"]...

Name
The name of the account that must not be migrated. By default, all accounts in a specified domain or organizational unit are migrated. Multiple names can be listed. Place each name in quotation marks and separate by a space. A maximum of two wildcard characters can be used in each name.

Report excludefile

Specifies the name of a file that contains a list of reports to leave out of the migration.

One Step admt report /{ef|excludefile}: "FileName1"[ "FileName2"]...

FileName
The name of the excluded file. Only one file may be specified with this parameter. A maximum of two wildcard characters can be used in each name.


ADMT Examples

Windows Tools

ADMT Command-line Examples

 Open Command Prompt

Example 1: Identifying Service Accounts

In this example, the computer Member1 is searched for services not using the LocalSystem account. Information about these accounts on Member1 is noted in the ADMT database.

Only those settings which differ from the default settings of ADMT need to be specified at the command prompt. The following table shows the parameters needed and notes which actions occur by default. Default actions will be left out of the command.

Action | Command
Specify the name of the computer to search | /N "AliceG" "BobA"
Specify source domain | /SD:"NY-ACCT"
Specify target domain | /TD:"reskit.com"

Open Notepad and type the following command:

ADMT service /N "Member1" /SD:"NY-ACCT" /TD:"reskit.com"

On the computer that has ADMT installed save this file as ServAccMig.cmd. Open the command prompt and change to the directory containing the ServAccMig.cmd file. Type the following command and press Enter:

ServAccMig.cmd

Example 2: Migrating User Accounts

In this example, the user accounts AliceG and BobA are migrated from the NY-ACCT source domain to the reskit.com target domain. The target organizational unit is NY-ACCT. During the migration complex passwords are generated and stored in a file called password.txt. This file is saved in the C:\Program Files\Active Directory Migration Tool\Logs directory. This example leaves both accounts enabled after migration, migrates source SIDS, translates roaming profiles, updates user rights, does not rename accounts with duplicate names in the target domain, replaces duplicate user accounts that already exist in the target domain with those from the source domain.

Only those settings which differ from the default settings of ADMT need to be specified at the command prompt. The following table shows the parameters needed and notes which actions occur by default. Default actions will be left out of the command.

Action | Command
Specify user accounts to migrate | /N "AliceG" "BobA"
Specify source domain | /SD:"NY-ACCT"
Specify target domain | /TD:"reskit.com"
Specify target OU | /TO:"NY-ACCT"
Specify password generation | /PO:Complex
Specify location and name of password file | /PF:"C:\Program Files\Active Directory Migration Tool\Logs\Password.txt"
Migrate source user SID to target account | /MSS:Yes
Translate existing roaming profiles | /TRP:Yes
Specifies rename action when a duplicate account exists in the target domain | /RO:Dont (This default action does not need to be specified in the command.)
Replace existing accounts in the target domain with the account in the source domain | /CO:Replace

Open Notepad and type the following command:

ADMT user /N "AliceG" "BobA" /SD:"NY-ACCT" /TD:"reskit.com" /TO:"NY-ACCT" /PO:Complex /PF:"C:\Program Files\Active Directory Migration Tool\Logs\Password.txt" /MSS:Yes /TRP:Yes /CO:Replace

On the computer that has ADMT installed save this file as UserAccMig.cmd. Open the command prompt and change to the directory containing the UserAccMig.cmd file. Type the following command and press Enter:

UserAccMig.cmd

Example 3: Migrating Computers

In this example, the member server Member1 is migrated from the NY-ACCT source domain to the reskit.com target domain. The target organizational unit for the computer account is NY-ACCT. During the migration the computer will be set to reboot one minute after completion of the migration, duplicate accounts will not be renamed, nor will they be migrated.

Only those settings which differ from the default settings of ADMT need to be specified at the command prompt. The following table shows the parameters needed and notes which actions occur by default. Default actions will be left out of the command.

