Before performing an intraforest migration

This topic lists the domain and security configurations necessary before you can use Active Directory Migration Tool to migrate users, groups, and computers between two Windows 2000 domains in the same forest.

Source and target domain

Verify that your source and target domains are configured as described in the following list:

• The target domain is running Windows 2000 and is operating in native mode.
• The source domain is running Windows 2000 is in the same forest as target domain.
• When migrating users and groups between domains in the same forest, Active Directory Migration Tool must communicate with the Relative ID (RID) pool master in the target domain. To improve performance when migrating a large number of users or groups, you should install Active Directory Migration Tool on the RID pool master in the target domain. By default, this is the first domain controller installed in the domain. Use Active Directory Users and Computers or Ntdsutil.exe to locate the domain controller that holds the RID pool master role.
• Any mapped network drives and similar connections between the source domain controller and the target domain controller on which Active Directory Migration Tool is running must be disconnected before running the tool. Failure to do so may result in the failure of a migration operation due to a "credentials conflict" error.

Security Requirements

You must meet the following security configuration requirements before running Active Directory Migration Tool.

• The user account you log on with when you run Active Directory Migration Tool must have the following permissions:

  • Domain Admin rights in the target domain
  • Member of the Administrators group in the source domain
  • Administrator rights on each computer you migrate
  • Administrator rights on each computer on which you translate security

Note

• To migrate users and groups from a child domain to the forest root domain, the user account you log on with when you run Active Directory Migration Tool must have the permissions of the Enterprise Admins group, in addition to the security privileges normally needed to run the tool.
• Administrative shares must exist on the computer where Active Directory Migration Tool is running and on any computer to which the tool must dispatch an agent.