MENU

Intraforest Migration in Windows Server 2016 with Active Directory Migration Tool (ADMT) 3.2

Posted by Karim Buzdar on May 23, 2017
Share on Facebook0Share on Google+2Share on LinkedIn13Share on Reddit6Tweet about this on Twitter0
5/5 (2)
5/52

In this first blog post, I’ll walk you through to migrate Active Directory objects (users, groups, and workstations or member servers) between two domains in the same forest (Intraforest) using Active Directory Migration Tool (ADMT) 3.2.

ADMT allows you to migrate objects (including users, groups, computers, profiles, service and managed service accounts) with the help of ADMT console, command line, and VBScript. However, in this post, I’ll focus only on ADMT console and command line.

Intraforest Active Directory Domain Object Migration

When you migrate objects between domains in the same forest, the migrated objects no longer exist in source domain except computer accounts which are copied. Following table list some behaviors during the migration process.

 Intraforest migration behavior

Table 1: Intraforest migration behavior

Include File

When you have limited number of objects to migrate, you can directly specify them in a command line or in ADMT console. However, when you migrate a large number of objects, it is more efficient and less time consuming to specify them in an include file. Include file is a text file in which you place each object on a separate line. You can then provide the path of that file in ADMT console or command line during the migration process.

The following table list fields of an include file with their explanation.

Include file fields

Table 2: Include file fields

It is mandatory to specify source name of an object in include file while rest of the fields are optional. You can specify optional fields in any combination and in any order. I have listed below few examples to make things more clear.

SourceName

John

SourceName,TargetRDN

John, CN=johnny

SourceName,TargetRDN,TargetSAM

John, CN=johnny, johnnym

SourceName,TargetRDN,TargetSAM,TargetUPN

John, CN=johnny, johnnym, johnm@yourdomain.com

Preparing for AD Objects Migration

Before you proceed with migration process, cross-check the following requirements.

  1. Identify the source, target domain and the organizational unit (OU) where you will place migrated objects.
  2. Create an assignment table and document the domain objects that you are migrating with their source and target locations.
  3. ADMT doesn’t have any built-in migration test options. You should develop a test plan separately and test each object during and after they are migrated to the target domain. Identify and correct any problems to make sure that the objects once migrated can access resources based on their group membership and credentials.
  4. The migration process is non-reversible and you cannot roll back changes. Once objects are migrated, the only way is to remigrate them from target domain back to the source domain. You should have a rollback plan and the method you will use to remigrate objects.
  5. Inform all affected users beforehand about accounts migration plan and its schedule so that they are aware of the impact of the migration.
  6. Download and install the latest version of Active Directory Migration Tool (ADMT) 3.2 in the target domain.

Lab Topology Overview

I have three domains in my forest. Root domain, child domain, and tree domain. Each domain has a single domain controller and they are running on Windows Server 2016. Default two-way trust is already created between domains since they are part of a single forest. The full topology is shown in the following figure.

Lab topology overview

Figure 1: Lab topology overview

In this article, I’ll show you to migrate objects from child domain (child.yourdomain.com) to parent domain (yourdomain.com). The process is same if you migrate between tree domain (ourtreedomain.com) and child domain or vice versa because there is a default transitive trust between them.

Migrating Objects from Child Domain to Parent Domain Using ADMT Snap-in

Migrating Limited Users

Step 1. Log in with ADMT migration account on computer in target or parent domain where ADMT is installed

Step 2. Right-click Active Directory Migration tool and then click User Account Migration Wizard

ADMT Snap-in

Figure 2: ADMT Snap-in

Step 3. Click Next

User account migration wizard

Step 4. Provide or select NetBIOS or DNS name of the source and the target domains. Provide or select the name of domain controller of source and target domains (or select Any domain controller) and click Next

Source and target domains selection

Figure 4: Source and target domains selection

Step 5. Click ‘Select users from domain’ radio button and then click Next

User selection method

Figure 5: User selection method

Step 6. Click Browse and add desired user(s) you would like to migrate

User Account Magration Wizzard Adding users

Figure 6: Adding users

Step 7. Click Next

User Account Migration Wizard Adding Users

Figure 7: Adding users

Step 8. Click Browse to choose the target OU for migrating users

User Account Migration Wizard Target OU selection

Figure 8: Target OU selection

Step 9. Click Next

User Account Migration Wizard Target OU selection

Figure 9: Target OU selection

Step 10. Check both Translate roaming profiles, and Update user rights. Ignore any warnings and click Next

