[Webinar] Streamline your web hosting managementRegister Today

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 767
  • Last Modified:

Copying an account to child domain keeping SID history

I have a forest with a parent domain which we will call "Shared" and three child domains (Field Test, Production, and Production Test) I want to use Production Test as a debug environment for Production. One of the applications I run requires a service account in AD and it looks at the SID on the account so for it to work in Production Test I need to copy the user and the SID history. I have tried using the ADMT 3.2 Account Migration Wizard but when it runs in the same forest it moves the account not copies. I need the account to exist in each child domain and have the same SID history. Is there a way to copy the account with SID? Import/Export options? Or is there a way to copy SID history and apply it to a user in the other domain? OS on all servers is Windows Server 2008 R2.

Shared Domain manages Admin User access for users like sys admins and support servers like AV and WSUS.

Child Domains Field Test, Production, and Production Test contain end user accounts and service accounts specific to each environment.

Thanks for any help!!!
0
Sparcedge
Asked:
Sparcedge
  • 2
1 Solution
 
AnuroopsunddCommented:
Clone principal can help in copying the account information..

Note:--- it duplicates the object from source domain to target domain... does not delete..

you can  find more details in below link if it fullfills your requirement..

http://technet.microsoft.com/en-us/library/cc773393(v=ws.10).aspx
0
 
SparcedgeAuthor Commented:
Clone Principal is from Server 2000 and 2003, do they still make it or include it in support tools for 2008 R2? Or would the 2003 version work on a 2008 R2 domain?
0
 
AnuroopsunddCommented:
it may require some testing. in below link they are providing how to run on windows 2008 machine..but again test in lab first..

http://daddyr.blogspot.com/2011/09/migrate-sidhistory-for-domain-admins.html

http://www.rutter-net.com/news/tips-tricks/migrate-sidhistory-for-domain-admins-and-domain-users-cross-forest/
0
 
Tony MassaCommented:
First link is correct, but you need to use the sidHistory script (from clone principal tool) to copy it.
Sidhist.vbs. Sample script that adds the SID of a source account to the SIDHistory of a destination account.
See Also: http://msdn.microsoft.com/en-us/library/ms677982%28v=vs.85%29.aspx

Apparently, you can use ADMT to do this though:
http://social.technet.microsoft.com/Forums/en/winserverDS/thread/c0bf3fa8-e379-4241-bf82-7dae2ea2a8fc
0

Featured Post

The new generation of project management tools

With monday.com’s project management tool, you can see what everyone on your team is working in a single glance. Its intuitive dashboards are customizable, so you can create systems that work for you.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now