Perform an interforest resource domain migration

Establish trusts between domains using the Trust Migration Wizard.

You may also need to use Active Directory Domains and Trusts to manually create trusts between the source and target domain. Migrate the trusts before you migrate user accounts, service accounts, or local groups.
For details about creating trusts between domains, see Windows 2000 Server Help and the Windows NT product documentation.

Identify service accounts not running under local system authority using the Service Account Migration Wizard.

Active Directory Migration Tool cannot determine if a particular user account is used by one or more services. If any user accounts in the source domain are used to allow services to log on, you must run the Service Account Migration Wizard and select any servers that are running service accounts. Then, the Active Directory Migration Tool can build a list of the service accounts to be migrated before you run the User Migration Wizard.
Many applications, including Exchange Server 5.5, use service account mappings that Active Directory Migration Tool cannot change. These service accounts usually require configuration through registry settings or from within the application itself. You must manually update these accounts after the domain migration is complete.
When asked for user account credentials, use credentials with Administrator rights on the specific computer that is using the service accounts.

Migrate workstations and member servers using the Computer Migration Wizard.

At this time, you can choose to migrate the local profiles of previously migrated accounts from the same domain as the computer that will be translated. To translate previously migrated accounts from other domains, use the Security Translation Wizard and select each of the domains.
When migrating computer accounts from Windows NT domains, Active Directory Migration Tool will not migrate computer descriptions because the computer description attribute is not stored in the Windows NT domain security account manager. The description is stored on the local computer. Active Directory Migration Tool will migrate nonnull computer descriptions from computer accounts in Windows 2000 source domains.
The Computer Migration Wizard dispatches an agent to each computer being migrated. The agent restarts each computer after the computers join the target domain. Verify that the default startup menu option on the migrated computers is the migrated Windows NT or Windows 2000 installation.

Migrate local profiles using the Security Translation Wizard.

Migrate shared local groups using the Group Migration Wizard.

On the Group Options wizard page, ensure that Migrate group SIDs to target domain and Do not rename accounts are the only options selected.

Migrate service accounts using the User Migration Wizard.

Service accounts are user accounts used to run services on servers with a set of credentials other than local system authority. These accounts may exist both in a master account domain and in the same resource domain as the server. If the service account is in an account domain, this procedure would be completed by selecting the account domain as the source domain.

Update service account user rights using the Security Translation Wizard.

Select the computers in the source domain from which to translate the user rights. When selecting the source domain, select the domain of the service accounts, not the domain of the computer on which the service accounts are running.
On the Translate Objects wizard page, select Local groups and User rights.
On the User Account wizard page, type the name of an account with Administrator permissions in the target domain.

Manually move domain controllers into the resource domain.

Active Directory Migration Tool can not change the domain affiliation of Windows NT primary domain controllers (PDCs) and backup domain controllers (BDCs) or Windows 2000 domain controllers. PDCs, BDCs, and Windows 2000 domain controllers must be migrated manually. Do not use the Computer Migration Tool to migrate domain controllers. However, you can use all of the other Active Directory Migration Tool wizards on all domain controllers.
If the source domain is a Windows NT domain, upgrade the domain controllers to Windows 2000 beginning with the primary domain controller. The Active Directory Installation Wizard will run automatically as part of the upgrade process. When the upgrade is complete, demote the domain controller to a member server and then join the target domain.
If the source domain is a Windows 2000 domain, demote the domain controllers and join them to the target domain.
After a successful move operation, you should check the user access to resources on the computer that was moved. It may be necessary to run the Security Translation Wizard again on the moved computers to correct the local permissions.

Decommission the source account domain.

When the migration process is complete, the source account domain can be decommissioned. At this time, the domain will cease to exist.
Remove all trusts between this domain and all other domains.
For information about decommissioning a Windows NT domain, see the Windows NT product documentation.
For information about decommissioning a Windows 2000 domain, see Windows 2000 Server Help.

Decommission the source resource domain

When the migration process is complete, the source resource domain can be decommissioned. At this time, the domain will cease to exist.
Remove all trusts between this domain and all other domains.
For information about decommissioning a Windows NT domain, see the Windows NT product documentation.
For information about decommissioning a Windows 2000 domain, see Windows 2000 Server Help.