Solved

AD migration

Posted on 2013-12-12
8
167 Views
Last Modified: 2013-12-30
Need to migrate AD with multiple domains.IS there any way by which we can migrate without admin access. One way is to build a new DC and create(migrate all resources belongs to AD) but not sure how we can comletely achieve this.
0
Comment
Question by:sivark14
  • 3
  • 2
  • 2
  • +1
8 Comments
 
LVL 53

Expert Comment

by:Will Szymkowski
Comment Utility
You absolutely need Admin accesses to do this. Think about it if you didn't then any user in your domain could perform tasks such as this. You need domain admin rights to perform and domain level tasks Enterprise to perform high level tasks at the forest level and if you are doing schema changes then you will require schema admin rights.

If you created a new forest with a new domain you still have to have domain/enterprise admin permissions as you will need to create a forest trust with the new domain and that privilege is required to have domain/enterprise admin rights.

Permissions required for specific tasks for migration. http://technet.microsoft.com/en-us/library/cc974398(v=ws.10).aspx

Will
0
 
LVL 35

Expert Comment

by:Mahesh
Comment Utility
You can use Microsoft ADMT tool for cross domain resource migration

You must require appropriate admins access in resource domain for that

You can use delegated access for resource migration (i.e. you can avoid domain admins and high previlage groups)

Please check ADMT guide

http://technet.microsoft.com/en-us/library/cc974332(v=ws.10).aspx

Mahesh
0
 

Author Comment

by:sivark14
Comment Utility
Yes ofcourse we need admin access but I am finding a way to migrate without any kind of admin access. For example export all object details in domain and import manually or use any script. Thinking restoring system state to restore AD objects in the new forest domain and not do any trust relationship
0
 
LVL 35

Expert Comment

by:Mahesh
Comment Utility
You cannot restore AD system state of one domain to another domain

You can export all object details and import it in new domain with csvde, Ds command tools etc

Then this is not a migration
If you want to do real migration, then ADMT is the only way

Check below links
http://www.petenetlive.com/KB/Article/0000794.htm

Mahesh
0
Promote certifications in your email signature

Has your company recently won an award or achieved a certification? They'll no doubt want to show it off. Email signature images used to promote certifications & awards can instantly establish credibility with a recipient and provide you with numerous benefits.

 
LVL 53

Expert Comment

by:Will Szymkowski
Comment Utility
A migration is much different than simply using powershell to export users/groups and import them into the other domain. You are basically just creating the object but none of the security principals will be tied to the users account once you have created them in the new domain.

Migration would be the best approach if you have proper credentials. If you do not then scripting with powershell doing an export of all users/groups etc and then import them in to the new domain. You will then have to manually setup all of the ACL's for the new domain moving the users back in the corresponding groups.

As for the trust after this is completed you will still need domain admin privileges in the forest root domain or enterprise admin rights to achieve this.

Will
0
 

Author Comment

by:sivark14
Comment Utility
Is there any way to restore system state on new domain by having same domain name , SID value of the source domain so it will have the same configuration detail and restoration will work?

Thanks
0
 
LVL 53

Accepted Solution

by:
Will Szymkowski earned 500 total points
Comment Utility
This is not achievable, and or not supported. The system state holds Active Directory info from the original domain, I don't know how you would go about using that and restore it into the new domain.

As stated there are a few things you can do that are supported and will work. If this is a production environment I would highly recommend that you proceed with either method. Trying to hack or work-a-round could just create more trouble than you are looking for, and may not even get your end results.

Will.
0
 
LVL 3

Expert Comment

by:Detlef001
Comment Utility
Hello,
Using ADMT we can migrate. By the way, what version of AD are you try to migrate and to which version?
If you really want to know more about AD migration, I suggest you refer one of our MVP's site:http://www.sivarajan.com/admt.html
0

Featured Post

Complete Microsoft Windows PC® & Mac Backup

Backup and recovery solutions to protect all your PCs & Mac– on-premises or in remote locations. Acronis backs up entire PC or Mac with patented reliable disk imaging technology and you will be able to restore workstations to a new, dissimilar hardware in minutes.

Join & Write a Comment

On July 14th 2015, Windows Server 2003 will become End of Support, leaving hundreds of thousands of servers around the world that still run this 12 year old operating system vulnerable and potentially out of compliance in many organisations around t…
The recent Microsoft changes on update philosophy for Windows pre-10 and their impact on existing WSUS implementations.
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…
This tutorial will walk an individual through locating and launching the BEUtility application and how to execute it on the appropriate database. Log onto the server running the Backup Exec database. In a larger environment, this would generally be …

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now