Active Directory Migration Tool

Use Active Directory Migration Tool to migrate user accounts, groups, and computer accounts between domains and to analyze the migration impact both before and after the actual migration process.

  • Before you begin using Active Directory Migration Tool, see Checklist: Before using Active Directory Migration Tool.
  • For tips about using Active Directory Migration Tool, see Best practices.
  • For help with specific tasks, see How to.
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.

Copyright © 1985-2000 Microsoft Corporation.
All rights reserved


Checklist: Before using Active Directory Migration Tool

Step | Reference
Verify that Active Directory Migration Tool is installed on computers with sufficient resources. | Migration requirements
Verify that the computers to which Active Directory Migration Tool agents will be dispatched have sufficient resources and are running a correct version of Windows NT or Windows 2000. | Migration requirements
Verify that the source and target domains are properly configured. | Before performing an interforest migration Before performing an intraforest migration
Review the concepts of domain migration. | The migration process Interforest migration Intraforest migration
Review the security concepts. | Understanding security
Review the concepts of trust relationships. | Understanding trust relationships
Review the concepts of how users, groups, and computers are migrated between domains. | Migrating user accounts and groups Migrating computers
Review the concepts of security translation. | Security identifier (SID) translation
Review the Active Directory Migration Tool best practices. | Best practices
Review the procedures for the various types of domain migration. | Perform an interforest account domain migration Perform an interforest resource domain migration Perform an intraforest account domain migration Perform an intraforest resource domain migration


Best practices

  • Carefully review the following topics:
    • Migration requirements
    • Before performing an interforest migration
    • Before performing an intraforest migration
  • Follow the migration procedures detailed in the following topics:
    • Perform an interforest account domain migration
    • Perform an interforest resource domain migration
    • Perform an intraforest account domain migration
    • Perform an intraforest resource domain migration
  • Synchronize the time on all computers participating in the migration.

    This will assist troubleshooting when using the event log.

  • Before migrating user profiles, empty the Recycle Bin on any computer that is used by a user whose profile will be migrated.

    Failure to empty the Recycle Bin will result in a benign "Recycle Bin corrupted" error. To clear this error, click Yes when prompted to empty the Recycle Bin.

  • Allow the migration process to finish without interruption.

    If you interrupt the migration process before it is finished, accounts may exist without correctly set properties.

  • When performing a lengthy migration, always run Active Directory Migration Tool from the same domain controller.

    Active Directory Migration Tool stores information used during the migration process in a file on the computer on which the tool is run. If you must change domain controllers during the migration, you can move this information to the new domain controller by copying the Protar.mdb file to the Active Directory Migration Tool folder on the new domain controller.

  • When migrating user accounts between domains in the same forest, user passwords are migrated to the target domain. Verify that the passwords of the source domain user accounts will match the password policy of the target domain.

    If the source user accounts have passwords that violate the password restrictions (such as minimum length) in the target, then the affected migrated accounts will be unable to log on until password has been set to a value that fits the target domain password policy and until the affected migrated accounts have been marked as enabled.

  • If you perform an intraforest migration of service accounts, ensure that all computers with the services on them are available when you perform the migration.

    When you perform an intraforest migration of accounts, you are actually moving the account since the two accounts cannot exist in the same forest. If a computer that uses one of these service accounts is not available, the service on that computer may stop working until it gets the service account updates.

  • To read Active Directory Migration Tool event log entries, read the log from a computer on which Active Directory Migration Tool is installed.

    The Active Directory Migration Tool agent may write event log entries to the computer on which it runs. Since the agent software is removed when the agent is finished, you can view the event log entries on a remote computer where the agent has run by running the Windows 2000 Event Viewer from the computer on which Active Directory Migration Tool is installed.

  • Two or more users in the same domain should not run Active Directory Migration Tool at the same time.

    Active Directory Migration Tool collects information about the objects to be migrated in a database. The tool then uses this information to perform the migration tasks. Two or more people trying to use Active Directory Migration Tool at the same time will cause a database access conflict.

  • Because agents are dispatched to remote computers, you should verify that replication is up to date across all domain controllers in the target domain before running the Computer Migration and Security Translation Wizards.

    Remote computers might look to a domain controller other than the one on which Active Directory Migration Tool is running to get the account and group information on which the operation is dependent. If a particular change has not replicated to all of the domain controllers in the domain, then the agent may receive outdated information and the computer migration or security translation could fail.

  • Install the Windows 2000 Support Tools and use Active Directory Administration Tool to help verify and troubleshoot correct object migration.

    For more information about the Windows 2000 Support Tools, see Windows 2000 Server Help.

  • Use the Migration.log and Dispatch.log files to help troubleshoot the Computer Migration Wizard.

    You can also use Event Viewer to view the Application and Security entries on both the source and target computers and on any computer to which an agent has been dispatched.


How to...

This section provides instructions for performing specific tasks:

  • Start a wizard
  • Perform an interforest account domain migration
  • Perform an interforest resource domain migration
  • Perform an intraforest account domain migration
  • Perform an intraforest resource domain migration
  • Create the TcpipClientSupport registry entry
  • Enable auditing on a Windows 2000 domain
  • Enable auditing on a Windows NT domain
  • Change domain mode of the target domain
  • Generate reports
  • Update Exchange after migrating users
  • Retry a task involving an agent
  • Undo the last operation


Start a wizard

To start a wizard

  1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Migration Tool.
  2. In the console tree, right-click Active Directory Migration Tool, and then click the desired wizard.

    Or, on the Action menu, click the desired wizard.

Related Topics


Perform an interforest account domain migration

To perform an interforest account domain migration

  1. Create the Windows 2000 target domain.

    2. More information

    • For instructions on how to set up a Windows 2000 domain or forest, see Windows 2000 Server Help.
    • The target domain must be operating in native mode.
  2. Establish trusts between the domains using the Trust Migration Wizard.

    3. More information

    • You may also need to use Active Directory Domains and Trusts to manually create trusts between the source and target domain. Migrate the trusts before you migrate user accounts, service accounts, or local groups.
    • For details about creating trusts between domains, see Windows 2000 Server Help and the Windows NT product documentation.
  3. Migrate global groups using the Group Migration Wizard.

    4. More information

    • If you have mapped a group to a different group in the target domain, and then you migrate that group from the source domain to the target domain, the mapping information is replaced. The group is then mapped to the migrated group in the target domain.
    • If you are migrating a distribution group (these only exist in Windows 2000) from the source domain to the target domain and group exists in the target domain as a security group, the target group will remain a security group even if the Replace option is selected.
    • If there is a large number of users in the domain, enumerating the users may take a significant amount of time and may impact your network bandwidth. To migrate many thousands of users you might want to migrate global groups and select to migrate their members with them.
  4. Identify and migrate user accounts using the User Migration Wizard.

    5. More information

    • You can migrate user accounts incrementally. Begin with a small number of users as a pilot project to verify whether the new domain environment and all resource access works correctly. Then, migrate the remaining users in one or more groups.
    • When the tool migrates user accounts, users are prompted to change their passwords the first time they log on to the network. The tool will override the Password never expires option unless the account has been marked as a service account using the Service Account Migration Wizard.
    • If the User cannot change password check box is selected for a user account, that migrated user account will be locked until the Administrator resets the password because the user will not be able to reset the password.
    • Active Directory Migration Tool cannot determine if a particular user account is used by one or more services. If any user accounts in the source domain are used to allow services to log on, you must run the Service Account Migration Wizard and select any servers that are running service accounts. Then, Active Directory Migration Tool can build a list of the service accounts to be migrated before you run the User Migration Wizard. If the Password never expires property is set for a user account, the User Migration Wizard clears the Password never expires unless you have used the Service Account Migration Wizard first.
    • If there is a large number of user accounts in the domain, when the User Migration Wizard builds the list of user accounts in a domain, retrieving this information can take a significant amount of time and can cause a significant impact on your network traffic.
    • Active Directory Migration Tool only migrates user rights in additive mode. This means that the user rights of any existing users and groups in the target domain will not be removed during a migration operation.
    • The user principal name suffix attribute of migrated user accounts is left empty by default but an implicit user principal name suffix of the current domain exists by default for each domain. For example, if the target domain is microsoft.com, the implicit user principal name for users migrated to that domain is UserName@microsoft.com.
  5. Do one of the following:
    • If you plan to migrate resource domains as part of the same migration process, see To perform a interforest resource domain migration.
    • Decommission the source account domain
      • .

    6. More information

    • If you plan to migrate resource domains as part of the same migration process, you should delay decommissioning the source account domain until the resource domain migration is complete. This will ensure that the source account domain controller will be available for service account migration, migration of shared local groups, and local workstation profile migration that may depend on a domain controller from the source account domain.
    • After all of the user accounts in an account domain have been migrated, you can migrate its domain controllers into the target domain just as you would in a resource domain migration.

Important

  • When performing an interforest migration, first migrate account domains, and then migrate resource domains.
  • Run the wizards in the order listed for best results.

Notes

  • When running the User Migration Wizard, Group Migration Wizard, or Security Migration Wizard, you must be logged on to the target domain as an administrator or member of the Administrators group.
  • The target domain must trust all domains that are trusted by the source domain and must be trusted by all domains that trust the source domain. The Trust Migration Wizard allows you to compare and create the source and target domain trusts.
  • When migrating a user, group, or computer account that exists in both the source and target domains, if the account in the target domain already has a value for a particular property and the account in the source domain does not have a value for that property, the value of the property in the target domain will be preserved. It will not be overwritten by the null-value of the property in the source domain.
  • You should migrate the security IDs (SIDs) to the target domain when migrating users and groups. This will update the SID History of the accounts. If you migrate accounts and do not update SID History for those accounts, the new accounts do not have the access the original accounts had until you translate security and the Exchange directory.
  • During the migration process, this tool truncates user account names that are more than 20 characters long.
  • Password complexity functions may limit the passwords the tool can assign to a user account. The tool can generate complex passwords that meet the minimum password length requirement and contain at least 3 lowercase letters, 3 uppercase letters, 3 numerical digits, and 3 symbols. If the generated password does not comply with the password complexity rules in the target domain, the tool disables the migrated user account.

Related Topics


Perform an interforest resource domain migration

To perform an interforest resource domain migration

  1. Establish trusts between domains using the Trust Migration Wizard.

    2. More information

    • You may also need to use Active Directory Domains and Trusts to manually create trusts between the source and target domain. Migrate the trusts before you migrate user accounts, service accounts, or local groups.
    • For details about creating trusts between domains, see Windows 2000 Server Help and the Windows NT product documentation.
  2. Identify service accounts not running under local system authority using the Service Account Migration Wizard.

    3. More information

    • Active Directory Migration Tool cannot determine if a particular user account is used by one or more services. If any user accounts in the source domain are used to allow services to log on, you must run the Service Account Migration Wizard and select any servers that are running service accounts. Then, the Active Directory Migration Tool can build a list of the service accounts to be migrated before you run the User Migration Wizard.
    • Many applications, including Exchange Server 5.5, use service account mappings that Active Directory Migration Tool cannot change. These service accounts usually require configuration through registry settings or from within the application itself. You must manually update these accounts after the domain migration is complete.
    • When asked for user account credentials, use credentials with Administrator rights on the specific computer that is using the service accounts.
  3. Migrate workstations and member servers using the Computer Migration Wizard.

    4. More information

    • At this time, you can choose to migrate the local profiles of previously migrated accounts from the same domain as the computer that will be translated. To translate previously migrated accounts from other domains, use the Security Translation Wizard and select each of the domains.
    • When migrating computer accounts from Windows NT domains, Active Directory Migration Tool will not migrate computer descriptions because the computer description attribute is not stored in the Windows NT domain security account manager. The description is stored on the local computer. Active Directory Migration Tool will migrate nonnull computer descriptions from computer accounts in Windows 2000 source domains.
    • The Computer Migration Wizard dispatches an agent to each computer being migrated. The agent restarts each computer after the computers join the target domain. Verify that the default startup menu option on the migrated computers is the migrated Windows NT or Windows 2000 installation.
  4. Migrate local profiles using the Security Translation Wizard.

