Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We're migrating from Windows 2003 to 2008 SBS. We will run concurrently for a short period of time. I cannot establish a trust relationship between Server 2003 & Server 2008 SBS and I would like to know if there is a way to sync the passwords between 2003->2008?

For example, I would like to dump the pre-encrypted passswords to a file in 2003 and then use this to update the passwords for the correspoding usernames in 2008 SBS. Is this possible? I have no need to ever see the clear text version of the passwords.

I see one commercial product, but it hardly seems worth it given the temporary nature of my project...

Thanks, Franco

share|improve this question

1 Answer 1

up vote 0 down vote accepted

I will preface this by saying it's all kinds of bad to store passwords outside of a one way hash which prevents anyone from ever being able to see what the actual password is.

You could certainly have a delimited file with each pw and username on a line that you run a script on to set the AD password on the destination side via ADSI. You would just have to store the credentials of a user on the dest side that has rights to set these PW's.

TO keep them updated, you could setup a web page that users used to change their passwords so when they changed them the app behind the page set them on both sides. You would also have to instruct users to not use their workstations to set their passwords in either of the domains during this time or they would get out of sync.

share|improve this answer
    
Thank you. Do you know if I would be able to simply extract a pre-hashed password from one domain and enter it as pre-hashed into the other domain? I'd like to do this so that a password change on domain X could be propagated into domain Y without using an intermediate page as you mention. This would be ideal from my current scenario (all people login to domain X, but temporarily use resources of domain Y) and slightly more secure as well. –  Franco C. Jun 14 '10 at 14:05
    
You can enable reversible encryption on your passwords then you would be able to get at them. –  BoxerBucks Jun 14 '10 at 14:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.