How to migrate windows users and retain passwords?

Question

I am moving a web application from one server to another, where users log in with Windows accounts (local server accounts, not AD). I want the migration to be as smooth as possible, but re-creating Windows users on the new server means every user must create a new password.

Is there a way to copy the passwords, so the migration is 100% seamless?

Answer 1

There isn't a "supported" method to do what you're asking for without involving Active Directory (AD). You could promote the current Windows Server 2003 computer to a Domain Controller (DC), which would "promote" all the local accounts to domain accounts. At that point you could join the new server to your domain as a DC and decommission the old server. That would do exactly what you want, but you'll have to use AD.

If you don't want to go w/ AD then you're stuck copying the details of the user accounts and resetting their passwords. I wrote a script to copy local user account properties for another Server Fault question, but that won't handle password migration. That script would be easy to modify, if you have a record of the passwords (which, admittedly, for security reasons isn't a great thing to have), to set the passwords during the copying.

You could use the PasswdHk password filter to capture user password changes on the old server. You'd have to ask everyone to change their password at least once after installing the filter. I can't recommend this course of action in good conscience without warning you that you'll be creating a situation where an attacker could steal the plaintext of your users' passwords by doing this, but it would work to build a password list for migration.