    5. More information

    • On the Translate Objects wizard page, select User Profiles.
  5. Migrate shared local groups using the Group Migration Wizard.

    6. More information

    • On the Group Options wizard page, ensure that Migrate group SIDs to target domain and Do not rename accounts are the only options selected.
  6. Migrate service accounts using the User Migration Wizard.

    7. More information

    • Service accounts are user accounts used to run services on servers with a set of credentials other than local system authority. These accounts may exist both in a master account domain and in the same resource domain as the server. If the service account is in an account domain, this procedure would be completed by selecting the account domain as the source domain.
  7. Update service account user rights using the Security Translation Wizard.

    8. More information

    • Select the computers in the source domain from which to translate the user rights. When selecting the source domain, select the domain of the service accounts, not the domain of the computer on which the service accounts are running.
    • On the Translate Objects wizard page, select Local groups and User rights.
    • On the User Account wizard page, type the name of an account with Administrator permissions in the target domain.
  8. Manually move domain controllers into the resource domain.

    9. More information

    • Active Directory Migration Tool can not change the domain affiliation of Windows NT primary domain controllers (PDCs) and backup domain controllers (BDCs) or Windows 2000 domain controllers. PDCs, BDCs, and Windows 2000 domain controllers must be migrated manually. Do not use the Computer Migration Tool to migrate domain controllers. However, you can use all of the other Active Directory Migration Tool wizards on all domain controllers.
    • If the source domain is a Windows NT domain, upgrade the domain controllers to Windows 2000 beginning with the primary domain controller. The Active Directory Installation Wizard will run automatically as part of the upgrade process. When the upgrade is complete, demote the domain controller to a member server and then join the target domain.
    • If the source domain is a Windows 2000 domain, demote the domain controllers and join them to the target domain.
    • After a successful move operation, you should check the user access to resources on the computer that was moved. It may be necessary to run the Security Translation Wizard again on the moved computers to correct the local permissions.
  9. Decommission the source account domain.

    10. More information

    • When the migration process is complete, the source account domain can be decommissioned. At this time, the domain will cease to exist.
    • Remove all trusts between this domain and all other domains.
    • For information about decommissioning a Windows NT domain, see the Windows NT product documentation.
    • For information about decommissioning a Windows 2000 domain, see Windows 2000 Server Help.
  10. Decommission the source resource domain

    11. More information

    • When the migration process is complete, the source resource domain can be decommissioned. At this time, the domain will cease to exist.
    • Remove all trusts between this domain and all other domains.
    • For information about decommissioning a Windows NT domain, see the Windows NT product documentation.
    • For information about decommissioning a Windows 2000 domain, see Windows 2000 Server Help.

Important

  • When performing an interforest migration, first migrate account domains, and then migrate resource domains.
  • Run the wizards in the order listed for best results.

Notes

  • When running the Service Account Wizard or Computer Migration Wizard, you must be logged on to the source domain as an administrator or member of the Administrators group.
  • When running the User Migration Wizard, Group Migration Wizard, or Security Migration Wizard, you must be logged on to the target domain as an administrator or member of the Administrators group.
  • The target domain must trust all domains that are trusted by the source domain and that contain accounts that are members of local groups you migrate from the source domain. The Trust Migration Wizard allows you to compare and create the source and target domain trusts.
  • During the migration process, this tool truncates service account names that are more than 20 characters long.
  • When migrating a user, group, or computer account that exists in both the source and target domains, if the account in the target domain already has a value for a particular property and the account in the source domain does not have a value for that property, the value of the property in the target domain will be preserved. It will not be overwritten by the null-value of the property in the source domain.

Related Topics


Perform an intraforest resource domain migration

To perform an intraforest resource domain migration

  1. Identify service accounts not running under local system authority using the Service Account Migration Wizard.

    2. More information

    • Active Directory Migration Tool cannot determine if a particular user account is used by one or more services. If any user accounts in the source domain are used to allow services to log on, you must run the Service Account Migration Wizard and select any servers that are running service accounts. Then, the Active Directory Migration Tool can build a list of the service accounts to be migrated before you run the User Migration Wizard. If the Password never expires property is set for a user account, the User Migration Wizard clears the Password never expires unless you have used the Service Account Migration Wizard first.
    • Many applications, including Exchange Server 5.5, use service account mappings that Active Directory Migration Tool cannot change. These service accounts usually require configuration through registry settings or from within the application itself. You must manually update these accounts after the domain migration is complete.
    • When asked for user account credentials, use credentials with Administrator rights on the specific computer that is using the service accounts.
  2. Migrate workstations and member servers using the Computer Migration Wizard.

    3. More information

    • The Computer Migration Wizard dispatches an agent to each computer being migrated. The agent restarts each computer after the computer joins the target domain. Verify that the default startup menu option on the migrated computers is the migrated Windows 2000 installation.
    • On the Translate Objects wizard page, ensure that no options are selected. Security translation during computer migration works only for accounts from the migrated computer's domain. If the access control lists (ACLs) contain security IDs (SIDs) from another domain, they will need to be translated later with the Security Translation Wizard.
  3. Migrate service accounts using the User Migration Wizard.

    4. More information

    • Service accounts are user accounts used to run services on servers with a set of credentials other than local system authority. These accounts may exist both in a master account domain and in the same resource domain as the server. If the service account is in an account domain, this procedure would be completed by selecting the account domain as the source domain.
    • Active Directory Migration Tool cannot determine if a particular user account is used by one or more services. If any user accounts in the source domain are used to allow services to log on, you must run the Service Account Migration Wizard and select any servers that are running service accounts. Then, the Active Directory Migration Tool can build a list of the service accounts to be migrated before you run the User Migration Wizard. If the Password never expires property is set for a user account, the User Migration Wizard clears the Password never expires unless you have used the Service Account Migration Wizard first.
  4. Migrate domain local groups using the Group Migration Wizard.

    5. More information

    • On the Group Options wizard page, ensure that Do not rename accounts is the only option selected.
  5. Do one of the following:
    • If you plan to migrate account domains as part of the same migration process, see Perform an intraforest account domain migration.
    • Manually migrate a domain controller from the resource domain and decommission the domain.
      • .

    6. More information

    • Use the Active Directory Installation Wizard to demote the domain controllers in the resource domain. For more information about the Active Directory Installation Wizard, see Windows 2000 Server Help.
    • When demoting the last domain controller in the source domain, select the This server is the last domain controller in the domain check box on the Remove Active Directory wizard page of the Active Directory Installation Wizard.
    • Once a domain controller has been demoted, it can join the target domain or be promoted to domain controller in the target domain.

Important

  • When performing an intraforest migration, first migrate resource domains, and then migrate account domains.
  • Run the wizards in the order listed for best results.

Notes

  • When running the Service Account Wizard or Computer Migration Wizard, you must be logged on to the source domain as an administrator or member of the Administrators group.
  • When running the User Migration Wizard, Group Migration Wizard, or Security Migration Wizard, you must be logged on to the target domain as an administrator or member of the Administrators group.
  • When migrating a user, group, or computer account that exists in both the source and target domains, if the account in the target domain already has a value for a particular property and the account in the source domain does not have a value for that property, the value of the property in the target domain will be preserved. It will not be overwritten by the null-value of the property in the source domain.
  • When migrating user accounts between Windows 2000 domains, if the user has previously logged on to a particular computer, it is not necessary to migrate the user profile that is associated with the user account on that computer. Because each user account has a GUID that is unique within the forest, when the migrated account logs on to the computer in the new domain, Windows 2000 notices that there is no profile associated with this user account. Using the GUID, it locates the original profile and automatically associates the original profile with the migrated user account.
  • When migrating users and groups between domains in the same forest, Active Directory Migration Tool must communicate with the Relative ID (RID) pool master in the target domain. To improve performance when migrating a large number of users or groups, you should install Active Directory Migration Tool on the RID pool master in the target domain. By default, this is the first domain controller installed in the domain. Use Active Directory Users and Computers or Ntdsutil.exe to locate the domain controller that holds the RID pool master role.
  • During the migration process, this tool truncates service account names that are more than 20 characters long.

Related Topics


Perform an intraforest account domain migration

To perform an intraforest account domain migration

  1. Migrate domain global groups using the Group Migration Wizard.

    2. More information

    • In an intraforest migration, when global groups are migrated from a native mode source domain, the groups are migrated over correctly, but are created as universal groups in the target domain so that they can contain members from the source domain that have not been migrated yet.
    • If you are migrating a distribution group (these only exist in Windows 2000) from the source domain to the target domain and the group exists in the target domain as a security group, the target group will remain a security group even if the Replace option is selected.
  2. Migrate users and roaming profiles using the User Migration Wizard.

    3. More information

    • On the User Options wizard page, select the Translate roaming profiles and Update user rights check boxes.
    • Active Directory Migration Tool only migrates user rights in additive mode. That is, the user rights of existing users and groups in the target domain will not be removed during a migration operation.
    • If there is a large number of user accounts in the domain, when the User Migration Wizard builds the list of user accounts in a domain, retrieving this information can take a significant amount of time and may cause a significant impact on your network traffic.
    • The user principal name suffix attribute of migrated user accounts is left empty by default but an implicit user principal name suffix of the current domain exists by default for each domain. For example, if the target domain is microsoft.com, the implicit user principal name for users migrated to that domain is UserName@microsoft.com.
    • As part of the migration process, Active Directory Migration Tool determines to which global groups the user account in the source domain belongs. The tool then checks its migrated objects table to see if any of those global groups have previously been migrated. If a match is found, that means that the group was previously migrated from the source domain, and the user is added to this group.
  3. Migrate local profiles on workstations using the Security Translation Wizard.

    4. More information

    • On the Translate Objects wizard page, select the User Profiles check box.
    • On the Security Translation Options wizard page, select the Add check box.
  4. Manually migrate a domain controller from the account domain and decommission the domain.

    5. More information

    • Use the Active Directory Installation Wizard to demote the domain controllers in the resource domain. For more information about the Active Directory Installation Wizard, see Windows 2000 Server Help.
    • When demoting the last domain controller in the source domain, select the This server is the last domain controller in the domain check box on the Remove Active Directory wizard page of the Active Directory Installation Wizard.
    • Once a domain controller has been demoted, it can join the target domain or be promoted to domain controller in the target domain.

Important

  • When performing an intraforest migration, first migrate resource domains, and then migrate account domains.
  • Run the wizards in the order listed for best results.

Notes

  • When running the User Migration Wizard, Group Migration Wizard, or Security Migration Wizard, you must be logged on to the target domain as an administrator or member of the Administrators group.
  • When migrating a user, group, or computer account that exists in both the source and target domains, if the account in the target domain already has a value for a particular property and the account in the source domain does not have a value for that property, the value of the property in the target domain will be preserved. It will not be overwritten by the null-value of the property in the source domain.
  • When migrating users and groups between domains in the same forest, Active Directory Migration Tool must communicate with the Relative ID (RID) pool master in the target domain. To improve performance when migrating a large number of users or groups, you should install Active Directory Migration Tool on the RID pool master in the target domain. By default, this is the first domain controller installed in the domain. Use Active Directory Users and Computers or Ntdsutil.exe to locate the domain controller that holds the RID pool master role.
  • During the migration process, this tool truncates user account names that are more than 20 characters long.

