We help IT Professionals succeed at work.

Check out our new AWS podcast with Certified Expert, Phil Phillips! Listen to "How to Execute a Seamless AWS Migration" on EE or on your favorite podcast platform. Listen Now

x

Not able to migrate SID using ADMT.

Medium Priority
669 Views
Last Modified: 2012-05-07
I am not able to migrate the SID to the target domain using ADMT, but the user accounts get successfully migrated. In the target domain the migrated user's SID is different compared to the user's SID into the source domain.

Source Domain : test.com
Target Domain : xyz.com

Source Domain and Target Domain running Windows 2003.

I have already gone through the Microsoft KB and  various articles with full of information, but I need specific reason to solve this problem. Need your help.
Comment
Watch Question

Author

Commented:
Anyone who can help me?
Toni UranjekConsultant/Trainer

Commented:
Hi!

You can not migrate SID from one domain to another. When object is copied between domains in the same forest, new SID is created, GUID does not change. When object is copied between domains in different forests, both change. However, you should be able to locate old SID under SIDHistory property of user account.

HTH

Toni

Author

Commented:
Hi,

You mean that, when object is copied :

Domains in the same forest --> SID changes in the Target Domain
Domains in different forests  -->  SID changes in the Target Domain

Am I correct?

Please tell me in which case SID does not change?

I am using two different forests for SID Migration.
Consultant/Trainer
Commented:
Unlock this solution with a free trial preview.
(No credit card required)
Get Preview
Chris DentPowerShell Developer
CERTIFIED EXPERT
Top Expert 2010

Commented:

> Please tell me in which case SID does not change?

Moves within the current domain only.

The current SID is copied to the SIDHistory attribute as Toniur said for both inter-forest and cross-forest moves.

Chris
Chris DentPowerShell Developer
CERTIFIED EXPERT
Top Expert 2010

Commented:

Sorry Toniur, popped up as question alert and neglected to refresh before posting.

Chris

Author

Commented:
Yes, I am getting the SID History in the Target Domain, but what is the purpose of it if I can't use that SID?

Is there any wayout so that I can keep my SID in case of cross forest migration?
Chris DentPowerShell Developer
CERTIFIED EXPERT
Top Expert 2010

Commented:

That is the entire point of SIDHistory, both the SID and SIDHistory are enumerated when evaluating entries in access control lists.

So what do you mean by "can't use that SID"? Perhaps you have SID Filtering running on a trust and that's preventing a migrated account from accessing resources with the entry in SIDHistory?

Chris

Author

Commented:
OK. I think it is not possible to use the SID History in the Target Domain. Am I right?

However, please tell me is there any wayout so that I can keep my SID in case of cross forest migration?
Chris DentPowerShell Developer
CERTIFIED EXPERT
Top Expert 2010

Commented:

What do you mean by use it? How would you use it? Can you give an example?

Chris

Author

Commented:
I mean to say the use of SID History on the target domain. The SID History in the Target Domain is showing the same SID in the Source Domain.
Chris DentPowerShell Developer
CERTIFIED EXPERT
Top Expert 2010

Commented:

That's what it's supposed to do if you use a tool like ADMT, it copies the SID from the source domain into the SID history on the target domain.

You shouldn't need to actively do anything with that, it allows the user in the target domain to use the old SID when accessing resources in the source domain. Without that functionality you would have to re-write all access control in the source domain to allow a migrated user in.

Chris

Author

Commented:
Thanks Crhris for your inputs.
Unlock the solution to this question.
Thanks for using Experts Exchange.

Please provide your email to receive a free trial preview!

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.