I have a number of domain local resource groups that need:

a) to be changed into Universal groups.
b) renamed.
c) have the users of their member groups collapsed into this group itself.
d) remove the (no longer needed) member-groups.

The groups currently contain a mix of member-groups (sometimes nested groups) and users.
The end result would be a Universal group with just users. (So basically it is just a collapse of the entire tree structure into a single group.)

What would be the best order:
First change the groups type and name, then re-assign the members.
Or the other way around: First the members, than the rename/type of the group ?
Or doesn't make any difference ?
I can't find a definitive source on this.

Are there any tools that can automate this ? Doing it manually is a lot of work...

This is in preparation of a domain migration/phase out.
The Universal groups (and the users) will eventually be transferred into the new domain. The domains are functionally AD2003 with 2008 and 2012 DC's (if that makes any difference).


I recommend you using the AGDLP structure of nested groups instead of UG's. Use: Accounts => Global Group (GG's)=> Domain Local Group (DLG's) => Permissions, as it makes it way more easy to administer.

You do not need universal groups if you migrate to a single Domain. Furthermore it is way easier to create new groups (e.g. via PS /CSV) instead of renaming.

Back to topic, I suggest you create the GG's / DLG's first, prepare the Group adding script and then you just migrate (Hopefully via MS ADMT) the user accounts + just run the script. The User accounts will be in the Global Groups, that are already nested into the DLG's.

Furthermore you could prepare all permissions before migrating the User accounts (silent switch).

Feel free to ask for more as I've migrated multiple domain structures into single ones several times already.

| improve this answer | |
  • 1
    I have no choice in how to do this. It is mandated by the enterprise admins that we get rid of ALL local groups like this. (By the way: It is not a single domain migration: It is a reduction of some 56 country-based sub-domains to 5 continent based sub-domains. Our country domain will be absorbed in the Europe domain.) My LG's have GG and UG members with users from at least 17 sub-domains. – Tonny Mar 25 '14 at 11:43
  • I see, then I would still prefer a creation of new UG's via PS/csv and adding the users as well via ps/csv. You can prepare everything in the CSV and then just run the script on it - The most fast and secure way. If you have full administrative rights on the target domain I'd prefer to migrate first and then join, else you could of course create + join them while being in the old domain and migrate (eventually) afterwards. In technet you'll find a good group creation script by a free developer on: gallery.technet.microsoft.com/scriptcenter/… – Becks TibiaFun Mar 25 '14 at 12:53
  • Making new UG's is in most cases not an option. I would have to re-apply access-rights on millions of files across a dozen severs and NAS boxes. – Tonny Mar 25 '14 at 13:20
  • Got it, then you could try to edit the PS script I've linked in the previous comment to rename your groups and edit the group type. – Becks TibiaFun Mar 25 '14 at 13:26
  • That seems to be my best bet. I'm no expert when it comes to PS, but it doesn't seem too complicated to do it like that. – Tonny Mar 25 '14 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.