Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am moving a web application from one server to another, where users log in with Windows accounts (local server accounts, not AD). I want the migration to be as smooth as possible, but re-creating Windows users on the new server means every user must create a new password.

Is there a way to copy the passwords, so the migration is 100% seamless?

share|improve this question

migrated from superuser.com Jan 5 '12 at 12:04

This question came from our site for computer enthusiasts and power users.

    
how many users? –  tony roth Jan 5 '12 at 16:59
    
@tonyroth: About 400 users –  tenfour Jan 5 '12 at 17:19
    
what OS levels are involved –  tony roth Jan 5 '12 at 17:37
    
@tonyroth: Limited user accounts, migrating from Windows 2003 server -> Windows 2008 server. Not sure if that's what you're asking :) –  tenfour Jan 5 '12 at 17:47
    
if it was w2k8r2 then you could use technet.microsoft.com/en-us/library/…;. –  tony roth Jan 5 '12 at 18:02

3 Answers 3

up vote 4 down vote accepted

There isn't a "supported" method to do what you're asking for without involving Active Directory (AD). You could promote the current Windows Server 2003 computer to a Domain Controller (DC), which would "promote" all the local accounts to domain accounts. At that point you could join the new server to your domain as a DC and decommission the old server. That would do exactly what you want, but you'll have to use AD.

If you don't want to go w/ AD then you're stuck copying the details of the user accounts and resetting their passwords. I wrote a script to copy local user account properties for another Server Fault question, but that won't handle password migration. That script would be easy to modify, if you have a record of the passwords (which, admittedly, for security reasons isn't a great thing to have), to set the passwords during the copying.

You could use the PasswdHk password filter to capture user password changes on the old server. You'd have to ask everyone to change their password at least once after installing the filter. I can't recommend this course of action in good conscience without warning you that you'll be creating a situation where an attacker could steal the plaintext of your users' passwords by doing this, but it would work to build a password list for migration.

share|improve this answer
    
This is what I suspected. I have used some other tool in the past as well which literally copied passwords from one machine to the next, but it was more of a shameful hacker's tool than a sysadmin tool. Thanks for such a complete answer. –  tenfour Jan 5 '12 at 22:53

You can give Sys-Manage's CopyRight2 a trial. It has an easy to use graphical user interface that allows you to selecively copy user and group accounts including password hashes from one computer to another. It supports all possible scenarios, e.g. from member server to DC, DC to member server, cross domain, inner domain, workgroup mode... You can download it from their website located at: http://www.sys-manage.com/PRODUCTS/CopyRight/tabid/64/Default.aspx

share|improve this answer

Okay maybe my solution is a little bit rude or even illegal but you can try to crack the passwords with on of the many password crackers.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.