Related Topics


Create the TcpipClientSupport registry entry

To create the TcpipClientSupport registry entry

  1. While logged on to the primary domain controller (PDC) or the PDC emulator in the source domain, click Start, click Run, type regedt32, and then click OK.

    2. Caution

    • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer. You can also use the Last Known Good Configuration startup option if you encounter problems after manual changes have been applied.
  2. In Registry Editor, navigate to the following registry key:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA

  3. On the Edit menu, click Add Value.
  4. In Value Name, type TcpipClientSupport, in Data Type, click REG_DWORD, and then click OK.
  5. In Data, type 1 (the number one), in Radix, click Hex, and then click OK.
  6. Close Registry Editor, and restart the computer.

Note

  • You must be logged on as an administrator or a member of the Aministrators group in order to complete this procedure.


Enable auditing on a Windows 2000 domain

To enable auditing on a Windows 2000 domain

  1. On a computer with administrative access to the Windows 2000 domain, click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
  2. In the console tree, right-click Domain Controllers, and then click Properties.
  3. On the Group Policy tab , click Default Domain Controller Policy, and then click Edit.
  4. In the Group Policy console tree, double-click Audit policies.

    Where?

    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Local Policies
    • Audit policies
  5. Right-click Audit account management, and then click Security.
  6. Select the Success and Failure check boxes, and then click OK.
  7. Using Active Directory Sites and Services, replicate the changed Group Policy object to all domain controllers in the domain or wait for the normal replication cycle.

Notes

  • You must be logged on as an administrator or a member of the Aministrators group in order to complete this procedure.
  • To apply the new Group Policy on every domain controller in the domain, run the Secedit tool with the /refreshpolicy machine_policy command line option on each domain controller.
  • For information about forcing replication, see Windows 2000 Server Help.


Enable auditing on a Windows NT domain

To enable auditing on a Windows NT domain

  1. On a computer with administrative access to the Windows domain, click Start, point to Programs, point to Administrative Tools, and then click User Manager for Domains.
  2. On the Policies menu, click Audit.
  3. Click Audit These Events, and then next to User and Group Management, select the Success and Failure check boxes.

Note

  • You must be logged on as an administrator or a member of the Administrators group in order to complete this procedure.


Change domain mode of the target domain

To change domain mode of the target domain

  1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Domains and Trusts.
  2. In the console tree, right-click the name of the domain you want to administer, and then click Properties.
  3. On the General tab, click Change Mode, and then click Yes.

Caution

  • Do not change domain mode if you have or will have any Windows NT 4.0 domain controllers in this domain. You can only change the mode from mixed mode to native mode. Once a domain is running in native mode, it cannot be changed back to mixed mode.

Note

  • You must be connected to the domain you want to administer and logged on as an administrator or a member of the Domain Administrators group of the target domain in order to complete this procedure.


Generate reports

To generate reports

  1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Migration Tool.
  2. In the console tree, right-click Active Directory Migration Tool, and then click Reporting Wizard.
  3. Follow the instructions until you have finished generating the desired reports.

Note

  • For more information about an option, click the Help button.


Update Exchange after migrating users

To update Exchange after migrating users

  1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Migration Tool.
  2. In the console tree, right-click Active Directory Migration Tool, and then click Exchange Directory Migration Wizard.
  3. Follow the instructions until you have finished resolving the related Exchange directory migration issues.

Note

  • For more information about an option, click the Help button.

Related Topics


Retry a task involving an agent

To retry a task involving an agent

  1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Migration Tool.
  2. In the console tree, right-click Active Directory Migration Tool, and then click Retry Task Wizard.
  3. Follow the instructions until you have finished retrying tasks involving agents.

Note

  • For more information about an option, click the Help button.


Undo the last operation

To undo the last operation

  1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Migration Tool.
  2. In the console tree, right-click Active Directory Migration Tool, and then click Undo Wizard.
  3. Follow the instructions until you have finished undoing the last operation.

Note

  • Only user migration, group migration, and computer migration can be undone.


Concepts

This section provides general background information about migrating objects between domains.

  • Active Directory Migration Tool overview
  • Understanding Active Directory Migration Tool
  • Using Active Directory Migration Tool
  • Wizard Page Descriptions
  • Resources


Active Directory Migration Tool overview

Use Active Directory Migration Tool to migrate user accounts, groups, and computer accounts:

  • From Windows NT 4.0 and earlier domains to Windows 2000 domains (interforest).
  • Between Windows 2000 domains in different forests (interforest).
  • Between Windows 2000 domains in the same forest (intraforest).

Domain migration is achieved by upgrading a Windows NT domain structure to Windows 2000 or as part of a Windows 2000 domain restructure. Active Directory Migration Tool is used to migrate existing Windows NT 4.0 and earlier domains into Windows 2000. It can also be used to consolidate one or more Windows 2000 domains into a single domain.

With a domain restructure you can redesign your existing domain structure to better meet the needs of your organization. Though restructure can result in any number of different outcomes, typically the result is a change in the logical relationship between your domains, and often fewer domains.

The recommended way to redesign your domain structure is to design and build a new Windows 2000 forest separate from your existing domain structure and then, using Active Directory Migration Tool, migrate user accounts, groups, and computer accounts, in stages, from your production environment to the new Windows 2000 forest. Eventually, you will decommission the old domain structure.

Domain upgrade, or in-place upgrade, involves upgrading each domain's primary domain controller to Windows 2000 and eventually upgrading all of the backup domain controllers to Windows 2000. Using this method, you can upgrade all of your Windows NT domains directly into a new Windows 2000 forest. A domain upgrade retains your current domain structure and no migration takes place. Active Directory Migration Tool does not support this process. However, after upgrading all Windows NT domains, you could redesign your upgraded domain structure by creating a new Windows 2000 forest and using Active Directory Migration Tool to migrate the upgraded domains into the new forest. For more information about domain upgrade, see Windows 2000 Server Help.

When migrating objects from computers in a source domain to a target domain, Active Directory Migration Tool installs services, called agents, on the source computers. These agents are dispatched from the computer on which Active Directory Migration Tool is running and are installed on other computers using the security credentials of the user account used to run Active Directory Migration Tool. Once installed, the agents run as a service using the local system security credentials. There is no need to load software on the source computers prior to the migration.

For more information on Active Directory Migration Tool, see Understanding Active Directory Migration Tool.


Understanding Active Directory Migration Tool

This section includes:

  • The migration process
  • Interforest migration
  • Intraforest migration
  • Understanding security
  • Security identifier (SID) translation
  • Migrating user accounts and groups
  • Migrating computers
  • Understanding trust relationships


The migration process

Migrating a domain is a complex process that should not be undertaken without proper planning and testing.

Before the migration

Before migrating a domain, you should:

  • Inventory the domains in your network and the trusts between them.
  • Inventory the groups.
  • Inventory the user accounts.
  • Inventory the service accounts.
  • Inventory the computers.
  • Perform a test run.
  • Generate and analyze migration reports.

The Active Directory Migration Tool supplies wizards to simplify parts of the process. You can run many of the wizards without actually making any changes in your network by clicking Test the migration settings and migrate later. You can then review the log files and reports generated by the wizards to identify and fix any potential problems before performing the actual migration.

For more information about what to do before you begin the migration, see Checklist: Before using Active Directory Migration Tool, Before performing an interforest migration, and Before performing an intraforest migration.

The migration

Once you have verified that migration will proceed as desired, use the wizards to migrate groups, users, and computers, and then use the Security Migration Wizard to update the access control lists (ACLs) on the computers. Throughout the migration process you should:

  • Generate migration reports.
  • Analyze the reports.
  • Fix problems as necessary.

Repeat this process of migration, analyzation, and fixing any problems until your migration is complete.

Note

  • During a migration operation, Active Directory Migration Tool establishes a connection with a specific domain controller in the target domain. If the target domain controller goes off the network, the migration operation will fail, even if another domain controller is available in the target domain. Active Directory Migration Tool will not switch target domain controllers while performing a migration operation. Restarting the migration operation will connect to a new domain controller in the target domain and will work normally.

For more information about performing the migration, see To perform an interforest account domain migration, To perform an interforest resource domain migration, To perform an intraforest resource domain migration, and To perform an intraforest account domain migration.

After the migration

The last step in the migration process is to decommission the source domains. When you decommission a domain, that domain ceases to exist.

Note

  • Active Directory Migration Tool cannot change the domain affiliation of Windows NT primary domain controllers (PDCs) and backup domain controllers (BDCs) or Windows 2000 domain controllers. PDCs, BDCs, and Windows 2000 domain controllers must be migrated manually.

To decommission a Windows NT domain, once you have migrated all of the necessary accounts and resources and removed all trusts, you can simply turn off the last remaining domain controller in the domain. Then, you can either reinstall Windows NT 4.0 or install Windows 2000 on that computer and join it to an existing domain. If you install Windows 2000, you can promote that computer to be a domain controller in another domain.

To decommission a Windows 2000 domain, use the Active Directory Installation Wizard (Dcpromo.exe) to demote the last domain controller to a stand-alone server. You can then join that computer to another domain or promote it to be a domain controller in another domain.

For more information about promoting a domain controller and the Active Directory Installation Wizard, see Windows 2000 Server Help. For more information about installing Windows NT, see the product documentation.


Interforest migration

Active Directory Migration Tool can be used to migrate users, groups, and computers between Windows NT domains and Windows 2000 domains. The process of migrating users, groups, and computers is referred to as domain migration.

An interforest migration is any move from a domain outside of a particular forest to a Windows 2000 domain inside that forest. Because Windows NT domains are not part of a forest, migrating users, groups, and computers from a Windows NT domain into a Windows 2000 domain is considered an interforest move.

Interforest migration flowchart

As shown in the illustration, moving security principals or resources from any of the domains on the left of the forest boundary (source domains) into any of the domains on the right (target domains) is an interforest move because the source and target domains are not in the same forest.

Interforest migration flowchart

Most organizations that are currently using Windows NT have account domains and resource domains. As shown in the illustration, the steps to perform an interforest migration include migrating the user and group accounts in the account domains; migrating the service accounts, local profiles, and shared local groups in the resource domains; and then updating the rights of the migrated users. When the migration is complete, the source domains can be decommissioned, and the computers can be moved into the target domain. Essentially the same steps can be used to migrate Windows 2000 domains from one forest into Windows 2000 domains in a different forest.

For information about preparing domains for migration, see Migration requirements and Before performing an interforest migration.

For details about migrating domains between forests, see To perform an interforest account domain migration, To perform an interforest resource domain migration, and the Microsoft Web site (http://www.microsoft.com/).


Intraforest migration

Active Directory Migration Tool can be used to migrate the users, groups, and computers from multiple Windows 2000 domains into one or more Windows 2000 domains. The process of migrating users, groups, and computers is referred to as domain migration.

As shown in the illustration, moving users, groups, and computers from the source domain to the target domain is an intraforest move because both domains are in the same Windows 2000 forest.

Intraforest migration flowchart

Migrating multiple Windows 2000 domains into a single Windows 2000 domain allows administrators to consolidate the number of domains, simplify the user and group administration, and simplify Group Policy administration.

Intraforest migration flowchart

As shown in the illustration, the steps to perform an intraforest migration include migrating the service accounts, local groups, and computers in the resource domains and then migrating the global groups, users, and roaming profiles in the account domains. When the migration is complete, the source domains can be decommissioned, and the computers can be moved into the target domain.

For information about preparing domains for migration, see Migration requirements and Before performing an intraforest migration.

For details about migrating domains within the same forest, see To perform an intraforest resource domain migration, To perform an intraforest account domain migration, and the Microsoft Web site (http://www.microsoft.com/).


Understanding security

In Windows NT and Windows 2000, all security principals (user accounts, groups, and computer accounts) are represented by unique security identifiers (SIDs). For normal security principals, part of each SID identifies the domain to which the security principal belongs. The SID is independent of the security principal name and is used by Windows NT and Windows 2000 to identify the individual security principals and to control access to resources.

