Link to home
Start Free TrialLog in
Avatar of rookie_b
rookie_bFlag for United Kingdom of Great Britain and Northern Ireland

asked on

Replace specific AD security groups when migrating folders to a new server

We use folder and server specific AD security groups to manage access  to our shared folders, and need to replace some of the groups as we are migrating them to a new server.

The folder specific groupss  are  ServerA-dir-folder-rw, serverA-dir-folder-ro
The server specific groups is ServerA-dir-rw, ServerA-dir-ro


We need to rename the folder groups to ServerB-dir-folder-rw, serverB-dir-folder-ro - whch attributes should we rename - cn,name,samaccountname,etc?

We need tor replace the server specific groups with ServerB-dir-rw, ServerB-dir-ro - we cannot rename those, as they are still in use on Server A. How do I replace these?
The issue is we have a lot of blocked inheritance down the folder structure, so we cant just replace them at the top level.


Thank you!
Avatar of Alex
Alex
Flag of United Kingdom of Great Britain and Northern Ireland image

renaming the group shouldn't cause any issues since it'll be referenced by either a SID or GUID. I think it's a SID for AD groups, essentially renaming the group shouldn't impact and it should automatically update the name of the group on the file server when it references it again.

If it were me, I'd create a group, assign it to a folder, rename it to confirm it still works as expected and then do your live groups.

Regards
Alex
Avatar of rookie_b

ASKER

Hi Alex,


Thanks for the quick response. I suppose I can test that, and see which attributes get renamed and which don't, and see if I can then set any remaining ones manually.

Any ideas on how to replace the groups that cannot be renamed as they are still in use  on the other server? Basically something that can scan the directory, find a specific group and replace it with its counterpart. As I said, there is a lot of blocked inheritance, so we can't just do it at the top level folder.
SOLUTION
Avatar of Mahesh
Mahesh
Flag of India image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Any ideas on how to replace the groups that cannot be renamed as they are still in use

You're not understanding, if you test it with a new group, verify it still works, it makes zero difference whether they are in use or not due to the fact the SID will be dealing with the communication. You can rename a live group without impacting.

Regards
Alex
I have done some testing. Using powershell:

Rename-ADObject -identity "cn=ServerA_folder_rw......" -newname  "Server_B_folder_rw"

The only issue I came across is it did not change the SamAccountName. I changed the SamAccountName manually in ADUC. The SID and ObjectGUID were not affected.

Is there a reason for the SamAccount name not changing initially?
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Thank you. I think the renaming part is clear. I will spilt the replacement part to a new question. The reason why we can't rename the server specific groups is they are still needed with their old names on the old server. The folder specific groups we will rename, as the entire folder is moving and will no longer exist on the old server.  Thank you so much for helping with this!