1

Our company was recently bought out and as such, we are going to be required to join their AD.

Currently, and the way they had recommended is very cumbersome, especially with very large profiles. Especially it requires tremendous time copying/migrating, it has high downtime for the user, and keeps me occupied during this period.

To summarise, this is my current method and I feel there has to be a better way than this.

  • Get their current domain password so it will be identical on new server (file server will still be authenticating on legacy server until completed)
  • Restart PC
  • Login as local admin
  • Unjoin domain/join workgroup/join new domain
  • add user into admin group
  • rename users\default to default_bak
  • clone users profile
  • rename the clone as default
  • in advanced settings delete profile
  • reboot and login as user and wait again
  • revert previous changes
  • remove from admin group
  • reboot

For the most part, this works fine, provided they have the space to hold the profile twice, but if anything, it is very time consuming, copying the profile twice. Is there another way I am not seeing? A script? A tool?

Update/Edited: They will not allow us to have a trust relationship between both domains, I think that may remove ADMT?

Also, I prefer something remote, as while a good portion are local in our physical location, I have several machines that are in several different US states as well as several other countries.

Improve this question
  • 2
    There are certainly MANY ways to do this better, both free and $$commercial. – Jim B Dec 3 '15 at 0:01
  • If you can't establish a trust relationship, you can't migrate anything. Sorry. – Massimo Dec 3 '15 at 14:29
  • Arggg... so I guess the way I described above, unfortunately, is then the only way I can accomplish this. That is unfortunate, but I guess then I have no choice. Thank you for the advice on ADMT.... I am sure sometime down the road it may become useful for me to know :-) – Jonathan Dec 3 '15 at 14:31
5

There is absolutely a better way. Using the ADMT, Active Directory Migration Tool, you can handle the transitions in a much more streamlined approach. The domains would need to be setup with a trust and the software run from a server but the basic idea is that the software would be used to copy users/computers/groups/etc from one domain to another. This can include the users' current password (without you having to know it), as well as their SID. The SID can be copied into the destination user object and helps ease the transition for file shares and resource access. As for the computers, the ADMT tool can be used to migrate the computers to the new domain, and associate their existing profile with their new user object on the destination domain.

Improve this answer
  • Though a caveat is they wont do the trust relationship... I have to read the documentation as the issue was avoiding C:\users\name and C:\users\name.newDomainName; and having a way so the desktop is identical to what the user expected. the not knowing their password part is tremendously more ideal, i hate the idea i have to ask but nobody wants to sit with me 3, 4, 5+ hours as I reboot it twice, and since I need the passwords to be in sync, the infamous 600 second time out lock when they're not is awful! – Jonathan Dec 2 '15 at 22:01
3

Microsoft's Active Directory Migration Tool is the free solution provided by Microsoft for AD migration tasks; you can find the relevant documentation here.

There are also various paid tools which may or may not be better suited for your situation (and are usually easier to use than ADMT, which is notoriously difficult); Dell (formerly Quest Software)'s Migration Manager for Active Directory is one of the most well known and used.

Improve this answer
  • I updated the question, to state that trust relationship won't happen between both domains. – Jonathan Dec 3 '15 at 14:10
  • 1
    If you can't establish a trust relationship, you can't migrate anything. Sorry. – Massimo Dec 3 '15 at 14:29
0

To do it really simply PC by PC, you can use a standalone tool like USMT (and Much Easier with a GUI running USMT)

With USMT you can simply store a copy of all profiles on the local disk or a network location.

Then on a PC on the new Domain (or the same PC rejoined) restore the users profile to the User account on the new domain.

We used USMTGUI because it lets you restore to a different username, making it possible for us to change usernames going over to the new Domain.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.