Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any way to export an OU within Active Directory on a 2008 Domain Cobntroller to another 2008 Domain Controller on a different domain?

share|improve this question

Sure - ldifde or csvde with do the export, you can clean up anything you like in the output file, and then use the same tool to do the import.

share|improve this answer
sorry I should have mentioned that I need all the permissions and email addresses in each account to be exported as well, is that possible? – Gram Jan 6 '11 at 14:01
Permissions are not stored in AD. NTFS permissions are stored on the filesystem. Sharepoint permissions are stored in Sharepoint. SQL permissions are stored in SQL. I can keep going, but I think you understand? – mfinni Jan 6 '11 at 14:33
this is why you use security groups to give access rights – JamesRyan Jan 7 '11 at 17:48

You could do an LDIF export/import to copy the users over using any tool you feel comfortable with.

However, of course your passwords will be lost, as will the SID's and remember to change the User Principle Name, since it will not make sense having the old domains in the new domain (though AD will accept any string for that value).

There is the ADMT (AD Migration Tool) which will update the sidHistory attribute with the old SID's so that if there are similar cross tree/forest trusts, which seem to use the SID as the identifier, they should continue to work on the newer domain.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.