User Account Migration Wizard User migration options

Figure 10: User migration options

Step 11. Click ‘Do not migrate source object if a conflict is detected in the target domain’ radio button and click Next

User Account Migration Wizard User Accounts conflict management

Figure 11: User accounts conflict management

Step 12. Click Finish

User Account Migration Wizard Completing user migration wizard

Figure 12: Completing the user migration wizard

Step 13. Wait for the wizard to complete and look for any errors. Click Close

user migration progress

Figure 13: User migration progress

Step 14. Open Active Directory Users and Computers snap-in and verify the user account in target OU.

Migrating Large Number of Users Using Include File

Steps 1,2, 3, 4 are similar to single user migration wizard. However, proceed as follow after step 4.

– Click ‘Read object from an include file’ radio button and click Next

User Account Migration Wizard User selection method

Figure 14: User selection method

– Click Browse and choose the path of include file from local hard drive of your computer

User Account Migration Wizard providing include file path

Figure 15: Providing include file path

When you are done with above steps, proceed with step 8 of single user migration wizard and follow it till the end.

Step 1. Log in with ADMT migration account on computer in target or parent domain where ADMT is installed

Step 2. In ADMT snap-in, right-click Active Directory Migration Tool and then click Group Account Migration Wizard

ADMT snap-in

Figure 16: ADMT snap-in

Step 3. Click Next

Group account migration wizard

Figure 17: Group account migration wizard

Step 4. Provide or select NetBIOS or DNS name of the source and target domains. Provide or select the name of domain controller of source and target domains (or select Any domain controller) and click Next

Source and target domains selection

Figure 18: Source and target domains selection

Step 5. Click ‘Select groups from domain’ radio button and click Next

Group selection method

Figure 19: Group selection method

Step 6. Add the desired group(s) you would like to migrate and click Next

Group Account Migration Wizard Adding groups

Figure 20: Adding groups

Step 7. Click Browse and choose the target OU for migrating group(s). When you are done click Next

Choosing target OU

Figure 21: Choosing target OU

Step 8. Click Next and ignore any warnings if they appear

Group Account Migration Wizard Group options

Figure 22: Group options

Step 9. Click ‘Do not migrate source object if a conflict is detected in the target domain’ radio button and click Next

Group account conflict management

Figure 23: Group account conflict management

Step 10. Click Finish

Completing the group account migration wizard

Figure 24: Completing the group account migration wizard

Step 11. Wait for a wizard to complete and look for any errors. Click Close

Group migration progress

Figure 25: Group migration progress

Step 12. Open Active Directory Users and Computers snap-in and verify the group account in target OU.

Migrating Large Number of Groups Using Include File

When you are migrating multiple groups using an include file, first four steps are same from single group migration wizard. From step 5, proceed as follow.

– Click ‘Read objects from an include file’ radio button and click Next

Group selection method

Figure 26: Group selection method

– Click Browse and choose the path of include file from your local hard drive. When you are done click Next

Providing include file path

Figure 27: Providing include file path

When you are done with above steps, proceed to step 7 of single group migration wizard and follow it till the end.

Migrating Limited Workstations or Member Servers

Step 1. Log in with ADMT migration account on computer in target or parent domain where ADMT is installed

Step 2. In ADMT snap-in, right-click Active Directory Migration Tool and then click Computer Migration Wizard

ADMT snap-in

Figure 28: ADMT snap-in

Step 3. Click Next

Computer migration wizard

Figure 29: Computer migration wizard

Step 4. Provide or select NetBIOS or DNS name of the source and target domains. Provide or select the name of domain controller of source and target domains (or select Any domain controller) and click Next