Access to network resources (printers, files, folders, and shares) in Windows NT and Windows 2000 is protected by access control lists (ACLs) that list individual SIDs and the rights and permissions that each has been granted.

Accessing resources

When users successfully log on to a Windows NT and Windows 2000 network, they are assigned an access token that lists their primary SID and also lists the SIDs of all of the groups to which they belong. When a particular user tries to access a resource, the security system compares the SID in the access token and the access sought, with the SID in the ACL and the access granted or denied, then grants the appropriate rights. For example, if the user requests read rights and the ACL can grant the user both read and write rights, the system will only grant the user read rights.

Migrating security principals

When you migrate a security principal from domain A to domain B, a new security principal is created (or cloned) in domain B. SIDs contain a component that specifies the domain to which the security principal belongs, so this new security principal has the same name as the original security principal, but it has a different SID.

The new security principal is not a member of the same groups and its SID does not appear in the security descriptors of the various resources, so the new security principal does not have the same rights and permissions as the original.

In order for these new security principals to keep their existing access to resources, a SID History is created. This SID History contains SIDs previously associated with the original security principal. When the user logs on to the system, the system retrieves the SID History entries and adds them to the user's access token. The access token then contains the SID of the new security principal and the SIDs associated with the original security principal. This provides the new security principal the same access to resources as the original.


Security identifier (SID) translation

Access to network resources (printers, files, folders, and shares) is protected by access control lists (ACLs) contained in security descriptors associated with each resource. Active Directory Migration Tool can change security descriptors that reference a user account or a group in a source domain to reference another user account or group in a target domain.

For example, when you migrate a user account or group from domain A to domain B, a new account is created (cloned) in domain B. This new account can have the same name as the original account in domain A, but this new account has a different security identifier. Active Directory Migration Tool changes the security descriptors for various resources to refer to the SID for the new account in domain B. This process ensures the new user account or group provides the same access to resources that the original user account or group provided. The process of changing the security descriptors is called security translation, which is performed by the Security Translation Wizard.

Note

  • If Active Directory Migration Tool finds a SID from the source domain that it cannot resolve, such as a SID for a user account that does not have a matching user account in the target domain, the tool leaves the SID unchanged.

The security on resources does not need to be translated before the source account is deleted. However, for cosmetic reasons, you will most likely want to translate security before deleting the source account. Once the source account is gone, the resource will no longer be able to resolve the SID to a name and the security properties will show as "account unknown". The access will still work, but you can't resolve the SID name. If you upgrade the resource domain to Windows 2000, Windows 2000 will be able to detect the SID History and resolve the name properly. So, over time, you will want to manually clean up SID History and grant access to the new security principals.

Windows 2000 only recognizes the first 30 entries in registry key access control lists. If security translation is performed in Add mode, then more than 30 entries can exist at the end of the process. The large number of access control entries on certain registry keys might result in users being locked out of the affected system.

To prevent this problem, if the wizard encounters an access control list with more than 15 access control entries while running in Add mode, then the registry keys will be skipped by the system registry security translation process. This will not occur if the security translation is run in Replace or Remove mode. It is also not a problem if you have not manually changed any registry key access control list entries on the affected systems.

Exchange directory translation

Active Directory Migration Tool can also change the security descriptors for Exchange mailboxes, distribution lists, custom recipients, organizations, sites, and containers, as well as the primary Windows NT or Windows 2000 account for each mailbox to reflect the SID for the new security principal in the target domain. This process ensures that the new security principal has the same access to resources and Exchange components as the original.

To translate Exchange security, you must install Microsoft Exchange Administrator on a computer running Active Directory Migration Tool. If you want to translate Exchange security for Exchange mailboxes, distribution lists, custom recipients, organizations, sites, and containers, the account credentials you specify during the translation process must be a Permissions Admin in the Exchange site of the specified Exchange server.

For more information about security descriptors, SIDs, and general security issues, see Understanding security.


Migrating user accounts and groups

Use Active Directory Migration Tool to migrate user accounts and groups from a source domain to a target domain. While migrating, the users can retain access to resources. Once all of the users, groups, computers, and resources have been migrated, the source domain can be decommissioned. Before performing the migration, you can test the process without actually migrating the accounts by clicking Test the migration settings and migrate later in the wizards.

User accounts

Because objects must exist in the target domain before their properties are referenced, Active Directory Migration Tool migrates all the account objects to the target domain before it migrates their properties. For example, Peter is the manager of Robert. Before Peter's account object can be referenced by the Manager property of Robert's user account, both Peter's and Robert's account objects must exist. So, when migrating user accounts, first Peter's and Robert's user accounts are migrated to the target domain, then the properties of each account are migrated.

When migrating accounts, you must migrate the security IDs (SIDs) to the target domain. This will update the SID History of the accounts. If you migrate accounts and do not update SID History for those accounts, the new accounts do not have the access that the original accounts had until you translate security and the Exchange directory.

Service accounts

Service accounts are user accounts that are used to run services with a set of credentials other than local system authority. This is usually done because even though the local system authority security context has absolute rights on the computer on which it operates, it has no rights on any other computers on the network. Many applications, for example Microsoft Exchange, use service accounts to run services with the same set of credentials on several networked computers.

Groups

Global groups can only have users from their own domain as members. So, when you migrate user accounts from one domain to another, the new accounts created by Active Directory Migration Tool in the target domain cannot be members of the global groups in the source domain. When you migrate global groups, group affiliation will be restored; however, if you migrate users before migrating global groups, it may be possible for the users to log on to the target domain using the migrated accounts, but the migrated user accounts will not have any group affiliation. Therefore, to ensure a smooth migration, you should migrate global groups before migrating users.

Migrating global groups before migrating users accounts creates a corresponding global group in the target domain for each global group that exist in the source domain. The newly created global group in the target domain receives a new primary SID that contains the domain identifier of the target domain as part of the SID. The primary SID of the global group in the source domain is added to the SID History attribute of the newly created group.

Local groups can contain members defined in other domains. Therefore, processing local groups can be a bit more complicated than processing global groups and user accounts. When adding a local group member in the target domain, Active Directory Migration Tool processes the group members in the following order:

  1. If the source member is also being migrated, Active Directory Migration Tool adds the copied account to the local group in the target domain.
  2. If the source member is known in the target domain, it is added by its security identifier. To be known by the target domain, the user account or group must be defined in a domain trusted by both the source and target domains.
  3. If the source member name exists in the target domain, this name is resolved to the target domain security identifier.
  4. If the source member name does not exist in the target domain, domains trusted by the target domain are searched for the name and the name is then resolved to its security identifier. If this search fails, Active Directory Migration Tool does not add the member.

Shared local groups are sometimes used on domain controllers to organize access rights. If shared local groups are used, you should migrate all shared local groups to the target domain using the Group Migration Wizard and then upgrade the domain controllers to Windows 2000 and move them to the target domain.

Before migrating groups, you can use the Group Mapping and Merging Wizard to map a group in the source domain to a different group in the target domain. Mapping one group to another essentially moves the membership of a group in the source domain into a new or different group in the target domain. You can also merge the memberships of multiple groups into a new or different group in the target domain. Merging multiple groups into one group combines the memberships of several groups in the source domain into one group in the target domain.

Notes

  • If you have mapped a group to a different group in the target domain, and then you migrate that group from the source domain to the target domain, the mapping information is replaced. The group is then mapped to the migrated group in the target domain.
  • In an intraforest migration, when global groups are migrated from a native mode source domain, the groups are migrated over correctly, but are created as universal groups in the target domain so that they can contain members from the source domain that have not been migrated yet.

Copying group memberships

Active Directory Migration Tool also copies local and global group memberships and user rights for migrated user accounts. If you migrate a local group and its members to another domain, Active Directory Migration Tool copies the local group to the target domain. Membership is maintained through SID History. When migrating users who are members of groups in the source domain that also exist in the target domain, the source domain groups are not actually migrated, but the users are made members of the target domain groups.

Local groups can only contain SIDs from other local groups. Global groups can only contain SIDs from other global groups. Universal groups can only contain SIDs from global groups or other universal groups. If Active Directory Migration Tool finds a SID from the source domain that it cannot resolve, such as a SID for a user account that does not have a matching user account in the target domain, Active Directory Migration Tool leaves the SID unchanged and continues searching.

For more information about security issues related to domain migration, see the Domain Migration and Restructuring Tools page at the Microsoft Web site (http://www.microsoft.com/). Other references available at the Microsoft Web site include Windows 2000 Server Help and the Resource Kit.


Migrating computers

Use Active Directory Migration Tool to migrate computer accounts from a source domain to a target domain. While migrating, users can retain access to resources on the computers. Once all of the computers and resources have been migrated, the source domain can be decommissioned. Before performing the migration, you can test the process without actually migrating the accounts by clicking Test the migration settings and migrate later in the wizards.

Domain controllers cannot be moved between domains. Windows NT domain controllers must either be upgraded to Windows 2000 and, in the process, joined to the target domain or, you must reinstall Windows NT. Windows 2000 domain controllers can be demoted to member servers, joined to the target domain and promoted to domain controller in that domain. Any domain local groups referenced by security descriptors on the domain controller to be moved must be moved before the server is moved.

Workstations and member servers have their own security account manager (SAM) databases. When they are moved between domains, their SAM database moves with them. Local user and group accounts are not affected when moving a computer.

When migrating computer accounts from Windows NT domains, Active Directory Migration tool will not migrate computer descriptions because the computer description attribute is not stored in the Windows NT domain SAM. The description is stored on the local computer. Active Directory Migration Tool will migrate nonnull computer descriptions from computer accounts in Windows 2000 source domains.


Understanding trust relationships

A trust relationship connects two domains and allows users in the trusted domain to access resources in the trusting domain. Groups can contain members from trusted domains. To migrate groups with member accounts from trusted domains, you must first establish the same trust relationships in the target domain as exist in the source domain. These trusts will allow authentication to continue to operate as it did before the migration.

For example, a resource domain usually trusts an account domain. This is usually a one-way trust. When you migrate users from an account domain into a target Windows 2000 domain, the resource domain temporarily remains outside of the forest. To allow the migrated users access to the resources in the resource domain, you must establish a new one-way trust from the resource domain to the target domain in the Windows 2000 forest. This trust will remain active until the resource domain is migrated into the forest and finally decommissioned.

The Trust Migration Wizard does this by comparing the trust relationships in the source domain to the trust relationships in the target domain. The Trust Migration Wizard mirrors in the target domain any trust relationships that exist in the source domain, but not in the target domain. This wizard does not affect any trusts that exist in the target domain, but not in the source domain.

Migrating an account domain

In a typical account domain and resource domain relationship, as shown in the illustration, the Windows NT resource domains trust the source account domain. Resource domains must also trust the new target account domain. This allows users in the account domain to access resources in the resource domains.

Resource domains trust the source account domain. They must also trust the new target account domain.

Before migrating user accounts from the Windows NT account domain to the Windows 2000 target domain, you must create trusts from each of the resource domains that trust the account domain to the Windows 2000 target domain. This will allow user accounts migrated to the target domain to access resources in the resource domains. Once the new trusts are established, you can clone the global groups and the users from the source account domain to the target domain.

Remove trusts to source domain and decommission the source domain.

As shown in the illustration, once you have migrated the users and global groups to the target domain, you can decommission the Windows NT 4.0 account domains. Because of the trusts created between the resource domains and the Windows 2000 target domain, the newly cloned users in the target domain can continue to access resources in the resource domains.

Migrating a resource domain

For increased manageability, resources can be migrated into organizational units in the target domain.