Action | Command
Specify user accounts to migrate | /N "Member1"
Specify source domain | /SD:"NY-ACCT"
Specify target domain | /TD:"reskit.com"
Specifies how many minutes to wait before restarting the migrated computer | /RD:1
Specifies how to rename duplicate accounts | /RO:Dont
Specifies how to handle conflicting accounts | /CO:Ignore

Open Notepad and type the following command:

ADMT computer /N "Member1" /SD:"NY-ACCT" /TD:"reskit.com" /TO:"NY-ACCT" /RD:1 /RO:Dont /CO:Ignore

On the computer that has ADMT installed save this file as CompMig.cmd. Open the command prompt and change to the directory containing the CompMig.cmd file. Type the following command and press Enter:

CompMig.cmd


Resources

This section includes:

  • Additional help on the Internet
  • Glossary


Additional help on the Internet

This topic lists some of the resources available on the Internet.

Microsoft Domain Migration and Restructuring

The Microsoft Domain Migration and Restructuring tools Web site contains up-to-date information and scenarios describing the various tools and methods used to migrate Windows NT networks to Windows 2000 and Windows Server 2003 family networks and to restructure existing Active Directory environments.

For more information, or to download the most recent version of Active Directory Migration Tool, see the Domain Upgrades & Active Directory Web site (http://www.microsoft.com/windows2000/techinfo/planning/pds-cduadtoc.asp).

Microsoft Personal Online Support

The Microsoft Personal Online Support Web site contains an extensive collection of articles, troubleshooting wizards, items you can download, and other useful product information, such as frequently asked questions (FAQs) and information from newsgroups.

For more information, or to begin your search, see the Microsoft Web site (http://www.microsoft.com/).

TechNet

TechNet is a service that contains resources for information technology (IT) professionals. This includes access to articles written by support professionals at Microsoft, career and industry information, discussion groups, technical feedback, and software. For more information about TechNet, see the Microsoft Web site (http://www.microsoft.com/).


Glossary

A BC D E F GHIJKL M N OPQ R S TUVWXYZ

A

account domain

A Windows NT domain that holds user account data. Also known as a master user domain.

See also: resource domain

B

There are no glossary terms that begin with this letter.

C

There are no glossary terms that begin with this letter.

D

domain migration

The process of moving accounts, resources, and their associated security objects from one domain structure to another.

domain restructure

The process of reorganizing one domain structure into another that typically results in the accounts, groups, and trusts being altered.

domain upgrade

The process of installing a newer version of an operating system on all domain controllers in a domain.

E

There are no glossary terms that begin with this letter.

F

forest

One or more Active Directory domains that share the same class and attribute definitions (schema), site and replication information (configuration), and forest-wide search capabilities (global catalog). Domains in the same forest are linked with two-way, transitive trust relationships.

G

There are no glossary terms that begin with this letter.

H

There are no glossary terms that begin with this letter.

I

There are no glossary terms that begin with this letter.

J

There are no glossary terms that begin with this letter.

K

There are no glossary terms that begin with this letter.

L

There are no glossary terms that begin with this letter.

M

mixed mode

In a Windows 2000 domain, the default domain mode setting. Mixed mode enables Windows NT-based backup domain controllers to coexist with Windows 2000-based domain controllers. Mixed mode does not support universal groups or the nesting of groups. You can change the domain mode setting to native mode when all Windows NT-based domain controllers are removed from a domain.

In Windows Server 2003 domains, mixed mode is referred to as Windows 2000 mixed, and it is one of three domain functional levels available.

See also: native mode

N

native mode

In Windows 2000 domains, the domain mode in which all domain controllers in a domain are running Windows 2000 and a domain administrator has switched the domain operation mode from mixed mode to native mode. Native mode supports universal groups and nesting of groups. In native mode, domain controllers running Windows NT 4.0 or earlier are not supported.

In Windows Server 2003 domains, native mode is referred to as Windows 2000 native, and it is one of three domain functional levels available.

See also: mixed mode

O

There are no glossary terms that begin with this letter.

P

There are no glossary terms that begin with this letter.

Q

There are no glossary terms that begin with this letter.

R

resource domain

A Windows NT 4.0 domain that is used for hosting file, print, and other application services.