Source and target domains selection

Figure 30: Source and target domains selection

Step 5. Click ‘Select computers from domain’ radio button and click Next

Computer selection method

Figure 31: Computer selection method

Step 6. Add the desired computer(s) you want to migrate and click Next

Computer Migration Wizard Adding computers

Figure 32: Adding computers

Step 7. Click Next

Computer Migration Wizard Adding computers

Figure 33: Adding computers

Step 8. Click Browse and choose target OU. Click Next

Computer Migration Wizard Choosing target OU

Figure 34: Choosing target OU

Step 9. Click Next

Computer Migration Wizard Choosing target OU

Figure 35: Choosing target OU

Step 10. Choose Local groups and User rights. Click Next

Computer Migration Wizard Computer Translation options

Figure 36: Computer translation options

Step 11. Choose Replace and click Next. Ignore any warnings

Computer Migration Wizard Security translation options

Figure 37: Security translation options

Step 12. Accept the default value and click Next

Computer Migration Wizard Computer restart delay

Figure 38: Computer restart delay

Step 13. Click Next

 Computer Migration Wizard Computer properies exclusion

Figure 39: Computer properties exclusion

Step 14. Click ‘Do not migrate source object if a conflict is detected in the target domain’ radio button and click Next

Computer Migration Wizard Computer account conflict management

Figure 40: Computer account conflict management

Step 15. Click Finish

Computer Migration Wizard Complete computer migration wizard

Figure 41: Completing the computer migration wizard

Step 16. Wait for the wizard to complete and look for any errors

Computer migration progress

Figure 42: Computer migration progress

Step 17. Open Active Directory Users and Computers snap-in and verify the computer account in target OU.

Migrating Large Number of Workstations or Member Servers Using Include File

Follow the steps 1,2,3 and 4 from single computer migration wizard. After step 4, proceed as follow:

– Click ‘Read objects from an include file’ radio button and click Next

Computer Migration Wizard computer selection method

Figure 43: Computer selection method

– Click Browse and provide the path of include file on your hard drive. Click Next

Group Account Migration Wizard providing include file path

Figure 44: Providing include file path

When you are done with above two steps, proceed with step 8 of single computer migration wizard and follow it till the end.

Migrating Objects from Child Domain to Parent Domain Using Command Line

Log in with ADMT migration account on the computer in target or parent domain where ADMT is installed. open PowerShell with elevated privileges and execute one of the following commands. After the migration, open Active Directory Users and Computers snap-in and verify the migrated objects in target OU.

Migrating Limited Users

Execute the following command on PowerShell.

The following table lists the required parameters, explanation and their syntax for migrating user accounts in intraforest.

ADMT user command line parameters

Table 3: ADMT user command line parameters

Migrating single user using PowerShell

Figure 45: Migrating single user using PowerShell

Migrating Large Number of Users Using Include File

Execute the following command on PowerShell.

Migrating multiple users with include file

Figure 46: Migrating multiple users with include file

Migrating Limited Groups

Execute the following command on PowerShell.

The following table lists the required parameters and their syntax for migrating global groups in intraforest.

ADMT group command line parameters

Table 4: ADMT group command line parameters

Migrating single group using PowerShell

Figure 47: Migrating single group using PowerShell

Migrating Large Number of Groups Using Include File

Execute the following command on PowerShell.

Migrating multiple groups with include file

Figure 48: Migrating multiple groups with include file

Migrating Limited Workstations or Member Servers

Execute the following command on PowerShell.

Following table list the required parameters and their syntax for migrating workstations or member servers in intraforest.

ADMT computer command line parameters

Table 5: ADMT computer command line parameters

Migrating single computer using PowerShell

Figure 49: Migrating single computer using PowerShell

Migrating Large Number of Workstations or Member Servers Using Include File

Execute the following command on PowerShell.

Migrating multiple computers with include file

Figure 50: Migrating multiple computers with include file

Conclusion

Today, I have covered AD objects migration including users, groups and computers account in the same forest with ADMT snap-in and PowerShell. However, intraforest migration is not about moving only these three AD objects. Security translation, service, and managed service account migration are still left and I’ll cover them in other blog posts.

Related materials:

Views All Time
10
Views Today
29

Please rate this

Return to all posts

You can’t have too much monitoring
Virtual Tape Library on Azure used with Microsoft System Center Data Protection Manager 2016
The following two tabs change content below.
Karim Buzdar
Karim Buzdar
Karim Buzdar holds a degree in telecommunication engineering and is a Microsoft Certified Solutions Associate (MCSA) for Server Infrastructure. As an IT engineer and technical author, he focuses on Microsoft Directory Services and PowerShell