Resource domains trust the account domain. The target source domain must also trust the account domain.

As shown in the illustration, when migrating a Windows NT 4.0 resource domain, you must create trusts between the target Windows 2000 domain and the account domain trusted by that resource domain. Once the trusts are in place, you can clone the local groups that control access to the various resources, demote the backup domain controllers in the resource domain and, if desired, move them to the new source domain.

Remove trusts to source domain and decommission the source domain.

As shown in the illustration, when all resources have been transferred, you can decommission the original resource domain.


Using Active Directory Migration Tool

This section includes:

  • Migration requirements
  • Before performing an interforest migration
  • Before performing an intraforest migration


Migration requirements

Listed below are the requirements for the objects to be migrated, the computer on which to install Active Directory Migration Tool, and any computer to which an Active Directory Migration Tool agent will be dispatched.

Source objects

Objects to be migrated must meet the following criteria:

  • Source objects must be of one of the following types:
    • User account
    • Security-enabled group including: local group (for Windows NT, only a domain controller's shared local groups can be migrated); domain local group (available only in a Windows 2000 domain operating in native mode); global group.
    • Computer account
  • Source objects cannot be a built-in account (such as local Administrators, Users, and Power Users). Built-in account Security IDs (SIDs) are identical in every domain, so adding them to a SID History would violate the SID-uniqueness requirement of the forest.
  • The SIDs of the source objects must not already exist in the target forest, either as primary account SIDs or in the SID History of an account.

Active Directory Migration Tool

Active Directory Migration Tool should be installed only on Windows 2000 domain controllers in target domains. Using Terminal Server, Active Directory Migration Tool can be run from any computer.

Make sure that the computer on which Active Directory Migration Tool is installed meets the following requirements:

  • Pentium II or later central processing unit (CPU).
  • Enough memory to accommodate the migration process. The minimum amount of available RAM is 10 megabytes (MB), plus 4 kilobytes for each user to be migrated.
  • A hard disk partition with at least 35 MB of free space: 7 MB for Active Directory Migration Tool installation and 25 MB for data and log files.

Active Directory Migration Tool agent

The Active Directory Migration Tool agent can operate on computers running the following operating systems:

  • Windows NT 3.51 with Service Pack 5 (both Intel and Alpha-based computers)
  • Windows NT 4.0 with Service Pack 4 or later (both Intel and Alpha-based computers)
  • Windows 2000

Computers on which the Active Directory Migration Tool agent will operate must meet the following requirements:

  • A hard disk partition with at least 15 MB of free disk space for the agent and agent log files.
  • The ADMIN$ share must exist on computers running Windows 3.51 for the agent to install successfully.
  • Active Directory Migration Tool user must be logged on with a user account that has Administrator or equivalent permissions on the target computer. Note that the built-in Administrators group normally contains the Domain Administrators group from the computer's domain.
  • Remote registry access must be enabled. For information on how to enable or disable remote registry access, see the Microsoft Web site (http://www.microsoft.com/).
  • NetBIOS should be enabled.
  • The (NetBIOS) Server service should be running.
  • The target computer must be a valid member of a valid domain. Note that some computers may have expired passwords, for example, the computer may have been disconnected from the domain for some time and its computer password has expired.


Before performing an interforest migration

This topic lists the domain and security configurations necessary before you can use Active Directory Migration Tool to migrate users, groups, and computers between a Windows NT domain and a Windows 2000 domain or two Windows 2000 domains in different forests.

Source and target domain

Verify that your source and target domains are configured as described in the following list:

  • The target domain is running Windows 2000 and is operating in native mode. This is required because the SID History attribute is only available in domains operating in native mode.
  • The source domain is running either Windows NT 4.0 or Windows 2000. If running Windows NT 4.0, the primary domain controller must have Service Pack 4 or later installed.
  • If the source domain is a Windows 2000 domain, it may operate in either mixed or native mode.
  • The source domain must be in a different forest than the target domain or it must be a Windows NT 4.0 domain.
  • A new local group, SourceDomainName$$$ must be created on the source domain. For example, if your source domain was named DomainA, you should create the local group DomainA$$$. There must be no members in this group. If this group is not present, Active Directory Migration Tool will create this group when needed. If a global group or other kind of group already exists with this name, the tool will not be able to create the new local group.
  • Any mapped network drives and similar connections between the source domain controller and the target domain controller on which Active Directory Migration Tool is running must be disconnected before running the tool. Failure to do so may result in the failure of a migration operation due to a "credentials conflict" error.
  • The primary domain controller (PDC), or PDC emulator, in the source domain must have the following registry value TcpipClientSupport:REG_DWORD:0X1 set for the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa registry entry. If this entry is not present, Active Directory Migration Tool will create this entry when needed. For details, see To create the TcpipClientSupport registry entry.

Security Requirements

You must meet the following security configuration requirements before running Active Directory Migration Tool.

  • The user account you log on with when you run Active Directory Migration Tool must have the following permissions:

    • Domain Admin rights in the target domain
    • Member of the Administrators group in the source domain
    • Administrator rights on each computer you migrate
    • Administrator rights on each computer on which you translate security

    Gaining administrative access to the objects you intend to migrate can be accomplished in one of two ways:

    1. Create a temporary two-way trust between the target domain and the source domain. Creating a two-way trust allows you to run the tool while logged on as the administrator of the source domain, an account that already has administrative rights to the objects you will migrate from the source domain.
    2. Add an account to the local administrators group of every workstation and member server you intend to migrate and use that account to log on while you run the tool. This process can be automated through scripting and the use of Active Directory Service Interfaces (ADSI).
  • Auditing for account management (success and failure events) must be enabled in the source and target domains. In Windows NT, account management is referred to as user and group management. For details, see To enable auditing in a Windows NT domain and To enable auditing in a Windows 2000 domain.
  • Administrative shares must exist on the computer where Active Directory Migration Tool is running and any computer to which an agent must be dispatched.
  • The source domain must trust the target domain to provide the security context necessary for Active Directory Migration Tool.
  • Trusts from existing resource domains to the target account domain to support resource access for migrated users.


Before performing an intraforest migration

This topic lists the domain and security configurations necessary before you can use Active Directory Migration Tool to migrate users, groups, and computers between two Windows 2000 domains in the same forest.

Source and target domain

Verify that your source and target domains are configured as described in the following list:

  • The target domain is running Windows 2000 and is operating in native mode.
  • The source domain is running Windows 2000 is in the same forest as target domain.
  • When migrating users and groups between domains in the same forest, Active Directory Migration Tool must communicate with the Relative ID (RID) pool master in the target domain. To improve performance when migrating a large number of users or groups, you should install Active Directory Migration Tool on the RID pool master in the target domain. By default, this is the first domain controller installed in the domain. Use Active Directory Users and Computers or Ntdsutil.exe to locate the domain controller that holds the RID pool master role.
  • Any mapped network drives and similar connections between the source domain controller and the target domain controller on which Active Directory Migration Tool is running must be disconnected before running the tool. Failure to do so may result in the failure of a migration operation due to a "credentials conflict" error.

Security Requirements

You must meet the following security configuration requirements before running Active Directory Migration Tool.

  • The user account you log on with when you run Active Directory Migration Tool must have the following permissions:

    • Domain Admin rights in the target domain
    • Member of the Administrators group in the source domain
    • Administrator rights on each computer you migrate
    • Administrator rights on each computer on which you translate security

    • Note

    • To migrate users and groups from a child domain to the forest root domain, the user account you log on with when you run Active Directory Migration Tool must have the permissions of the Enterprise Admins group, in addition to the security privileges normally needed to run the tool.
  • Administrative shares must exist on the computer where Active Directory Migration Tool is running and on any computer to which the tool must dispatch an agent.


Wizard Page Descriptions

This section includes descriptions of each wizard page in the Active Directory Migration Tool wizards. The following topics can also be displayed by clicking Help on the various wizard pages.

  • Account Transition Options
  • Computer Options
  • Computer Selection
  • Confirmation
  • Domain Selection
  • Exchange Server
  • Folder Selection
  • Group Member Options
  • Group Options
  • Group Selection
  • Last Migration
  • Naming Conflicts
  • Object Type Selection
  • Organizational Unit Selection
  • Password Options
  • Report Selection
  • Security Translation Credentials
  • Security Translation Options
  • Service Account Information
  • Service Accounts Selection
  • SID History Credentials
  • Target Group Selection
  • Task Selection
  • Test or Make Changes
  • Trust Information
  • Update Information
  • User Account
  • User Options
  • User Selection
  • Welcome screen
  • Agent Monitor page


Account Transition Options

Specifies how Active Directory Migration Tool handles migrated user accounts in both the source and target domains. For example, you can direct this tool to disable the migrated accounts in one or both of the domains. The options are defined as follows:

Disable source accounts

Disables the original user account in the source domain. This option prohibits anyone from using the source domain account to log on to the source domain.

Disable target accounts

Disables the new user account in the target domain. This option prohibits anyone from using the target domain account to log on to the target domain. This option can affect migrated service accounts. Do not select this option when migrating accounts that are used as service accounts for Windows NT or Windows 2000 services.

Leave both accounts open

Leaves the existing account in the source domain and the new account in the target domain active. This option allows someone using the source domain account to log on to the source domain and someone using the target domain account to log on to the target domain.

Days until source account expires

Sets the number of days after which the source account will no longer be available. This setting prohibits anyone from using the source account to log on to the domain after the specified number of days.

Migrate user SIDs to target domain

Adds the security ID (SID) of the migrated account in the source domain to the SID History attribute of the new user account in the target domain. This feature uses a secure connection to the source domain controller. For more information about SID History, see Understanding security.


Computer Options

Specifies how Active Directory Migration Tool handles computers after it migrates the computer accounts to the target domain. The options are defined as follows:

Minutes before computers restart after wizard completion

Specifies how many minutes after the agent is dispatched and after the agent's task is completed that the computer on which the agent was run will be restarted.

Do not rename computers

Tries to name the migrated computer account the same name as the computer account in the source domain. If a naming conflict occurs, the options specified on the Naming Conflicts page control how the migrated computer account is named.

Rename with prefix

Adds the specified prefix to the name of each migrated computer account in the target domain. The original computer account with the same name in the target domain remains unchanged.

Rename with suffix

Adds the specified suffix to the name of each migrated computer account in the target domain. The original computer account with the same name in the target domain remains unchanged.


Computer Selection

Specifies which computers the Active Directory Migration Tool will migrate. To add one or more computers, click Add, and then follow the instructions on the Select Computers page. To remove one or more computers, select the desired computers, and then click Remove.

Note

  • Domain controllers cannot be migrated. To migrate a computer that is operating as a Windows 2000 domain controller, you must first demote that domain controller to a member or stand-alone server. Windows NT domain controllers cannot be migrated. You must either upgrade them to Windows 2000 Server or reinstall Windows NT.


Confirmation

Identifies the task you have chosen to perform using Active Directory Migration Tool. This page summarizes the tasks you selected through the wizard. To use these settings and continue the selected tasks, click Finish. To return to the wizard and change one or more tasks, click Back. To exit the wizard and return to the Active Directory Migration Tool console, click Cancel.


Domain Selection

Specifies the source and target domains for the selected task. The options are defined as follows:

Source domain

Specifies the name of the source domain. When migrating accounts, the source domain indicates the domain from which the account information is migrated. Specify a valid Windows NT or Windows 2000 domain. You may type the domain name or select it from the list.

In the Security Translation Wizard and the Exchange Directory Migration Wizard, type the domain of the service accounts not the domain of the computers on which the service accounts are running.

Target domain

Specifies the name of the target domain. When migrating accounts, the target domain indicates the domain to which the account information is migrated. Specify a valid Windows 2000 native mode domain. You may type the domain name or select it from the list.


