Transfer Accounts & Passwords from NT4 PDC to Server 2003

[OutToLunch]

Hoping to pick peoples brains - I have collected a fair pile of links about how to upgrade from NT4 PDC to Server 2003 on the same machine, and how to use a Server 2003 install as an NT4 style PDC, but nothing about quick and dirty transfer of users and computer accounts from an NT4 PDC to a fresh Server 2003 install on another server. Aiming to get all users and their passwords over and all computer accounts over without them having to be rejoined to a new domain domain (ie keep the same domain if possible).

I'm in the usual situation of a creaky old NT4 PDC on it's last legs and trying to get everything over to a shiny new Server 2003 machine with minimum disruption - hopefully over half term. Server 2003 is a complete clean slate at the moment Does anyone have any tips (or even "Whatever you do, don't do what I did..." stories) on the easiest way to get accounts/passwords over?

Although it would be nice not to have to, I'm happy to do file transfers manually, redo shares, reset permissions with CACLS if necessary and generally fiddle to get everything working but our kids won't be able to cope with returning after the holidays to a completely new set of passwords (and come to think of it, the teachers probably won't either!).

Ben

[DMcCoy]

Active directory migration Tool (ADMT). On microsofts website, and free.

You should (not used NT4, but did a 2003 -> 2003 Migration). be able to copy the users and their SIDs, even group memberships I think. You can keep passwords too, but need to install some files for that.

Its worth a look anyway, but can take a little while to setup

http://www.microsoft.com/downloads/d...DisplayLang=en

[DMcCoy]

Hmm, there is a version 3 too!

http://www.microsoft.com/downloads/d...DisplayLang=en

[OutToLunch]

Excellent! Don't know how I missed that...

ADMT v3 also performs security translation from Windows NT 4.0 domains to Active Directory domains and between Active Directory domains in different forests.

Sounds like I have some more reading to do

Thanks!

[ChrisH]

I used the ADMT to migrate from NT to 2003 with minimal fuss .

[DMcCoy]

Its a great bit of software, especially if you keep the SIDs, all I did was copy users into the new domain, retain their SIDs, backup thier folders with windows backup (to a file) and restore on the new domain, all the permisions were kept, excellent

Keeping passwords between domains is wonderful :P

[m25man]

All objects during migration are assigned a new SID in the target domain.
The old SID is migrated and becomes the SID History allowing access to previous security objects.
There is also a SID Cleanup process, and to ensure all machine accounts are migrated one has to "despatch" (thats install to you and me) an agent to every machine in order to perform the migration.

Now all thats fine, and it works in text book fashion provided you rembered to turn them all on, but what about all of the other paraphnalia!
Exchange, ISA and allsorts....

Check you registry sizes after an ADMT migration they swell upto twice the previous size and that adds an overhead to the work stations.

If you have no reason to change your NetBios Domain Name why not "Swing"!
Prep the new 2k3 box set up the drives, join to the NT domain as a standalone box.
Copy all of the users folders from old to new hardware using Robocopy XP
Then,
I use a VM, configure it as an NT4 BDC
Sync it so you replicate all of the domain accounts and promote it to a BDC.
UnPlug the old NT Server that is now an NT BDC.
It is now your get out of jail free card!

If you are really paranoid shut down the VM and copy the Virtual Hard Drive now.
Restart the VM
Perform an in place upgrade of the VM to Server 2003 in 45 minutes all of your domain user accounts are now 2003 as are the machines, groups etc etc etc.....

Check your VM servers logs, DNS AD etc
If all is good then now is time to DC Promo your new Hardware server.
Transfer the FSMO Roles from the VM to the Hardware box.
Set the new server as a Global Catalog.

Your next move depends on what needs to happen to your old NT server box.

You can turn it back on and remove it gracefully from the domain.

If you do not do this now then you will have to clean up the old server info through NTDSUTIL and a Metadata Cleanup - a job for the experienced.

The result Old Domain - New Hardware
Everyone keeps their old SID, Security Context etc.
No Workstations need to been on during this process there is no client interaction.

Swinging is a valid and highly efficient method of Domain Migration - done it dozens and dozens of times even SBS Servers quick and easy huge domains in less than a few hours.

ADMT3 or SWING

Different techniques for different scenarios both valid and proven methods.

You want quick n dirty - swinging takes some beating.

GeoffH

[DMcCoy]

You don't have to do the whole process though, I only used it to copy the users and passwords between domains, I rebuilt the clients and servers anyway.

[OutToLunch]

Well, this got delayed and delayed and... You get the picture. Anyone have any final words on swinging? Sounds like the way to go for minimum disruption. Most of the docs I've found seem to be geared towards SBS migration though - I assume it's equally fine for a bog standard NT4 PDC with nothing but DHCP running on it? No other member servers in the domain to worry about.

[tarquel]

DMcCoy has the best idea - at least, thats what worked with me [tho i couldnt manage to get the passwords to carry over as it seemed to imply that it needed 2000 not NT 4 lol but gave me the option to reset them all to a single password or to the same as the username etc - u get a few options in any case].

I have commented in another thread how i did it - if u wanna search... but it basically was having a differently named domain on the new 2003 server / DC and migrating the users from the old NT domain to the new 2003 DC using the ADMT tool [i think thats the name] from MS.

I exported the user shares [in the registry] to a reg file, then moved the home dir HDD into the new server, made the drive/partition letters the same, and imported the user dir shares.

Then ran that ADMT tool and it all went beautifully - with the bonus of not having crap imported from the old domain, which is what i was worried about

Regards
Nath.

[Disease]

ADMT worked fine for me as well. It's the way to go.

[tarquel]

ADMT - ha, i did remember correctly...

Theres a first [tho technically, its not a hard one to guess at lol ]

N.