Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have about ~30 workstations that I administer, plus a fileserver, all of which I inherited when I took this net admin job. The previous guy had been around forever from when the company was far smaller and just put up with the hassle of dealing with it as a workgroup. Now we have a remote location and far too may users and workstations to make this feasible.

Currently the users have a username/password on their workstation, and a matching one on the fileserver. There are local groups set up on said fileserver so that the people in various departments have the correct access to the folders they need.

Shortly I'll be making the fileserver into an active-directory server as well and migrating everything over to a domain so I can centrally administrate everything. I'm wondering if there's a way to copy/migrate the local groups over into the domain groups so that I don't have to go recreate the same permission structure for the shares. I'll be changing the username schema, but definitely would like to be able to keep the groups if possible.

share|improve this question
up vote 1 down vote accepted

Unfortunately, there's no way I know of to migrate local groups into the domain such that you don't have to change any of the filesystem permissions. While you could fairly easily do some scripting that would read the local groups and make equivalently named groups in AD, they're not really the same groups. The group SIDs will always be different. So you'll still end up needing to update the permissions wherever those local groups were referenced to point to their domain equivalents.

The other option you have would be to leave the local groups intact and just add your new domain users to the local groups. Or better yet, do the work to make your equivalent domain groups and just add the domain groups to their equivalent local group. Ultimately, you're still managing the fileserver using local groups. But you are at least utilizing domain users until you have time to go through the fileserver and update the permissions. The only thing this wouldn't fix is folders that are tied directly to existing local users if there are any of those.

share|improve this answer

actually this is fairly straightforward if previous permission was grant to local groups. Just add newly created AD group into corresponding server local group.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.