Exchange Server

Name

Specifies the Microsoft Exchange server that Active Directory Migration Tool will migrate. Specify the name of the Exchange server, and then click Next.


Folder Selection

Specifies the folder where Active Directory Migration Tool stores the generated reports. You can type the full path to the folder or use Browse to select a folder.


Group Member Options

Specifies how Active Directory Migration Tool handles members of the migrated groups. These options are defined as follows:

Generate complex passwords

Automatically generates a complex password for each migrated user account. Active Directory Migration Tool records the new passwords in the file specified in New password output file.

Set password to user name

Sets the password for each copied user account to the first 14 characters of the user account name. Active Directory Migration Tool records the passwords in the file specified in New password output file.

New password output file

Specifies a file to which the assigned or generated passwords are written. You can type the full path to the file or use Browse to select a folder.

Disable source accounts

Disables the user account in the source domain. This option prohibits anyone from using the source account to log on to the source domain.

Disable target accounts

Disables the user account in the target domain. This option prohibits anyone from using the new target account to log on to the target domain.

Leave both accounts active

Leaves the accounts in both the source and target domains active. When this option is selected, both accounts can be used to log on to either the source or target domains.

Days until source account expires

Sets the number of days after which the source account will no longer be available. This setting prohibits anyone from using the source account to log on to the domain after the specified number of days.

Translate roaming profiles

Copies roaming profiles from the source domain to the target domain for the selected user accounts. This process associates the roaming user profile with the new user account in the target domain.


Group Options

Specifies how Active Directory Migration Tool handles the group migration. These options are defined as follows:

Update user rights

Copies the user rights assigned in the source domain to the target domain.

Copy group members

Copies the members of the groups you selected to migrate. This option allows you to maintain the group membership information in the target domain. This option is not available in the Group Merging and Mapping Wizard.

Update previously migrated objects

Updates the members of the groups you selected to migrate, even if those members were previously migrated. This option is available only if the Copy group members check box is selected. This option is not available in the Group Merging and Mapping Wizard.

Migrate group SIDs to target domain

Adds the security ID (SID) of the migrated user accounts and groups in the source domain to the SID History of the new user accounts and groups in the target domain. This feature uses a secure connection to the source domain controller. For more information about SID History, see Understanding security.

Do not rename accounts

Tries to assign the migrated group the same name as the group in the source domain. If a naming conflict occurs, the options specified on the Naming Conflicts page control how the migrated group is named.

Rename with prefix

Adds the specified prefix to the name of each migrated group in the target domain. The original group with the same name in the target domain remains unchanged.

Rename with suffix

Adds the specified suffix to the name of each migrated group in the target domain. The original group with the same name in the target domain remains unchanged.


Group Selection

Specifies which groups in the source domain the Active Directory Migration Tool will migrate. To add one or more groups, click Add, and then follow the instructions on the Select Groups page. To remove one or more groups, select the desired groups, and then click Remove.


Last Migration

Describes the most recently performed user, group, or computer migration. To undo the migration, review the task description and ensure that the described tasks are those that want to undo, and then click Next.


Naming Conflicts

Specifies how the Active Directory Migration Tool handles accounts in the target domain that have the same name as a copied account in the source domain. The options are defined as follows:

Ignore conflicting accounts and don't migrate

Leaves the account in the target domain unchanged.

Replace conflicting accounts

Changes properties of existing accounts in the target domain to match the properties of the account with the same name in the source domain.

Remove existing user rights

Ensures the account in the target domain does not have more user rights than those granted to the account with the same name in the source domain. This check box is only available when Replace conflicting accounts is selected.

Remove existing members of groups being replaced

Ensures the members of the migrated groups in the target domain are the same as the members of the associated groups in the source domain. This check box is only available when Replace conflicting accounts is selected.

Rename conflicting accounts by adding the following

Adds the specified prefix or suffix to the name of the migrated account in the target domain to avoid the conflict with the other account with the same name in the target domain. The original account with the same name in the target domain remains unchanged.


Object Type Selection

Specifies the types of objects for which you want Active Directory Migration Tool to translate security. Select the object types you want the tool to process.

For more information, see Security identifier (SID) translation.


Organizational Unit Selection

Specifies the target organizational unit in the target domain.

Target OU

Specifies the target container, such as an organizational unit (OU), to which Active Directory Migration Tool will migrate selected user accounts, groups, or computer accounts. Specify a value in the following format:

container=name

Enter the full LDAP distinguished name of the target container. For example, to specify the organizational unit named TargetOU, in the testdomain.microsoft.com domain type:

LDAP://TESTDOMAIN/OU=TargetOU,DC=testdomain,DC=microsoft,DC=com

To select the desired container from the list of available containers, click Browse, and then follow the instructions on the Select Container page.


Password Options

Specifies how Active Directory Migration Tool assigns passwords to migrated user accounts. The options are defined as follows:

Complex passwords

Automatically generates a complex password for each migrated user account. Active Directory Migration Tool records the new passwords in the file specified in Location to store password file.

Same as user name

Sets the password for each copied user account to the first 14 characters of the user account name. Active Directory Migration Tool records the passwords in the file specified in Location to store password file.

Location to store password file

Specifies a file to which the assigned or generated passwords are written. You can type the full path to the file or use Browse to select a folder.


Report Selection

Specifies the reports you want Active Directory Migration Tool to generate. Select the desired report, and then click Next. To select more than one report, hold down CTRL and then click the desired reports.


Security Translation Credentials

Specifies the user account name and password that Active Directory Migration Tool will use to perform the security translation process. The specified user account must have the required access permissions to make the required changes. For example, the specified user account must have the following permissions:

  • Administrator rights in the source domain (member of Domain Admins)
  • Administrator rights in the target domain
  • Administrator rights on each computer you migrate
  • Administrator rights on each computer on which you translate security
  • Administrator rights on any computer to which Active Directory Migration Tool must dispatch an agent

If you want to translate Exchange security for Exchange mailboxes, distribution lists, custom recipients, organizations, sites, and containers, the user account you specify on this page must be a Permissions Admin in the Exchange site of the specified Exchange server. For more information about the permissions required to perform various operations, see Before performing an interforest migration and Before performing an intraforest migration.

The fields are defined as follows:

User account name

Specifies the name of the user account that Active Directory Migration Tool uses to perform the security translation process.

Password

Specifies the password for the user account specified in User account name.

Domain

Specifies the domain in which the user account is defined.


Security Translation Options

Specifies how Active Directory Migration Tool handles the security translation process. These fields are defined as follows:

Replace

Replaces the security ID (SID) for the account in the source domain with the SID for the account in the target domain in the access control lists (ACLs) and system access control lists (SACLs) in the security descriptors of the selected objects. This option gives the account in the target domain the same permissions on the selected objects as the account in the source domain. This option also removes these permissions from the account in the source domain.

When performing an intraforest migration, SID History is migrated and the source object is deleted. So, when performing an intraforest migration, Active Directory Migration Tool only allows security translation in Replace mode.

Add

Adds the SID for the account in the target domain to the ACLs and SACLs in the security descriptors of the selected objects that contain the SID for the account in the source domain. This option gives the account in the target domain the same permissions to the selected objects as the account in the source domain.

Windows 2000 only recognizes the first 30 entries in registry key ACLs. If security translation is performed in Add mode, then more than 30 entries can exist at the end of the process. The large number of access control entries (ACEs) on certain registry keys might result in users being locked out of the affected system.

To prevent this problem, if the wizard encounters an ACL with more than 15 ACEs while running in Add mode, then the registry keys will be skipped by the system registry security translation process. This will not occur if the security translation is run in Replace or Remove mode. This is not a problem is the customer has not manually changed any registry key ACEs on the affected systems.

Remove

Removes the SID for the account in the source domain from the ACLs and SACLs in the security descriptors of the selected objects. This option removes the permissions to the selected objects from the account in the source domain.

For more information, see Security identifier (SID) translation.


Service Account Information

Displays the service account information you have collected. You can also select which Service Control Manager entries you want to automatically update when the service account is migrated.

If the tool was unable to update a service that uses a migrated service account, this page displays the Update Failed status for that service. When that service is available, you can select the service, and then click Retry Now to update the Service Control Manager entry.


Service Accounts Selection

Specifies the computers from which Active Directory Migration Tool will service accounts. To add one or more computers, click Add, and then follow the instructions on the Select Computers page. To remove one or more computers, select the desired computers, and then click Remove.


SID History Credentials

Specifies the user account name and password that Active Directory Migration Tool uses to update the SID History for migrated accounts in the target domain. The specified user account must have Administrator rights in the source and target domains.

The fields are defined as follows:

User account name

Specifies the name of the user account that Active Directory Migration Tool uses to update the SID History for migrated accounts.

Password

Specifies the password for the user account specified in User account name.

Domain

Specifies the domain in which the user account is defined.


Target Group Selection

Specifies the target group that will contain all the members of the selected source group or groups. Specify the name of the desired target group, and then click Next. You can type the group name or use Browse to select a group. If the group does not exist, Active Directory Migration Tool will create it.


Task Selection

Specifies a task for Active Directory Migration Tool to try to perform again. You can also cancel tasks by selecting the task, and then clicking Cancel.


Test or Make Changes

Specifies whether you want to test migration settings or actually perform a migration. Click Test the migration settings and migrate later to run the wizard in test mode, or click Migrate now to perform a migration.


Trust Information

Displays information about the trusts for the source and target domains. Options available in the Trust Migration Wizard ensure that the target domain has all the trusts that the source domain has.

To copy a trust for the target domain, select the desired trust, and then click Copy Trust. Active Directory Migration Tool prompts you for a user account and password that has administrative rights in the trusted domain. Specify the user account and password, and then click OK.

When you have finished selecting all the trusts you want to copy, click Next.


Update Information

Provides the option to refresh the current service account information. The options are defined as follows:

Yes, update the information

Collects the service account information to use during the migration process.

No, use the previously collected information

Uses the service account information previously collected and stored in the database.


User Account

Specifies the user account name and password that the Active Directory Migration Tool uses to collect information for the reports. The specified user account must have the necessary access permissions to collect the required information. The fields are defined as follows:

User name

Specifies the name of the user account the Active Directory Migration Tool uses to collect the information for the reports.

Password

Specifies the password for the user account specified in User account name.

Domain

Specifies the domain in which the user account is defined.


User Options

Specifies how Active Directory Migration Tool handles the user account migration. These options are defined as follows:

Translate roaming profiles

Copies roaming profiles from the source domain to the target domain for the selected user accounts. This process associates the roaming user profile with the new user account in the target domain.

Update user rights

Sets the user rights assigned to the new user account in the target domain to match the user rights assigned to the migrated user account in the source domain.

Migrate associated user groups

Migrates the groups of which the migrated user accounts are members. This option allows you to maintain the group membership information in the target domain.

Update previously migrated objects

Updates the groups of which the migrated user accounts are members, even if those groups were previously migrated. This option is available only if the Migrate associated user groups check box is selected.

Do not rename accounts

Tries to assign the migrated account the same name as the account in the source domain. If a naming conflict occurs, the options specified on the Naming Conflicts page control how the migrated account is named.

Rename with prefix

Adds the specified prefix to the name of each migrated account in the target domain. The original account with the same name in the target domain remains unchanged.

Rename with suffix

Adds the specified suffix to the name of each migrated account in the target domain. The original account with the same name in the target domain remains unchanged.


User Selection

Specifies which user accounts in the source domain Active Directory Migration Tool will migrate. To add one or more user accounts, click Add, and then follow the instructions on the Select Users page. To remove one or more user accounts, select the desired user accounts, and then click Remove.


Welcome screen

Identifies the wizard you have selected and the task you have chosen to perform using Active Directory Migration Tool. To continue the selected task, click Next. To exit the wizard and return to the MMC console, click Cancel.