S

security descriptor

A data structure that contains security information associated with a protected object. Security descriptors include information about who owns the object, who can access it and in what way, and what types of access are audited.

security ID (SID)

A data structure of variable length that identifies user, group, and computer accounts. Every account on a network is issued a unique SID when the account is first created. Internal processes in Windows refer to an account's SID rather than the account's user or group name.

security principal

An account holder that is automatically assigned a security identifier (SID) to control access to resources. A security principal can be a user, group, service, or computer.

See also: security ID (SID)

T

There are no glossary terms that begin with this letter.

U

There are no glossary terms that begin with this letter.

V

There are no glossary terms that begin with this letter.

W

There are no glossary terms that begin with this letter.

X

There are no glossary terms that begin with this letter.

Y

There are no glossary terms that begin with this letter.

Z

There are no glossary terms that begin with this letter.


Troubleshooting

What problem are you having?

I am receiving an error message that Active Directory Migration Tool could not verify auditing and TcpipClientSupport on domains.

Cause: All necessary configuration changes have not been made.

Solution: Properly configure your migration environment and try the operation again.

See also: Checklist: Before using Active Directory Migration Tool, Migration requirements, Before performing an interforest migration, and Before performing an intraforest migration

Active Directory Migration Tool agents either fail to install or will not run on a remote computer.

Cause: The agent is dispatched with invalid credentials or the migration environment is not configured correctly.

Solution: An agent is dispatched to a remote computer using the credentials of the account used to run Active Directory Migration Tool. Once installed on the remote computer, the agent runs under the local system account. The credentials that you provide to the wizard before the agent is dispatched to the remote computer are used to write results back to a share created on the computer on which Active Directory Migration Tool is running. The agent must have the right to log on locally to the remote computer, and, if the agent is used to migrate computers, it must have Administrative rights in the source domain.

To ensure that you have the correct credentials, create trusts such that the source domain trusts the target domain and the target domain trusts the source domain. Add the Domain Admins group of the target domain (target\Domain Admins) to the built-in Administrators group of the source domain (source\Administrators). Log on using the target\Domain Admins account and supply a set of credentials for the source\Administrators account when prompted. This will provide you with administrative permissions on both the source and target domains.

See also: Migration requirements

Agent dispatch operations are failing with credentials conflict errors.

Cause: You have an active connection, such as a mapped drive or a printer, to a computer on which an agent is being installed. The dispatch operation will fail because the credentials of the agent installation conflict with the existing set of credentials.

Solution: Remove any active connections between the computer that is running Active Directory Migration Tool and the computer to which the agent is being dispatched.

I am receiving the following error: "Cannot connect to agent."

Cause: The agent monitor tried to connect to the agent while the agent was still initializing.

Solution: Click Refresh one or more times to update the Agent Monitor.

When I try to view the results of a remote agent operation, I receive the following error: "Cannot open the \\ComputerName\(%SystemRoot%)$\temp\dctlog.txt file."

Cause: The default administrative share for the system volume of the computer to which the agent was dispatched is not enabled.

Because the default share is not enabled, the Active Directory Migration Tool cannot read the log file.

Solution: Reenable the default share of the system volume.

I am receiving the following error (W10431): "The Program Files folder name on \\ComputerName is in an unrecognized format "\ADMIN$"

Cause: By default, the Active Directory Migration Tool agent is installed to the folder specified by the %ProgramFiles% environment variable on the target computer. Since this environment variable does not exist by default on Windows NT 3.51 computers, the agent is installed to the %SystemRoot% folder instead.

Solution: This is a warning message. No action is necessary.

Active Directory Migration Tool was not able to change the domain affiliation of a particular computer. This failure caused the computer to lose affiliation with any domain.

Cause: This can be caused by an incorrect migration environment configuration or some malfunction with either the source or target computers.

Solution: Join the computer to a domain and create the computer account in the domain as described in the following procedures:

To change the domain membership of a computer running Windows NT 4.0 or earlier

  1. Log on to the computer using an account with local administrator permissions.
  2. Open the Control Panel, and then double-click Network.
  3. Click Change, and then, in Domain Name, type the name of the domain you want this computer to join.

