70 lines
8.4 KiB
HTML
70 lines
8.4 KiB
HTML
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN"
|
||
|
|
"http://www.w3.org/TR/REC-html40/strict.dtd">
|
||
|
|
<HTML DIR="LTR">
|
||
|
|
<HEAD>
|
||
|
|
<TITLE>Migrating user accounts and groups</TITLE>
|
||
|
|
<LINK REL="stylesheet" MEDIA="screen" TYPE="text/css" HREF="coUA.css">
|
||
|
|
<LINK REL="stylesheet" MEDIA="print" TYPE="text/css" HREF="coUAprint.css">
|
||
|
|
<SCRIPT LANGUAGE="JScript" SRC="shared.js"></SCRIPT>
|
||
|
|
|
||
|
|
<META HTTP-EQUIV="Content-Type" CONTENT="text-html;charset=Windows-1252">
|
||
|
|
<META HTTP-EQUIV="PICS-Label" CONTENT='(PICS-1.1 "<http://www.rsac.org/ratingsv01.html>" l comment "RSACi North America Server" by "inet@microsoft.com <mailto:inet@microsoft.com>" r (n 0 s 0 v 0 l 0))'>
|
||
|
|
<META NAME="MS.LOCALE" CONTENT="EN-US">
|
||
|
|
<META NAME="MS-IT-LOC" Content="Active Directory Migration Tool">
|
||
|
|
<META NAME="MS-HAID" CONTENT="a_ConceptMigratingUsersGroup">
|
||
|
|
</HEAD>
|
||
|
|
<BODY>
|
||
|
|
|
||
|
|
|
||
|
|
<H1>Migrating user accounts and groups</H1>
|
||
|
|
|
||
|
|
<P>Use Active Directory Migration Tool to migrate user accounts and groups from a <A ID="wPopup" HREF="HELP=ADMTGlos.hlp TOPIC=SourceDomain">source domain</A> to a <A ID="wPopup" HREF="HELP=ADMTGlos.hlp TOPIC=TargetDomain"> target domain</A>. While migrating, the users can retain access to resources. Once all of the users, groups, computers, and resources have been migrated, the source domain can be decommissioned. Before performing the migration, you can test the process without actually migrating the accounts by clicking <B>Test the migration settings and migrate later</B> in the wizards.</P>
|
||
|
|
|
||
|
|
<H2>User accounts</H2>
|
||
|
|
<P>Because objects must exist in the target domain before their properties are referenced, Active Directory Migration Tool migrates all the account objects to the target domain before it migrates their properties. For example, Peter is the manager of Robert. Before Peter's account object can be referenced by the Manager property of Robert's user account, both Peter's and Robert's account objects must exist. So, when migrating user accounts, first Peter's and Robert's user accounts are migrated to the target domain, then the properties of each account are migrated.</P>
|
||
|
|
|
||
|
|
<P>When migrating accounts, you must migrate the security IDs (SIDs) to the target domain. This will update the <A ID="wPopup" HREF="HELP=ADMTGlos.hlp TOPIC=SIDHistory">SID History</A> of the accounts. If you migrate accounts and do not update SID History for those accounts, the new accounts do not have the access that the original accounts had until you translate security and the Exchange directory.</P>
|
||
|
|
|
||
|
|
<H2>Service accounts</H2>
|
||
|
|
|
||
|
|
<P>Service accounts are user accounts that are used to run services with a set of credentials other than local system authority. This is usually done because even though the local system authority security context has absolute rights on the computer on which it operates, it has no rights on any other computers on the network. Many applications, for example Microsoft Exchange, use service accounts to run services with the same set of credentials on several networked computers.</P>
|
||
|
|
|
||
|
|
<H2>Groups</H2>
|
||
|
|
|
||
|
|
<P>Global groups can only have users from their own domain as members. So, when you migrate user accounts from one domain to another, the new accounts created by Active Directory Migration Tool in the target domain cannot be members of the global groups in the source domain. When you migrate global groups, group affiliation will be restored; however, if you migrate users before migrating global groups, it may be possible for the users to log on to the target domain using the migrated accounts, but the migrated user accounts will not have any group affiliation. Therefore, to ensure a smooth migration, you should migrate global groups before migrating users.</P>
|
||
|
|
|
||
|
|
<P>Migrating global groups before migrating users accounts creates a corresponding global group in the target domain for each global group that exist in the source domain. The newly created global group in the target domain receives a new primary <A ID="wPopup" HREF="HELP=ADMTGlos.hlp TOPIC=SID">SID</A> that contains the domain identifier of the target domain as part of the SID. The primary SID of the global group in the source domain is added to the SID History attribute of the newly created group.</P>
|
||
|
|
|
||
|
|
