?
Solved

How to Migrate User Profiles

Posted on 2009-04-24
19
Medium Priority
?
495 Views
Last Modified: 2012-05-06
Hello Experts,
We have created a new Domain where we have crated all new user accounts, its not currently in production. All of our users have roaming profiles which are stored on File Server in the old Domain. My next step is to migrate all the folders with user profiles from old domain to the new one. Can you suggest the tools that I can use to make this prosses as simple as possible? Both DCs are server 2003.
0
Comment
Question by:Sergey_Nesterenko
  • 9
  • 6
  • 3
  • +1
19 Comments
 
LVL 47

Expert Comment

by:Donald Stewart
ID: 24225840
I would use Richcopy to copy the profiles to the new server
http://technet.microsoft.com/en-us/magazine/2009.04.utilityspotlight.aspx?pr=blog
 
And then make the appropriate changes in ADUC to the users profile paths
0
 
LVL 85

Accepted Solution

by:
oBdA earned 400 total points
ID: 24225877
Note that you can NOT simply copy the folder content into the new directories; the user's registry has permissions configured as well, and these permissions will have to be replaced for the new user to be able to use the old user's registry. This is obviously not done during a simple file copy.

You can try the User State Migration Tool, and/or moveuser.exe from the W2k3 Resource Kit Tools (http://www.microsoft.com/downloads/details.aspx?FamilyID=9D467A69-57FF-4AE7-96EE-B18C4790CFFD&displaylang=en).

User State Migration Tool 3.0
http://technet.microsoft.com/en-us/library/cc722032.aspx

Windows User State Migration Tool (USMT) Version 3.0.1
http://www.microsoft.com/downloads/details.aspx?familyid=799AB28C-691B-4B36-B7AD-6C604BE4C595&displaylang=en
0
 
LVL 47

Expert Comment

by:Donald Stewart
ID: 24225928
Richcopy will keep the security settings as well
0
Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

 

Author Comment

by:Sergey_Nesterenko
ID: 24225932
I do not want to perserve any permissions or the security settings, I want to copy over the profile folders and change their SIDs, is there a tool that can help me do that?
0
 
LVL 6

Expert Comment

by:MikeGGG
ID: 24225948
Active Directory Migration Tool?
http://www.microsoft.com/downloads/details.aspx?FamilyID=6f86937b-533a-466d-a8e8-aff85ad3d212&displaylang=en
The Active Directory Migration Tool version 3 (ADMT v3) simplifies the process of restructuring your operating environment to meet the needs of your organization. You can use ADMT v3 to migrate users, groups, and computers from Microsoft® Windows NT® 4.0 domains to Active Directory® directory service domains; between Active Directory domains in different forests (interforest migration); and between Active Directory domains in the same forest (intraforest migration). ADMT v3 also performs security translation from Windows NT 4.0 domains to Active Directory domains and between Active Directory domains in different forests.
0
 
LVL 47

Assisted Solution

by:Donald Stewart
Donald Stewart earned 1200 total points
ID: 24226024
Copy the folders over and then use the script found here
Resets The Permission On A Collection Of Home Folders... ( Vbscript )
0
 

Author Comment

by:Sergey_Nesterenko
ID: 24226026
I realy wanted to avoid using ADMT, I looked in to it and it looks like its all command line tool, I'm fairly new in the IT field and it looks very complicated. If may be somebody can help me and explain how to use ADMT or suggest another way?

Thank you!
0
 

Author Comment

by:Sergey_Nesterenko
ID: 24226107
As i understand just copying user profile folder from domainA to domainB and pointing user profiles to the share where the profile stored in the domainB will not work because profile folders that were copied over from domainA have old SIDs. So after copying over the profiles I need to re SID them. Do I understand that correctly?
0
 
LVL 6

Assisted Solution

by:MikeGGG
MikeGGG earned 400 total points
ID: 24226113
Sergey,
migrating users between AD Domains is not a trivial task anyway.
It is not the same as copying files between 2 directories.
check this article maybe it will be useful, or you can use built-in help
http://support.microsoft.com/kb/326480/ru
0
 
LVL 47

Expert Comment

by:Donald Stewart
ID: 24226136
Yes, you are correct. It will be the same thing as taking/giving ownership of the folders. The script above can do that.
0
 
LVL 47

Assisted Solution

by:Donald Stewart
Donald Stewart earned 1200 total points
ID: 24226171
0
 

Author Comment

by:Sergey_Nesterenko
ID: 24226327
Thank you every one for your suggestions, however my instructions were to find an automated solution to transfer user profile folders. Is there a tool for example where in field 1 I specify the Source( where all profiles are stored) in the field 2 the Destination( where the folders are going) check the option to change the SID on the destonation folders. My manager wants me to find a software that will perform this operation.
0
 
LVL 47

Expert Comment

by:Donald Stewart
ID: 24226465
I dont think there is any software for that, just scripts and some manual.
Take a look at SetACL.exe which has a Sid option
http://www.helge.mynetcologne.de/setacl/ 
0
 
LVL 47

Expert Comment

by:Donald Stewart
ID: 24226499
This is one of the examples of setacl
 
This might be useful in a migration scenario where users from domain1 are migrated (copied) to domain2. This command copies all ACEs belonging to 'domain1\user1' to 'domain2\user2' resulting in a duplication of permissions: after the process domain2\user2 has the same permissions as domain1\user1.
Example 16 SetACL.exe -on "\\server1\share1\users" -ot file -actn domain -rec cont_obj -dom "n1:domain1;n2:domain2;da:repldom;w:dacl"
0
 
LVL 6

Expert Comment

by:MikeGGG
ID: 24226513
I agree with dstewartjr
you (or somebody for you) should write the following script:
Assume, your domains are domain1 and domain2
Take the old home folder
read its permission - who is owner (yourdomain/user1 for example)
copy the folder to it new location
look in domain2 for user domain2/user1
give im necessary permissions
go back to domain1 and look for the next home folder
...
0
 
LVL 47

Assisted Solution

by:Donald Stewart
Donald Stewart earned 1200 total points
ID: 24226576
0
 

Author Comment

by:Sergey_Nesterenko
ID: 24227001
Thank you very much everyone for all your help, I will now try to use your suggestions.
0
 

Author Comment

by:Sergey_Nesterenko
ID: 24227041
I'm new to expert exchange, instead of giving credit to everyone who helped me I just selected one person. Can I do anything to correct that?
0
 
LVL 47

Expert Comment

by:Donald Stewart
ID: 24227064
select the "Request Attention" and specify what you need
0

Featured Post

Free recovery tool for Microsoft Active Directory

Veeam Explorer for Microsoft Active Directory provides fast and reliable object-level recovery for Active Directory from a single-pass, agentless backup or storage snapshot — without the need to restore an entire virtual machine or use third-party tools.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this post we will be converting StringData saved within a text file into a hash table. This can be further used in a PowerShell script for replacing settings that are dynamic in nature from environment to environment.
Know the reasons and solutions to move/import EDB to New Exchange Server. Also, find out how to recover an Exchange .edb file and to restore the file back.
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…
In this video, viewers will be given step by step instructions on adjusting mouse, pointer and cursor visibility in Microsoft Windows 10. The video seeks to educate those who are struggling with the new Windows 10 Graphical User Interface. Change Cu…
Suggested Courses

864 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question