To change the domain membership of a computer running Windows 2000 and Windows Server 2003 family

  1. Log on to the computer using an account with local administrator permissions.
  2. On the Desktop, right-click My Computer, and then click Properties.
  3. On the Network Identification tab, click Properties, and then click Domain.
  4. In Domain, type the name of the domain you want this computer to join.

Notes

  • To join a domain, you must enter credentials of an account with administrative permissions on the domain you want the computer to join.
  • You must restart the computer to complete joining the computer to the domain.

The Remove existing user rights option did not work.

Cause: If the Group Policy template associated with a user whose user rights are being removed contains the nondomain-qualified name of the user (for example, if it contains User1 instead of DomainA\User1), then the remove operation will fail.

Solution: Correct the user name entry in the Group Policy template.

I cannot find the Active Directory Migration Tool log files.

Solution: Active Directory Migration Tool creates several log files in the Logs folder under the Active Directory Migration Tools folder on the computer on which the tool is installed. User and group migration progress is recorded in Migration.log; dispatcher progress is recorded in Dispatcher.log; and the progress of the Trust Migration Wizard is recorded in Trust.log. Additionally, the progress of each agent is recorded in log files named for the computer to which the agents are dispatched. These log files are located in the Agents folder under the previously mentioned Logs folder. Each agent also records information a Dctlog.txt file which is created in the folder specified by the %TEMP% variable on each computer to which an agent is dispatched.

I cannot read the event log entries for the Active Directory Migration Tool agent.

Cause: You are not on a computer on which Active Directory Migration Tool has been installed.

Solution: The agent may write log entries to the computer on which it runs. Since the agent software is removed when the agent's task is finished, you can view the event log entries on the computer to which the agent was dispatched by running Event Viewer from the computer on which Active Directory Migration Tool is installed.

I need more information from the Active Directory Migration Tool logs.

Cause: Incorrect logging level setting.

By default, Active Directory Migration Tools writes summary information to its log files. The level of detail can be increased by changing the registry entry that controls the logging level.

Solution: On the computer on which Active Directory Migration Tool is installed, set the value of the HKEY_LOCAL_MACHINE\Software\Microsoft\ADMT\TranslationLogLevel registry key to 7.

Verbose logging mode is used for problem diagnosis and troubleshooting. The verbose logging mode can create very large log files, particularly in cases where large numbers of files, or other objects whose access control lists must be updated, exist on the target computer. Since the agent logs are written to the folder specified by the %TEMP% environment variable, the volume to which that environment variable points should have ample disk space. When logging in verbose mode, it may be necessary to change the value of the %TEMP% environment variable before dispatching an agent.

Generated reports do not show up in Active Directory Migration Tool.

Cause: When the tool generates reports, it does not automatically update the console.

Solution: To view the reports, close and reopen Active Directory Migration Tool.

When generating reports, I receive IDispatch error 3107.

Cause: This error may occur when the Agent Monitor is closed before all agents have finished writing their results back to the Active Directory Migration Tool reporting database.

Solution: To prevent this problem, wait until all agents have completed their tasks before closing the Agent Monitor.

After an interforest migration, users cannot log on to their new domain.

Cause: When performing an interforest migration, Active Directory Migration Tool always sets the User Must Change Password option for migrated users. If the user account has the User Cannot Change Password option set, then the target account won't be able to log on until one or both options have been changed.

Solution: Change the options using one of the following methods:

To enable the ability to change the user password

  1. In Active Directory Users and Computers, on the View menu, click Advanced Features.
  2. Right-click the user, and then click Properties.
  3. On the Security tab, allow the Change Password permission for Everyone and for the user.

To remove the User Must Change Password flag

  • In Active Directory Users and Computers, right-click the user, and then click Reset Password.

After an intraforest migration, users cannot log on to their new domain.

Cause: The user account passwords used in the old domain may violate the password restrictions in the new domain.

In an intraforest migration, user account passwords from the source domain are migrated to the target domain. If the source domain user accounts have passwords that violate the password restrictions (such as minimum length) in the target, then the affected migrated users will be unable to log on until their password has been set to a value that fits the target domain password policy.

