Before performing an intraforest migration

This topic lists the domain and security configurations necessary before you can use Active Directory Migration Tool to migrate users, groups, and computers between two Windows 2000 domains in the same forest.

Source and target domain

Verify that your source and target domains are configured as described in the following list:

• The target domain is running Windows 2000 and is operating in native mode.
• The source domain is running Windows 2000 (either in mixed or native mode) and located in the same forest as the target domain.

Note

• It is recommended that the source domain is running Active Directory in native mode. If the source domain is running in mixed mode, the undo feature will not be available and users will not retain group memberships if the user and group are located in different domains.
• When migrating users and groups between domains in the same forest, Active Directory Migration Tool must communicate with the Relative ID (RID) pool master in the target domain. To improve performance when migrating a large number of users or groups, you should install Active Directory Migration Tool on the RID pool master in the target domain. By default, this is the first domain controller installed in the domain. Use Active Directory Users and Computers or Ntdsutil.exe to locate the domain controller that holds the RID pool master role.
• Any mapped network drives and similar connections between the source domain controller and the target domain controller on which Active Directory Migration Tool is running must be disconnected before running the tool. If they are not disconnected, the migration operation might fail with a "credentials conflict" error.

Security requirements

You must meet the following security configuration requirements before running Active Directory Migration Tool.

• The user account you log on with when you run Active Directory Migration Tool must have the following permissions:

  • Member of the Administrators group in both the source and target domains
  • Administrator rights on each computer you migrate
  • Administrator rights on each computer on which you translate security

  Note

  • To migrate users and groups from a child domain to the forest root domain, the user account you log on with when you run Active Directory Migration Tool must have the permissions of the Enterprise Admins group in addition to the security privileges normally needed to run the tool.
• Administrative shares must exist on the computer where Active Directory Migration Tool is running and on any computer to which the tool must dispatch an agent.