User Account and Group Migration

The Active Directory Migration Tool allows you to copy user accounts and groups from one domain to another. This product provides many options to help you migrate the user accounts and groups exactly as you need. For example, you can specify how the Active Directory Migration Tool handles the passwords for the copied user accounts. You can also test the process first to examine the user accounts and groups without copying them to the target domain.

Warning:
When you migrate user accounts and groups, the tool creates all the accounts before copying the properties of those accounts. This process ensures Windows 2000 accounts that reference the distinguished names of other Windows 2000 objects in their properties, such as the Manager property, are correctly migrated. For example, if UserA is the manager of UserB, and you migrate both accounts at the same time, UserA and UserB need to exist before the tool can correctly set the Manager property of UserB. If you interrupt the migration process before it is finished, accounts may exist without the properties correctly set. You should allow the migration process to finish completely.

When the tool migrates user accounts, the tool sets the User must change password at next logon property for each migrated user account. If the Password never expires property is set for a user account, the tool clears the Password never expires property for that user account.

Notes:

If the User cannot change password property is set for a user account, that migrated user account will be locked because the user will not be able to reset the password.
Password complexity functions may limit the passwords the tool can assign to a user account. The tool can generate complex passwords that meet the minimum password length requirement and contain at least 3 lowercase letters, 3 uppercase letters, 3 numerical digits, and 3 symbols. If the generated password does not comply with the password complexity rules in the target domain, the tool disables the migrated user account.

Local groups can contain members defined in other domains. Therefore, processing local groups can be a bit more complicated than processing global groups and user accounts. When adding a local group member in the target domain, the Active Directory Migration Tool processes the group members in the following manner:

If the source member is also being migrated, the Active Directory Migration Tool adds the copied account to the local group in the target domain.
If the source member is known in the target domain, it is added by its Security Identifier (SID). To be known by the target domain, the user account or group must be defined in a domain trusted by both the source and target domains.
If the source member name exists in the target domain, this name is resolved to the target domain SID.
If the source member name does not exist in the target domain, domains trusted by the target domain are searched for the name and the name is then resolved to its SID. If this search fails, the Active Directory Migration Tool does not add the member.

Note:
If you have mapped a group to a different group in the target domain, and then you migrate that group from the source domain to the target domain, the mapping information is replaced. The group is then mapped to the migrated group in the target domain.