If the users try to use the invalid passwords, their new user accounts may be locked. If you selected Disable target accounts in the User Migration Wizard, the new user accounts will be disabled. As a result, the migrated users may not be able to log on until their accounts have been unlocked or marked as enabled.

Solution: Reset the user account passwords to a value that fits the new domain's password policy, and enable the user accounts if they were disabled due to repeated password failure.

Migrated users receive an error indicating that their user name or password is incorrect.

Cause: Migrated users cannot log on due to password policy, even though password policies appear to be disabled.

During a migration, some administrators may choose to disable their password policies on the target domain. If they try to accomplish this by turning off the minimum password length policy without setting the password policy to zero, it is possible that the users will not be able to log on because an effective password policy is still in effect.

Solution: Set the password policy to a length of zero. After the zero length policy is in effect, the minimum password length policy can be turned off.

SID History migration is not working.

Cause: There are a number of conditions that must be satisfied for SID History migration to work.

Solution: Properly configure the migration environment before running Active Directory Migration Tool, and review the configuration topics before proceeding with the migration.

See also: Checklist: Before using Active Directory Migration Tool, Migration requirements, Before performing an interforest migration, and Before performing an intraforest migration.

Note

  • When migrating a previously migrated security principal to a new domain, the criteria for migrating SID History should be in place for all three domains.

    For example, you have the following three domains: DomainA, DomainB, and DomainC. DomainA is a Windows NT 4.0 domain. DomainB and DomainC are Windows 2000 domains operating in native mode. User1 in DomainA (DomainA\User1) was migrated to DomainB as DomainB\User1 and SID History was translated. DomainB\User1 now has the primary SID for DomainB\User1 and the SID History value for DomainA\User1. If an administrator wants to migrate DomainB\User1 to DomainC\User1 and preserve all of DomainB\User1's SIDs, then the proper configuration settings must be in place to allow migration from DomainA to DomainC and from DomainB to DomainC. If DomainA has been decommissioned, or if proper configuration cannot be satisfied between DomainA and DomainC, then Active Directory Migration Tool will migrate the SID for DomainB\User1 to DomainC\User1 and log the fact that it could not migrate the DomainA\User1 SID.

    If DomainA does not exist, ADMT will write an error message to the log, but migration will still be successful. This error message can be ignored.

Permissions on a resource show "Account Unknown" for a migrated group or user.

Cause: If, when migrating a group or user account, domain controllers in the source domain are no longer available, computers in domains outside the target forest that are running Windows NT 3.51, Windows NT 4.0, or Windows 2000 (in a domain operating in mixed mode) may not be able to resolve the group or user object's SID History with the target domain's Global Catalog.

As long as the source domain is accessible, the group or user account name can be resolved. The inability to resolve the account name is an administrative problem only. The inability to resolve the group or user account name through SID History does not prevent that account from having the desired access to that resource. For example, if a user shows up as "Account Unknown" in a group's membership list, that user is still a member of that group and has the rights associated with that group.

Solution: This SID History resolution problem can be fixed by running the Security Translation Wizard to replace the source account SID with the new target account SID for all resources on all affected computers. This problem will be much more prevalent if you decommission the source account domain prior to migrating the source resource domain. Therefore, you should decommission all source domains together as the last step in the migration process.

After migration, new user accounts in the target domain are unable to access resources where the source domain accounts have permissions.

Cause: The settings necessary to run Active Directory Migration Tool have not been correctly established.

Most migration problems are caused by an incorrectly configured migration environment.

Solution: Open the migration log file and find the account you migrated with SID History. If SID History was added to the account, you should see an entry similar to the following:

1999-10-06 18:28:50-SID for UserAccountName added to the SID History of UserAccountName

If you receive an error message, it's almost certain you have not configured the environment correctly, and you should review the configuration topics before retrying the migration.

