Active Directory Migration Tool Requirements

The Active Directory Migration Tool has several requirements to ensure it can perform the required tasks:

• The Active Directory Migration Tool runs only on Windows 2000 computers. The target domain must be running Windows 2000 RC2 or later in native mode. The PDC in the source domain must be running Windows NT 4.0 Service Pack 4 or later. If the source domain is running Windows 2000, it can run in native mode or mixed mode. If the Windows 2000 source domain has two or more domain controllers, and the source and target domains are in the same forest, you must run this tool on the domain controller with the RID pool allocator role.
• Memory requirements depend on the number of user accounts, groups, and computer accounts you migrate at one time. If you migrate a large number of accounts at one time, such as 30,000 accounts, you should run the Active Directory Migration Tool on a computer with at least 128MB of RAM (256MB recommended).
• Auditing for account management (success and failure events) must be enabled in the source and target domains. In Windows NT, account management is referred to as user and group management.
• If you have more than 10,000 user accounts, groups, or computers, you need to increase the Maximum size of Active Directory Searches group policy in the target domain. By default, this value is set to 10,000.
• If you want to translate Exchange security for Exchange mailboxes, distribution lists, custom recipients, organizations, sites, and containers, the account credentials you specify during the translation process must be a Permissions Admin in the Exchange site of the specified Exchange server.
• If you want to translate Exchange security, you must install Microsoft Exchange Administrator on the computer where you run the Active Directory Migration Tool.
• To use the Active Directory Migration Tool, the user account you log on with when you run the Active Directory Migration Tool must have the following permissions:
  • Administrator rights in the source domain (member of Domain Admins)
  • Administrator rights in the target domain
  • Administrator rights on each computer you migrate
  • Administrator rights on each computer on which you translate security
  • Administrator rights on any computer where the Active Directory Migration Tool must install an agent to perform the migration. These agents allow the Active Directory Migration Tool to resolve the security-related issues and to gather information for impact analysis.
• The source domain must trust the target domain. In addition, the target domain must trust all domains that are trusted by the source domain and that contain accounts that are members of local groups you will migrate in the source domain. The Trust Migration wizard allows you to compare the source and target domain trusts. You can also migrate the source domain trusts to the target domain.
• To update the SID History of migrated accounts in the target domain, the Active Directory Migration Tool has several additional requirements:
  • You must run the tool on a domain controller in the target domain.
  • The domain$$$ local group must exist in the source domain. The tool creates this group.
  • The tool must be able to connect to all domains related to the information in the SID History property of each migrated account. In addition, the user account you log on with when you run the tool must have administrator rights in each domain from which SID information is used.

    For example, if you migrate accounts from Domain A to Domain B, then migrate accounts from Domain B to Domain C, your account must have administrator rights in Domain A to copy the SID History information related to that domain. If Domain A is no longer available, the tool cannot copy the SID History information related to Domain A.

  • The following registry key must exist on the PDC in the source domain as a DWORD with the value set to 1. If you create this registry key, you must restart the domain controller to activate this value. The tool creates this registry key if it does not exist and restarts the domain controller.

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\
       Control\Lsa\TcpipClientSupport

Notes: To read the entries the Active Directory Migration Tool writes in the Application event log, you should read the log from a computer where the Active Directory Migration Tool is installed. The Active Directory Migration Tool uses an Access database to collect information. The tool then uses this information to perform the migration tasks. Two users should not run this tool at the same time using the same database.