<P>Local groups can contain members defined in other domains. Therefore, processing local groups can be a bit more complicated than processing global groups and user accounts. When adding a local group member in the target domain, Active Directory Migration Tool processes the group members in the following order:</P>
|
||
|
|
|
||
|
|
<OL>
|
||
|
|
<LI>If the source member is also being migrated, Active Directory Migration Tool adds the copied account to the local group in the target domain.</LI>
|
||
|
|
|
||
|
|
<LI>If the source member is known in the target domain, it is added by its security identifier. To be known by the target domain, the user account or group must be defined in a domain trusted by both the source and target domains.</LI>
|
||
|
|
|
||
|
|
<LI>If the source member name exists in the target domain, this name is resolved to the target domain security identifier.</LI>
|
||
|
|
|
||
|
|
<LI>If the source member name does not exist in the target domain, domains trusted by the target domain are searched for the name and the name is then resolved to its security identifier. If this search fails, Active Directory Migration Tool does not add the member.</LI>
|
||
|
|
</OL>
|
||
|
|
|
||
|
|
<P><A ID="wPopup" HREF="HELP=ADMTGlos.hlp TOPIC=SharedLocalGroup">Shared local groups </A> are sometimes used on domain controllers to organize access rights. If shared local groups are used, you should migrate all shared local groups to the target domain using the Group Migration Wizard and then upgrade the domain controllers to Windows 2000 and move them to the target domain.</P>
|
||
|
|
|
||
|
|
<P>Before migrating groups, you can use the Group Mapping and Merging Wizard to map a group in the source domain to a different group in the target domain. Mapping one group to another essentially moves the membership of a group in the source domain into a new or different group in the target domain. You can also merge the memberships of multiple groups into a new or different group in the target domain. Merging multiple groups into one group combines the memberships of several groups in the source domain into one group in the target domain.</P>
|
||
|
|
|
||
|
|
<P class="note">Notes</P>
|
||
|
|
<UL>
|
||
|
|
<LI>If you have mapped a group to a different group in the target domain, and then you migrate that group from the source domain to the target domain, the mapping information is replaced. The group is then mapped to the migrated group in the target domain.</LI>
|
||
|
|
|
||
|
|
<LI>In an <A ID="wPopup" HREF="HELP=ADMTGlos.hlp TOPIC=IntraforestMigration">intraforest migration</A>, when global groups are migrated from a <A ID="wPopup" HREF="HELP=ADMTGlos.hlp TOPIC=NativeMode">native mode</A> source domain, the groups are migrated over correctly, but are created as universal groups in the target domain so that they can contain members from the source domain that have not been migrated yet.</LI>
|
||
|
|
</UL>
|
||
|
|
|
||
|
|
<H2>Copying group memberships</H2>
|
||
|
|
<P>Active Directory Migration Tool also copies local and global group memberships and user rights for migrated user accounts. If you migrate a local group and its members to another domain, Active Directory Migration Tool copies the local group to the target domain. Membership is maintained through SID History. When migrating users who are members of groups in the source domain that also exist in the target domain, the source domain groups are not actually migrated, but the users are made members of the target domain groups.</P>
|
||
|
|
|
||
|
|
<P>Local groups can only contain SIDs from other local groups. Global groups can only contain SIDs from other global groups. Universal groups can only contain SIDs from global groups or other universal groups. If Active Directory Migration Tool finds a SID from the source domain that it cannot resolve, such as a SID for a user account that does not have a matching user account in the target domain, Active Directory Migration Tool leaves the SID unchanged and continues searching.</P>
|
||
|
|
|
||
|
|
<P>For more information about security issues related to <A ID="wPopup" HREF="HELP=ADMTGlos.hlp TOPIC=DomainMigration">domain migration</A>, see the Domain Migration and Restructuring Tools page at the <A ID="extUrl" HREF="http://www.microsoft.com/isapi/redir.dll?prd=Domain Migration and Restructuring tools" TITLE="http://www.microsoft.com/" TARGET="_new">Microsoft Web site</A><SPAN CLASS="printOnly"> (http://www.microsoft.com/)</SPAN>. Other references available at the Microsoft Web site include Windows 2000 Server Help and the Resource Kit.</P>
|
||
|
|
|
||
|
|
</BODY>
|
||
|
|
</HTML>
|