Agent Monitor page

This section includes information about the following Agent Monitor tabs:

  • Monitoring Settings Tab
  • Servers Tab
  • Summary Tab


Monitoring Settings tab

These options are defined as follows:

Dispatch log

Specifies the location of the log file in which the agent records its actions. This option is only available after selecting Stop Monitoring.

Refresh interval

Specifies the amount of time, in seconds, the agent waits before sending the latest status information. This option is only available after selecting Stop Monitoring.

Start Monitoring

Enables agent monitoring.

Stop Monitoring

Disables agent monitoring and makes the Dispatch log and Refresh interval options available.


Servers tab

Lists the computers you have selected. The dispatcher attempts to install and run the agents on each computer. This page also lists the status of the agent on each computer.

View Dispatch Log

Displays the dispatch log file which details the progress of each agent dispatched.


Summary tab

Displays the summary of the agents dispatched to the selected computers. The status options are defined as follows:

Computers started

Specifies the computers on which the agent has been successfully started.

Computers finished

Specifies the computers on which the agent has finished the specified actions.

Computers installed

Specifies the number of computers on which the agent has been successfully installed.

Computers running

Specifies the number of computers on which the agent is running.

Computers finished

Specifies the number of computers on which the agent has finished the specified actions.

Computers failed

Specifies the number of computers on which the agent was not able to be installed and run.

The following information provides a summary of the agent actions. The rows and columns are defined as follows:

Rows

Files

Specifies the number of files processed by the agent.

Directories

Specifies the number of directories processed by the agent.

Shares

Specifies the number of shares processed by the agent.

Group members

Specifies the number of members in local groups processed by the agent.

User rights

Specifies the number of entries for user rights processed by the agent.

Columns

Examined

Specifies the number of security descriptors that the agent searched for SIDs that match the SIDs of the selected accounts.

Changed

Specifies the number of security descriptors that the agent changed.

Unchanged

Specifies the number of security descriptors that the agent did not change.


Resources

This section includes:

  • Additional help on the Internet
  • Glossary


Additional help on the Internet

This topic lists some of the resources available on the Internet.

Microsoft Domain Migration and Restructuring

The Microsoft Domain Migration and Restructuring tools Web site contains up-to-date information and scenarios describing the various tools and methods used to migrate Windows NT networks to Windows 2000 networks and to restructure existing Windows 2000 networks.

For more information, or to download the most recent version of Active Directory Migration Tool, see the Microsoft Web site. (http://www.microsoft.com/)

Microsoft Personal Online Support

The Microsoft Personal Online Support Web site contains an extensive collection of articles, troubleshooting wizards, items you can download, and other useful product information, such as frequently asked questions (FAQs) and information from newsgroups.

For more information, or to begin your search, see the Microsoft Web site (http://www.microsoft.com/).

TechNet

TechNet is a service that contains resources for information technology (IT) professionals. This includes access to articles written by support professionals at Microsoft, career and industry information, discussion groups, technical feedback, and software. For more information about TechNet, see the Microsoft Web site (http://www.microsoft.com/).


Glossary Navigator

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

Glossary

- A -

account domain

agent

- B -

no entries

- C -

no entries

- D -

dispatcher

domain collapse

domain consolidation

domain migration

domain restructure

domain upgrade

- E -

no entries

- F -

forest

- G -

no entries

- H -

no entries

- I -

intraforest migration

interforest migration

- J -

no entries

- K -

no entries

- L -

local group, shared

- M -

member account

mixed mode

- N -

native mode

- O -

no entries

- P -

no entries

- Q -

no entries

- R -

resource domain

- S -

security descriptor

security ID (SID)

security principal

shared local group

SID (Security ID)

SID History

source domain

source object

- T -

target domain

target object

- U -

no entries

- V -

no entries

- W -

no entries

- X -

no entries

- Y -

no entries

- Z -

no entries


Troubleshooting

What problem are you having?

I am receiving an error message that Active Directory Migration Tool could not verify auditing and TcpipClientSupport on domains.

Cause: All necessary configuration changes have not been made.

Solution: Properly configure your migration environment and try the operation again.

See also: Checklist: Before using Active Directory Migration Tool, Migration requirements, Before performing an interforest migration, and Before performing an intraforest migration

Active Directory Migration Tool agents either fail to install or will not run on a remote computer.

Cause: The agent is dispatched with invalid credentials or the migration environment is not configured correctly.

Solution: An agent is dispatched to a remote computer using the credentials of the account used to run Active Directory Migration Tool. Once installed on the remote computer, the agent runs under the local system account. The credentials that you provide to the wizard before the agent is dispatched to the remote computer are used to write results back to a share created on the computer on which Active Directory Migration Tool is running. The agent must have the right to log on locally to the remote computer, and, if the agent is used to migrate computers, it must have Administrative rights in the source domain.

To ensure that you have the correct credentials, create trusts such that the source domain trusts the target domain and the target domain trusts the source domain. Add the Domain Admins group of the target domain (target\Domain Admins) to the built-in Administrators group of the source domain (source\Administrators). Log on using the target\Domain Admins account and supply a set of credentials for the source\Administrators account when prompted. This will provide you with administrative permissions on both the source and target domains.

See also: Migration requirements

Agent dispatch operations are failing with credentials conflict errors.

Cause: You have an active connection, such as a mapped drive or a printer, to a computer on which an agent is being installed. The dispatch operation will fail because the credentials of the agent installation conflict with the existing set of credentials.

Solution: Remove any active connections between the computer that is running Active Directory Migration Tool and the computer to which the agent is being dispatched.

I am receiving the following error: "Cannot connect to agent."

Cause: The agent monitor tried to connect to the agent while the agent was still initializing.

Solution: Click Refresh one or more times to update the the Agent Monitor.

When I try to view the results of a remote agent operation, I receive the following error: "Cannot open the \\ComputerName\(%SystemRoot%)$\temp\dctlog.txt file."

Cause: The default administrative share for the system volume of the computer to which the agent was dispatched is not enabled.

Because the default share is not enabled, the Active Directory Migration Tool cannot read the log file.

Solution: Reenable the default share of the system volume.

I am receiving the following error (W10431): "The Program Files folder name on \\ComputerName is in an unrecognized format "\ADMIN$"

Cause: By default, the Active Directory Migration Tool agent is installed to the folder specified by the %ProgramFiles% environment variable on the target computer. Since this environment variable does not exist by default on Windows NT 3.51 computers, the agent is installed to the %SystemRoot% folder instead.

Solution: This is a warning message. No action is necessary.

Active Directory Migration Tool was not able to change the domain affiliation of a particular computer. This failure caused the computer to lose affiliation with any domain.

Cause: This can be caused by an incorrect migration environment configuration or some malfunction with either the source or target computers.

Solution: Join the computer to a domain and create the computer account in the domain as described in the following procedures:

To change the domain membership of a computer running Windows NT 4.0 or earlier

  1. Log on to the computer using an account with local administrator permissions.
  2. Open the Control Panel, and then double-click Network.
  3. Click Change, and then, in Domain Name, type the name of the domain you want this computer to join.

To change the domain membership of a computer running Windows 2000

  1. Log on to the computer using an account with local administrator permissions.
  2. On the Desktop, right-click My Computer, and then click Properties.
  3. On the Network Identification tab, click Properties, and then click Domain.
  4. In Domain, type the name of the domain you want this computer to join.

Notes

  • To join a domain, you must enter credentials of an account with administrative permissions on the domain you want the computer to join.
  • You must restart the computer to complete joining the computer to the domain.

The Remove existing user rights option did not work.

Cause: If the Group Policy template associated with a user whose user rights are being removed contains the nondomain-qualified name of the user (for example, if it contains User1 instead of DomainA\User1), then the remove operation will fail.

Solution: Correct the user name entry in the Group Policy template.

I cannot find the Active Directory Migration Tool log files.

Solution: Active Directory Migration Tool creates several log files in the Logs folder under the Active Directory Migration Tools folder on the computer on which the tool is installed. User and group migration progress is recorded in Migration.log; dispatcher progress is recorded in Dispatcher.log; and the progress of the Trust Migration Wizard is recorded in Trust.log. Additionally, the progress of each agent is recorded in log files named for the computer to which the agents are dispatched. These log files are located in the Agents folder under the previously mentioned Logs folder. Each agent also records information a Dctlog.txt file which is created in the folder specified by the %TEMP% variable on each computer to which an agent is dispatched.

I cannot read the event log entries for the Active Directory Migration Tool agent.

Cause: You are not on a computer on which Active Directory Migration Tool has been installed.

Solution: The agent may write log entries to the computer on which it runs. Since the agent software is removed when the agent's task is finished, you can view the event log entries on the computer to which the agent was dispatched by running the Windows 2000 Event Viewer from the computer on which Active Directory Migration Tool is installed.

I need more information from the Active Directory Migration Tool logs.

Cause: Incorrect logging level setting.

By default, Active Directory Migration Tools writes summary information to its log files. The level of detail can be increased by changing the registry entry that controls the logging level.

Solution: On the computer on which Active Directory Migration Tool is installed, set the value of the HKEY_LOCAL_MACHINE\Software\Mission Critical Software\DomainAdmin\TranslationLogLevel registry key to 7.

Verbose logging mode is used for problem diagnosis and troubleshooting. The verbose logging mode can create very large log files, particularly in cases where large numbers of files, or other objects whose access control lists must be updated, exist on the target computer. Since the agent logs are written to the folder specified by the %TEMP% environment variable, the volume to which that environment variable points should have ample disk space. When logging in verbose mode, it may be necessary to change the value of the %TEMP% environment variable before dispatching an agent.

Generated reports do not show up in Active Directory Migration Tool.

Cause: When the tool generates reports, it does not automatically update the console.

Solution: To view the reports, close and reopen Active Directory Migration Tool.

When generating reports, I receive IDispatch error 3107.

Cause: This error may occur when the Agent Monitor is closed before all agents have finished writing their results back to the Active Directory Migration Tool reporting database.

Solution: To prevent this problem, wait until all agents have completed their tasks before closing the Agent Monitor.

After an interforest migration, users cannot log on to their new domain.

Cause: When performing an interforest migration, Active Directory Migration Tool always sets the User Must Change Password option for migrated users. If the user account has the User Cannot Change Password option set, then the target account won't be able to log on until one or both options have been changed.

Solution: Change the options using one of the following methods:

To enable the ability to change the user password

  1. In Active Directory Users and Computers, on the View menu, click Advanced Features.
  2. Right-click the user, and then click Properties.
  3. On the Security tab, allow the Change Password permission for Everyone and for the user.

To remove the User Must Change Password flag

  • In Active Directory Users and Computers, right-click the user, and then click Reset Password.

After an intraforest migration, users cannot log on to their new domain.

Cause: The user account passwords used in the old domain may violate the password restrictions in the new domain.

In an intraforest migration, user account passwords from the source domain are migrated to the target domain. If the source domain user accounts have passwords that violate the password restrictions (such as minimum length) in the target, then the affected migrated users will be unable to log on until their password has been set to a value that fits the target domain password policy.

If the users try to use the invalid passwords, their new user accounts may be locked. If you selected Close target accounts in the Migrate Users Wizard, the new user accounts will be disabled. As a result, the migrated users may not be able to log on until their accounts have been unlocked or marked as enabled.

Solution: Reset the user account passwords to a value that fits the new domain's password policy, and enable the user accounts if they were disabled due to repeated password failure.

Migrated users receive an error indicating that their user name or password is incorrect.

Cause: Migrated users cannot log on due to password policy, even though password policies appear to be disabled.

During a migration, some administrators may choose to disable their password policies on the target domain. If they try to accomplish this by turning off the minimum password length policy without setting the password policy to zero, it is possible that the users will not be able to log on because an effective password policy is still in effect.

