The WADMigrator Warm and Fuzzies

Acitve Directory Migration With Minimal End-User Impact.

The Winzero Active Directory Domain Migrator was designed with least end user impact foremost in mind. This was achieved by reducing any impact on the source domain during the migration process.

By understanding the processes involved during each migration phase is to understand that at any time during the migration the source domain remains untouched until the final step where the end user’s account is enabled in the target domain and their workstation is cut over to join the target domain.

Migration Steps
During the account, contact and group migration, new accounts are created in the target domain, accounts are not moved. The new security accounts in the target domain all have new SIDs and their original SIDs are appended to each target account’s SIDHistory. NO impact on source accounts.

Once the accounts and groups are recreated in the target domain, their SIDs are matched in an account migration table with the original source accounts for both users and groups. The table is laid out in four columns: source UNCName, target UNCName, source SID and target SID. Once again NO impact on source accounts.

After the migration tables are created, all resources in the source domain, servers and workstations, are reACLed by appending the target name or SID to each object thereby creating a state of co-existence between all objects in the source domain and target domain. In other words; regardless whether the source or target account is trying to access any resource: files, folders, shares, profile objects or email, both accounts have the same access to each resource. Again NO impact on source accounts.

During the final phase of the migration, referred to as the cutover, workstations and/or servers are migrated to the target domain. During this process the source accounts of the selected users are disabled and their target accounts are enabled just prior to moving the accounts workstation to the target domain. The workstation reboots and joins the new domain. This is the only impact on the source domain: the user account is disabled and the computer is moved to the target domain.

Rollback Plan
If for any reason the migration or subset of a migration must be reversed, WADMigrator would be used to:
A) enable the source accounts, disable the target user accounts and
B) migrate the migrated workstations back to the source domain.
All the original source domain user accounts and group accounts with the original rights and permissions still exist, untouched in the source domain.

During all phases of the migration the source domain is not touched or restructured in any way. Only until the source domain controllers are removed will the properties of the source domain cease to exist in its original form.

Active Directory Domain Migration Checklist

Before beginning an Active Directory migration, a number of mandatory requirements are needed to be in place in order to complete the migration successfully. These requirements are standards to meet both the requirements for Microsoft Windows migration and the ADUM Active Directory Migrator.

Download the Domain Migration Checklist

Top 5 Interforest Active Directory Migration Tips

Migrating between Microsoft's Windows Active Directory forests can be an intimidating project. This article provides 5 Active Directory migration tips that are bound to save IT pros time and aspirin.

1. Plan, plan, plan

Planning is the best way to a smooth Active Directory migration.

The most common error is a lack of planning. Don't horribly underestimate the impact … an AD migration. Research the impact thoroughly and properly develop migration plans.

At the end of a thorough evaluation, IT pros will know their AD requirements for structure, security, bandwidth, hardware and timeline. AD is not forgiving, so it's easier to get it right the first time than try to clean up afterward.

2. Ask for help

Going it alone is a sure-fire way to blow it. Try not to reinvent the wheel.

Not asking for help before starting the project is asking for trouble and results in the same mistakes our experts have seen – and solved – many times.

3. Ensure redundancy

A lack of server redundancy can be the costliest of AD blunders. Except for single-server environments, a minimum of two domain controllers should be installed for load-balancing and failover.

4. Enlist expert support

Recruit a migration expert, as needed, at the start of the migration project to avoid pit falls. Keep the migration expert available, as required, during the begining phases of the project to help guide the success of the project.

5. Use advanced Migration tools.

There are 3 major migration software tools on the market from Quest software, netIQ and Winzero technologies.

Test the tools in a lab, compare cost to benefit and choose the tool that can more easily meet the challenges and issues what will be faced during the migration process.

WADMigrator Premigration Checklist

Administrative Access:
Create a 2 way trust betwen each source and target domain.
Add both the source and targets Domain Admins group, the Enterprise Admins group to each domains Administrators group.

Create or select an account on the target domain and add it to Domain Admins, Enterprise Admins and Schema Admins Group.
Use the above account as the migration account to perform the migration as well as for the service account.
Enable this account to logon locally and run as a service on both the source and target PDC Emulator.

Domain Policy:
verify that IPFiltering is turned off on both domains
Verify that Windows Firewall is turned off as a group policy

http://domainreconfigure.blogspot.com/search/label/Step%203%20Virtual%20Migration

DNS Configuration:
Once the target domain’s DNS server is configured and running, configure the DNS network card clients of the source domain computers to point to the new DNS Server and add the new domain to the domain suffix list.

Create a Domain Local Group:
Create a Domain Local group on both the source and target domain called DomainNetBiosName$$$ example: WINZERO$$$. Add 3 $ signs to the local group name. DO NOT add members to this group.

Enable Auditing:
Enable Account Management sucess and failure Auditing for both the domain and domain controller for both the source and target domain.
You will need to reboot the server for the auditing to take effect.

Register DLLs:
On the target domain PDC emulator register clonepr.dll.
Copy Clonepr.dll to the Windows directory from the WADMigrator working directory.
Open the command prompt
Type regsrv32 drive:\Windows\clonepr.dll to successfully register the dll.

Password Policies:
Check and verify that the source minimum domain password policy and restrictions less or equally restrictive to any target domain password policy. Passwords will not migrate if the password policy of the target domain is more restrictive then the password policy of the source domain.

After installation of WADMigrator Verify the following registry setting on both the target and sourec PDC emulators.

Registry Settings:
Check, add and verify the registry settings of the PDC or PDC emulator or FSMO server. (Usually the first installed domain controller in the source domain)

HKEY_LOCAL_MACHINE
SYSTEM\CurrentControlSet\Control\Lsa
Key: AllowpasswordExport
Type: DWORD
Set to: 1

HKEY_LOCAL_MACHINE
SYSTEM\CurrentControlSet\Control\Lsa
Key: RestrictAnonymous
Type: DWORD
Set to: 0

HKEY_LOCAL_MACHINE
SYSTEM\CurrentControlSet\Control\Lsa
Key: TcpipClientSupport
Type: DWORD
Set to: 1

HKEY_LOCAL_MACHINE
SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
Key: MaxUserPort
Type: DWORD
Set to: 0x0000fffe (hex) or 65534 (decimal)

Winzero Releases WADMigrator

Winzero Releases the next solution in Active Directory Migration Challenges - Winzero Active Directory Migrator ensuring coexistence between migrated and un-migrated users, simplifing the migration processes with automated resource updating and continued support during and after the migration process.

Whether migrating to meet specific economic challenges or undergoing acquisition, mergers or divestitures, Winzero Active Directory Migrator provides the features necessary to meet your evolving needs and budget.