The migration process

Migrating a domain is a complex process that should not be undertaken without proper planning and testing.

Before the migration

Before migrating a domain, you should:

• Inventory the domains in your network and the trusts between them.
• Inventory the groups.
• Inventory the user accounts.
• Inventory the service accounts.
• Inventory the computers.
• Perform a test run.
• Generate and analyze migration reports.

The Active Directory Migration Tool supplies wizards to simplify parts of the process. You can run many of the wizards without actually making any changes in your network by clicking Test the migration settings and migrate later. You can then review the log files and reports generated by the wizards to identify and fix any potential problems before performing the actual migration.

For more information about what to do before you begin the migration, see Checklist: Before using Active Directory Migration Tool, Before performing an interforest migration, and Before performing an intraforest migration.

The migration

Once you have verified that migration will proceed as desired, use the wizards to migrate groups, users, and computers, and then use the Security Translation Wizard to update the access control lists (ACLs) on the computers. Throughout the migration process you should:

• Generate migration reports.
• Analyze the reports.
• Fix problems as necessary.

Repeat this process of migration, analyzation, and fixing any problems until your migration is complete.

Note

• During a migration operation, Active Directory Migration Tool establishes a connection with a specific domain controller in the target domain. If the target domain controller goes off the network, the migration operation will fail, even if another domain controller is available in the target domain. Active Directory Migration Tool will not switch target domain controllers while performing a migration operation. Restarting the migration operation will connect to a new domain controller in the target domain and will work normally.

For more information about performing the migration, see To perform an interforest account domain migration, To perform an interforest resource domain migration.

After the migration

The last step in the migration process is to decommission the source domains. When you decommission a domain, that domain ceases to exist.

Note

• Active Directory Migration Tool cannot change the domain affiliation of Windows NT primary domain controllers (PDCs) and backup domain controllers (BDCs) or Windows 2000 domain controllers. PDCs, BDCs, and Windows 2000 domain controllers must be migrated manually.

To decommission a Windows NT domain, once you have migrated all of the necessary accounts and resources and removed all trusts, you can simply turn off the last remaining domain controller in the domain. Then, you can install the desired operating system on that computer and join it to an existing domain. If you install Windows 2000 or Windows Server 2003 family, you can promote that computer to be a domain controller in another domain.

To decommission a Windows 2000 or Windows Server 2003 family domain, use the Active Directory Installation Wizard (Dcpromo.exe) to demote the last domain controller to a stand-alone server. You can then join that computer to another domain or promote it to be a domain controller in another domain.

For more information about promoting a domain controller and the Active Directory Installation Wizard, see Help for the Windows server product you are installing.