Solution: Set the password policy to a length of zero. After the zero length policy is in effect, the minimum password length policy can be turned off.

SID History migration is not working.

Cause: There are a number of conditions that must be satisfied for SID History migration to work.

Solution: Properly configure the migration environment before running Active Directory Migration Tool, and review the configuration topics before proceeding with the migration.

See also: Checklist: Before using Active Directory Migration Tool, Migration requirements, Before performing an interforest migration, and Before performing an intraforest migration.

Note

  • When migrating a previously migrated security principal to a new domain, the criteria for migrating SID History should be in place for all three domains.

    For example, you have the following three domains: DomainA, DomainB, and DomainC. DomainA is a Windows NT 4.0 domain. DomainB and DomainC are Windows 2000 domains operating in native mode. User1 in DomainA (DomainA\User1) was migrated to DomainB as DomainB\User1 and SID History was translated. DomainB\User1 now has the primary SID for DomainB\User1 and the SID History value for DomainA\User1. If an administrator wants to migrate DomainB\User1 to DomainC\User1 and preserve all of DomainB\User1's SIDs, then the proper configuration settings must be in place to allow migration from DomainA to DomainC and from DomainB to DomainC. If DomainA has been decommissioned, or if proper configuration cannot be satisfied between DomainA and DomainC, then Active Directory Migration Tool will migrate the SID for DomainB\User1 to DomainC\User1 and log the fact that it could not migrate the DomainA\User1 SID.

    If DomainA does not exist, ADMT will write an error message to the log, but migration will still be successful. This error message can be ignored.

Permissions on a resource show "Account Unknown" for a migrated group or user.

Cause: If, when migrating a group or user account, domain controllers in the source domain are no longer available, computers in domains outside the target forest that are running Windows NT 3.51, Windows NT 4.0, or Windows 2000 (in a domain operating in mixed mode) may not be able to resolve the group or user object's SID History with the target domain's Global Catalog.

As long as the source domain is accessible, the group or user account name can be resolved. The inability to resolve the account name is an administrative problem only. The inability to resolve the group or user account name through SID History does not prevent that account from having the desired access to that resource. For example, if a user shows up as "Account Unknown" in a group's membership list, that user is still a member of that group and has the rights associated with that group.

Solution: This SID History resolution problem can be fixed by running the Security Translation Wizard to replace the source account SID with the new target account SID for all resources on all affected computers. This problem will be much more prevalent if you decommission the source account domain prior to migrating the source resource domain. Therefore, you should decommission all source domains together as the last step in the migration process.

After migration, new user accounts in the target domain are unable to access resources where the source domain accounts have permissions.

Cause: The settings necessary to run Active Directory Migration Tool have not been correctly established.

Most migration problems are caused by an incorrectly configured migration environment.

Solution: Open the migration log file and find the account you migrated with SID History. If SID History was added to the account, you should see an entry similar to the following:

1999-10-06 18:28:50-SID for UserAccountName added to the SID History of UserAccountName

If you receive an error message, it's almost certain you have not configured the environment correctly, and you should review the configuration topics before retrying the migration.

For information on up-to-date information and scenarios describing the various tools and methods used to migrate Windows NT networks to Windows 2000 networks and to restructure existing Windows 2000 networks, see the Domain Migration and Restructuring tools page at the Microsoft Web site. (http://www.microsoft.com/)

See also: Checklist: Before using Active Directory Migration Tool, Migration requirements, Before performing an interforest migration, and Before performing an intraforest migration.

I am receiving the following error: "The Recycle Bin on C:\ is corrupt or invalid. Do you want to empty the Recycle Bin for this drive?"

Cause: This is by design. For security reasons, each user who logs on to a Windows 2000 computer receives their own, user specific Recycle Bin. The access control list (ACL) for each instance of the Recycle Bin can contain only one user specific SID. When a user's profile is migrated in Add mode, the SID of the source domain user is added to the SID History of the Recycle Bin. This essentially places two user specific SIDs in the Recycle Bin's ACL. This problem does not occur if profiles are migrated in Replace mode.

Solution: Click Yes to the error message, and the Recycle Bin will be emptied without a problem. If you click No, the error will continue to appear until the Recycle Bin is emptied.

Users in Windows NT domains and Windows 2000 domains that are not trusted cannot access Distributed file system (Dfs) shares in Windows 2000 domains.

Cause: This is by design.

Solution: If you plan to use Dfs shares in your domain, you should migrate the computers first or migrate the computers and users in the same migration session.

SID History does not work for migrated Exchange service accounts.

Cause: Active Directory Migration Tool correctly migrates the Exchange service accounts, but there is a special manual process for updating Exchange service accounts that must be completed while running Exchange. Failure to follow this process could result in system failure or data loss on the Exchange system.

Solution: Review walkthrough material, scenarios, and other information about performing a domain migration on the Microsoft Domain Migration and Restructuring tools Web page at the Microsoft Web site. (http://www.microsoft.com/) You can also contact Microsoft Product Support Services for details on how to change the service account used by Exchange services in a site.

See also: Resources


Copyright

Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the example companies, organizations, products, people and events depicted herein are fictitious and no association with any real company, organization, product, person or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

Copyright © 2000 Microsoft Corporation. All rights reserved.

Microsoft, MS-DOS, Windows, and Windows NT are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries/regions.

Portions licensed from Mission Critical Software, Inc. of Houston, Texas.

The names of actual companies and products mentioned herein may be the trademarks of their respective owners.


About this Help file

This Help file contains topics integrated into the main Windows 2000 Help and is not meant for browsing. For overviews of features and help with specific tasks, click Start, and then click Help.


No Content

This content is not available in this preliminary release.


Preliminary Content

This is preliminary documentation and subject to change.


INDEX~TEXT
para1~"To open a Control Panel item, click <B>Start</B>, point to <B>Settings</B>, click <B>Control Panel</B>, and then double-click the appropriate icon."
para2~"To open an accessory, click <B>Start</B>, point to <B>Programs</B>, point to <B>Accessories</B>, and then click the appropriate icon."
para3~"To search for a specific word or phrase, click the <B>Index</B> or <B>Search</B> tab."
para4~"For more information, see Related Topics."
para5~"Web addresses can change, so you might be unable to connect to the Web site or sites mentioned here."
para6~"To open Computer Management, click <B>Start</B>, point to <B>Settings</B>, and then click <B>Control Panel</B>. Double-click <B>Administrative Tools</B>, and then double-click <B>Computer Management</B>."
para7~"To open <B>Fax</B>, click <B>Start</B>, point to <B>Settings</B>, click <B>Control Panel</B>, and then double-click <B>Fax</B>. If <B>Fax</B> does not appear, you need to install a fax device (such as a modem)."
para8~"To open Network and Dial-up Connections, click <B>Start</B>, point to <B>Settings</B>, click <B>Control Panel</B>, and then double-click <B>Network and Dial-up Connections</B>."
para10~"You must be logged on as an administrator or a member of the Administrators group in order to complete this procedure. If your computer is connected to a network, network policy settings may also prevent you from completing this procedure."
para13~"Open <A ID='shortcut' HREF='EXEC=,compmgmt.msc,/s CHM=mmc.chm FILE=alt_url_snapin.htm'>Computer Management (Local)</A>."
para14~"To open My Computer, double-click its icon on the desktop."
para15~"To open Windows Explorer, click <B>Start</B>, point to <B>Programs</B>, point to <B>Accessories</B>, and then click <B>Windows Explorer</B>."


Additional Help on the Internet

If you have a technical question about your Windows operating system and cannot find an answer in the product Help files or other documentation, contact the computer manufacturer that provided your software.

Microsoft Product Support Services You can also find the latest technical information about Microsoft products through online product support at the Microsoft Web site. (http://www.microsoft.com/)


Support Online

Online support
and information

* | Windows 2000 home page (http://www.microsoft.com/windows/professional)
* | Get tips and practical advice about Windows 2000 (http://www.microsoft.com/windows/professional/learnmore)
* | Contact product support (http://www.microsoft.com/windows/professional/support)
* | Download updates, new features, and drivers from Windows Update (http://windowsupdate.microsoft.com)
* | Search for Windows 2000-compatible software (http://www.microsoft.com/windows/professional/deploy/compatible)
* | Search for Windows 2000-compatible hardware (http://www.microsoft.com/hcl)
* | Learn how to deploy Windows 2000 (http://www.microsoft.com/windows/professional/deploy)
* | View Windows 2000 Resource Kit information (http://windows.microsoft.com/windows2000/reskit)
* | Learn more about accessibility resources (http://www.microsoft.com/enable)

Online support
and information

* | Windows 2000 home page (http://www.microsoft.com/windows/server)
* | Get tips and practical advice about Windows 2000 (http://www.microsoft.com/windows/server/learnmore)
* | Contact product support (http://www.microsoft.com/windows/server/support)
* | Download updates, new features, and drivers from Windows Update (http://windowsupdate.microsoft.com)
* | Search for Windows 2000-compatible software (http://www.microsoft.com/windows/server/deploy/compatible)
* | Search for Windows 2000-compatible hardware (http://www.microsoft.com/hcl)
* | Learn how to deploy Windows 2000 (http://www.microsoft.com/windows/server/deploy)
* | View Windows 2000 Resource Kit information (http://windows.microsoft.com/windows2000/reskit)
* | Learn more about accessibility resources (http://www.microsoft.com/enable)

Online support
and information

* | Windows 2000 home page (http://www.microsoft.com/windows/server)
* | Get tips and practical advice about Windows 2000 (http://www.microsoft.com/windows/server/learnmore)
* | Contact product support (http://www.microsoft.com/windows/server/support)
* | Download updates, new features, and drivers from Windows Update (http://windowsupdate.microsoft.com)
* | Search for Windows 2000-compatible software (http://www.microsoft.com/windows/server/deploy/compatible)
* | Search for Windows 2000-compatible hardware (http://www.microsoft.com/hcl)
* | Learn how to deploy Windows 2000 (http://www.microsoft.com/windows/server/deploy)
* | View Windows 2000 Resource Kit information (http://windows.microsoft.com/windows2000/reskit)
* | Learn more about accessibility resources (http://www.microsoft.com/enable)

Online support
and information

* | Windows 2000 home page (http://www.microsoft.com/windows/server)
* | Get tips and practical advice about Windows 2000 (http://www.microsoft.com/windows/server/learnmore)
* | Contact product support (http://www.microsoft.com/windows/server/support)
* | Download updates, new features, and drivers from Windows Update (http://windowsupdate.microsoft.com)
* | Search for Windows 2000-compatible software (http://www.microsoft.com/windows/server/deploy/compatible)
* | Search for Windows 2000-compatible hardware (http://www.microsoft.com/hcl)
* | Learn how to deploy Windows 2000 (http://www.microsoft.com/windows/server/deploy)
* | View Windows 2000 Resource Kit information (http://windows.microsoft.com/windows2000/reskit)
* | Learn more about accessibility resources (http://www.microsoft.com/enable)
Online support
and information
* | Windows home page (http://www.microsoft.com/windows)
* | Get tips and practical advice about Windows (http://www.microsoft.com/windows)
* | Contact product support (http://www.microsoft.com/support)
* | Download updates, new features, and drivers from Windows Update (http://windowsupdate.microsoft.com)
* | Search for Windows-compatible software (http://www.microsoft.com/windows)
* | Search for Windows-compatible hardware (http://www.microsoft.com/hcl)
* | Learn how to deploy Windows (http://www.microsoft.com/windows)
* | View Windows Resource Kit information (http://windows.microsoft.com/windows2000/reskit)
* | Learn more about accessibility resources (http://www.microsoft.com/enable)