For up-to-date information and scenarios describing the various tools and methods used to migrate Windows NT networks to Windows 2000 and Windows Server 2003 family networks and to restructure existing Active Directory environments, see the Microsoft Domain Upgrades & Active Directory Web site (http://www.microsoft.com/windows2000/techinfo/planning/pds-cduadtoc.asp).

See also: Checklist: Before using Active Directory Migration Tool, Migration requirements, Before performing an interforest migration, and Before performing an intraforest migration.

I am receiving the following error: "The Recycle Bin on C:\ is corrupt or invalid. Do you want to empty the Recycle Bin for this drive?"

Cause: This is by design. For security reasons, each user who logs on to a Windows 2000 or Windows Server 2003 family computer receives their own, user-specific Recycle Bin. The access control list (ACL) for each instance of the Recycle Bin can contain only one user specific SID. When a user's profile is migrated using the Add option, the SID of the source domain user is added to the SID History of the Recycle Bin. This essentially places two user specific SIDs in the Recycle Bin's ACL. This problem does not occur if profiles are migrated using the Replace option.

Solution: Click Yes to the error message, and the Recycle Bin will be emptied without a problem. If you click No, the error will continue to appear until the Recycle Bin is emptied.

Users in domains that are not trusted cannot access Distributed file system (Dfs) shares in Active Directory domains.

Cause: This is by design.

Solution: If you plan to use Dfs shares in your domain, you should migrate the computers first or migrate the computers and users in the same migration session.

SID History does not work for migrated Exchange service accounts.

Cause: Active Directory Migration Tool correctly migrates the Exchange service accounts, but there is a special manual process for updating Exchange service accounts that must be completed while running Exchange. Failure to follow this process could result in system failure or data loss on the Exchange system.

Solution: Review walkthrough material, scenarios, and other information about performing a domain migration on the Microsoft Domain Upgrades & Active Directory Web site (http://www.microsoft.com/windows2000/techinfo/planning/pds-cduadtoc.asp). You can also contact Microsoft Product Support Services for details on how to change the service account used by Exchange services in a site.

See also: Resources


Password Options

Specifies how Active Directory Migration Tool assigns passwords to migrated user accounts. The options are defined as follows:

Complex passwords

Automatically generates a complex password for each migrated user account. A complex password includes a combination of capital and lowercase letters as well as numbers and symbols. Active Directory Migration Tool records the new passwords in a password file.

Same as user name

Sets the password for each copied user account to the first 14 characters of the user account name. Active Directory Migration Tool records the passwords in a password file.

Migrate passwords

Allows the migration of the original passwords in the source domain to the target domain. Before choosing this option make sure all of the prerequisite setup is completed. For more information on this topic and the setup for it see the Password Migration help file.

Password migration source DC:

Specifies a source domain controller that has been set up as a Password Export Server (PES). You can type the PES name or use Browse to find it. To configure a source domain controller as the Password Export Server see the Password Migration help file.


This information is not available

The information you are trying to locate is not available on this computer.

Try the following Web sites:

  • Windows Resource Kits (http://go.microsoft.com/fwlink/?LinkId=291)
  • Microsoft Press (http://go.microsoft.com/fwlink/?LinkId=215)
  • Microsoft Windows (http://go.microsoft.com/fwlink/?LinkId=622)
  • Microsoft Product Support (http://go.microsoft.com/fwlink/?LinkId=281)
  • Microsoft Technet (http://go.microsoft.com/fwlink/?LinkId=170)
  • Microsoft MSDN (http://go.microsoft.com/fwlink/?LinkId=140)


Group Options

Specifies how Active Directory Migration Tool handles the group merge. These options are defined as follows:

Copy user rights

Copies the user rights assigned in the source domain to the target domain.

Migrate group SIDs to target domain

Adds the security ID (SID) of the migrated user accounts and groups in the source domain to the SID History of the new user accounts and groups in the target domain. This feature uses a secure connection to the source domain controller. For more information about SID History, see Understanding security.


Computer Selection

Specifies which computers the Report Wizard will check when creating a report. To add one or more computers, click Add, and then follow the instructions on the Select Computers page. To remove one or more computers, select the desired computers, and then click Remove.