1

I have a situation here that requires me to transfer all the OU, User and Computer Accounts to another domain, which is from Windows Server 2008 R2 to Windows Server 2012 Standard.

How to do this kind of task? Thanks in advance and Have a good day ahead.

6
  • You will probably get a few people that will chime in that you should hire a professional to do this. What you are asking to do isn't a simple checklist of things and the phrasing of your question suggests you aren't familiar with what you are asking about.
    – MikeAWood
    Sep 25, 2013 at 7:44
  • @MikeAWOOD, Yes, I am not very much familiar with it, but, I tried some method like the LDIFDE export and import, but getting errors.
    – Mark
    Sep 25, 2013 at 7:48
  • I am not familiar with the tool you mentioned, but likely it is expecting to see everything be the same from one domain to the new one. If you changed anything (which is almost impossible NOT to do), it likely will give you issues. Are you creating a new domain or just trying to move one over to a new server?
    – MikeAWood
    Sep 25, 2013 at 7:51
  • Yes, I am creating a new domain at the same time move the OUs, User and Computer Accounts in the new domain, which is from 2008 R2 to 2012 standard.
    – Mark
    Sep 25, 2013 at 7:56
  • 1
    What you are asking is likely beyond your skill level. I caution you to get a professional to help you. When setting up a domain, there are some choices and things to consider that will be set in stone. Simply put, don't do it alone. You cannot move computer accounts over. You will need to disjoin and rejoin the new domain, once done they will appear in AD. User Accounts and OU can be recreated, but it might be easier to script it in powershell with a script like this that imports from excel. (gallery.technet.microsoft.com/scriptcenter/…)
    – MikeAWood
    Sep 25, 2013 at 8:03

2 Answers 2

2

This is a very involved process depending on the number of users, computers, servers and services you have that interact with your current AD. You need to think about and look at -

  • Group Policies that are in place in the old domain
  • Logon Scripts if they are been used
  • Trusts between the 2 domains while you are migrating
  • Services that are AD integrated or use FQDNs for been accessed as these will change when you move domains
  • Migrating Groups to new domain then running Security Translations on servers in old domain to add those group (NewDomain\Group) to the servers. So when you close the old domain the groups still work.

That is just from the top of my head I am sure there is more you will need to do.

For your original question you can create a script to replicate the OU structure from your old domain (this is also a good opportunity to improve on that structure if you think it is incorrect). For user and computer objects you need to use ADMT to migrate there accounts. AD uses SIDs to identify each object and associate rights and profiles etc with that object. By using ADMT you will be able to migrate the users and computers to the new domain and retain the original SIDs, as well as the new one given out by your new domain. This way when they move to the new domain they will not lose access to file shares and services that are in there old world. The computers will need to be on the network when you use ADMT as it will connect to them translate there security from old domain to new domain and then move the computer. You will need a trust in place between the 2 domains for this to work at all.

If you are looking at a large number of users, computers and services I would hire in contractors to do this for you. It is not a quick process and is very involved.

1
  • SIDs are only used to indentify a specific subset objects in AD, namely Security Principals Sep 25, 2013 at 10:32
0

At first you need to configure the DNS Servers in each domain for enabling the network connectivity between the domains.

Next step is create the trust relationship between the domains,

After creating trust relationship, you need use ADMT to migrate users, computers etc between domains.

To export the password of AD User Accounts from one domain to other, you need to install Password Export Server(PES) on the source domain.

Checkout the below link on Creating Trust Relationship, Configuring ADMT and PES installation, http://social.technet.microsoft.com/wiki/contents/articles/16208.interforest-migration-with-admt-3-2-part-2.aspx

Checkout the below link on Configuration for SID History Migration and Use, Group, Computer Migration, http://social.technet.microsoft.com/wiki/contents/articles/16621.interforest-migration-with-admt-3-2-part-3.aspx

To disable the SID filtering, please follow the below steps

  • Login to target domain and start the command prompt with runas administrator
  • Execute the below command to disable SID Filtering on target domain

For example, if your source domain name is green.com and target domain is blue.com,

Netdom trust green green.com  /domain:blue /quarantine:No /usero:administrator /passwordo:Password1

Where usero, passwordo indicates the administrator credentials of source domain.

Once, you have executed the above command, you will receive SID filtering is not enabled for this trust.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .