Instructions for Using WMI to Migrate Profiles

We are about to merge an existing small school into our large university.
They have received new Vista Enterprise machines from us to use on their
current Windows 2003 domain until they are ready to be migrated to our domain
in a couple of months. There are only about 25 users and computers, since
it's just faculty and staff. (if anyone is interested, someone used Easy
Transfer to migrate the old machines to the Vista ones, which apparently was
successful.)

I will need to migrate the user profiles to our domain. I see that
moveuser.exe cannot be used with Vista. Rather it becomes a WMI function.

I downloaded the KB930955 update which will allow this function, but the
article doesn't give instructions for using WMI to migrate the profile, so
I'm hoping someone can point me to an article or to an existing script for
this purpose.

Thanks.

More information:

I want to make it clear that there is no trust between our domain and the
other school's domain. Please keep this in mind as I am afraid this may mean
that WMI may not work for this purpose.

I looked at the list of updates included in SP1 and it does include
KB930955, so I won't need to install it after all.

"Baboon" wrote:

> We are about to merge an existing small school into our large university.
> They have received new Vista Enterprise machines from us to use on their
> current Windows 2003 domain until they are ready to be migrated to our domain
> in a couple of months. There are only about 25 users and computers, since
> it's just faculty and staff. (if anyone is interested, someone used Easy
> Transfer to migrate the old machines to the Vista ones, which apparently was
> successful.)
>
> I will need to migrate the user profiles to our domain. I see that
> moveuser.exe cannot be used with Vista. Rather it becomes a WMI function.
>
> I downloaded the KB930955 update which will allow this function, but the
> article doesn't give instructions for using WMI to migrate the profile, so
> I'm hoping someone can point me to an article or to an existing script for
> this purpose.
>
> Thanks.

Hello,

Do you mean that you want to migrate user profiles from old domain to new
domain, or more specifically, change user accounts without changing
existing user profiles?

Would you please take a look at the following article and see if your
situation looks like it?

How to migrate from Workgroup network model to Domain based model?
http://support.microsoft.com/kb/555542

With Windows Vista, you can achieve this by using a tool named Windows User
State Migration Tool (USMT) Version 3.0.1. You can download it from:

Windows User State Migration Tool (USMT) Version 3.0.1:
http://www.microsoft.com/downloads/d...28c-691b-4b36-
b7ad-6c604be4c595&displaylang=en

For some general information about this tool, please take a look at:

Migrating to Windows Vista Through the User State Migration Tool:
http://technet.microsoft.com/en-us/w.../aa905115.aspx

Please note that, before you perform the migration, you should read the
help document (you can get it after you install this tool) in more detail.
I will list some general steps here just for your reference:

1. Log on to the source computer as an administrator, and specify:

scanstate \\fileserver\migration\mystore /ue:*\* /ui:fareast\user1
/ui:fareast\user2 /i:miguser.xml /i:migapp.xml /o

2. Log on to the destination computer as an administrator.

3. Specify the following:

loadstate \\fileserver\migration\mystore /mu:fareast\user1:farwest\user2
/i:miguser.xml /i:migapp.xml

You need to adjust these settings accordingly.

I hope this helps.

Sincerely,
George Yin
Microsoft Online Support
Microsoft Global Technical Support Center

Get Secure! - www.microsoft.com/security
================================================== ===
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
================================================== ===
This posting is provided "AS IS" with no warranties, and confers no rights.

Thank you for your response. See my responses below.

"George Yin(MSFT)" wrote:

> Hello,
>
> Do you mean that you want to migrate user profiles from old domain to new
> domain, or more specifically, change user accounts without changing
> existing user profiles?

I guess you would call it changing user accounts without changing existing
profiles, but either one may apply.
>
> Would you please take a look at the following article and see if your
> situation looks like it?
>
> How to migrate from Workgroup network model to Domain based model?
> http://support.microsoft.com/kb/555542

This doesn't apply to Vista, as it relies on moveuser.exe. If you read
KB930955, you will see what I mean. Also, you will see where my first
question came from, regarding using WMI for this.
>
> With Windows Vista, you can achieve this by using a tool named Windows User
> State Migration Tool (USMT) Version 3.0.1. You can download it from:

Ah, you have brought up option 2 before I had a chance to. I am very
familiar with USMT but I have never used the option to move a profile from
one domain to another. This would be simple in a situation where there is a
trust involved. However, as I said in my second post, there is no trust
between our domain and the domain that these users now belong to.
So, the big question is whether or not we can do this without the trust.
>
> Windows User State Migration Tool (USMT) Version 3.0.1:
> http://www.microsoft.com/downloads/d...28c-691b-4b36-
> b7ad-6c604be4c595&displaylang=en
>
> For some general information about this tool, please take a look at:
>
> Migrating to Windows Vista Through the User State Migration Tool:
> http://technet.microsoft.com/en-us/w.../aa905115.aspx
>
> Please note that, before you perform the migration, you should read the
> help document (you can get it after you install this tool) in more detail.
> I will list some general steps here just for your reference:
>
> 1. Log on to the source computer as an administrator, and specify:
>
> scanstate \\fileserver\migration\mystore /ue:*\* /ui:fareast\user1
> /ui:fareast\user2 /i:miguser.xml /i:migapp.xml /o
>
> 2. Log on to the destination computer as an administrator.
>
> 3. Specify the following:
>
> loadstate \\fileserver\migration\mystore /mu:fareast\user1:farwest\user2
> /i:miguser.xml /i:migapp.xml
>
> You need to adjust these settings accordingly.
>
> I hope this helps.
>
> Sincerely,
> George Yin
> Microsoft Online Support
> Microsoft Global Technical Support Center
>
> Get Secure! - www.microsoft.com/security
> ================================================== ===
> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
> ================================================== ===
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
>

Hello Baboon,

Based on my understanding, your scenario is:

I assume you have one client computer (computerA), and it is now in
domainA. An user named user1 (domainA\user1) use this computer. Some days
later, you want to remove this computer from domainA and want to join it to
another domain, domainB. However, you want the user use account user1
(domainB\user1) to log on to the computer in the new domain with existing
user profile. You don't want to use ADMT to perform this migration, right?

If I have any misunderstanding, please let me know.

Well, this can be achieved by using USMT. You can do it as follows:

1. Log on to the computerA with an administrative account (Administrator)
in domainA. Then run the following command:

scanstate \\fileserver\migration\mystore /ue:*\* /ui:domainA\user1
/i:miguser.xml /i:migapp.xml /o

2. Remove the computerA from domainA.

3. After creating a new user "user1" in domainB and joining computerA to
domainB, you should log onto computerA with an administrative account
(Administrator) in domainB.

4. Run the following command on computerA:

loadstate \\fileserver\migration\mystore /mu:domainA\user1:domainB\user1
/i:miguser.xml /i:migapp.xml

5. Log on to computerA with the new user account (e.g. domainB\user1), see
it the user profile has been migrated successfully.

With this method, you don't need to create trust between domainA and
domainB. However, you need to create a new user domainB\user1 for
domainA\user1.

I have checked this on my test environment, and I would like to know how it
goes on your side.

Additionally, if you want to perform this job via the WMI provider, the
following resources will be more appropriate to provide efficient
assistance:

MSDN Public newsgroup
http://msdn.microsoft.com/newsgroups/default.asp

MSDN Forum:
http://forums.microsoft.com/msdn

I hope this helps.

Sincerely,
George Yin
Microsoft Online Support
Microsoft Global Technical Support Center

Get Secure! - www.microsoft.com/security
================================================== ===
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
================================================== ===
This posting is provided "AS IS" with no warranties, and confers no rights.

Thank you very much.
The scenario you describe is exactly correct.

It sounds like this will work even without the trust, based on your test
results. I will test this anyway, though I believe it should succeed as it
has for you. We won't do the actual migration until August though.

These users have their My Documents redirected to a server via Group Policy
Folder Redirection. I believe the Admin on other domain will need to turn
this policy setting off before the migation. Other than that, I don't see
any problems.

Cheers.


"George Yin(MSFT)" wrote:

> Hello Baboon,
>
> Based on my understanding, your scenario is:
>
> I assume you have one client computer (computerA), and it is now in
> domainA. An user named user1 (domainA\user1) use this computer. Some days
> later, you want to remove this computer from domainA and want to join it to
> another domain, domainB. However, you want the user use account user1
> (domainB\user1) to log on to the computer in the new domain with existing
> user profile. You don't want to use ADMT to perform this migration, right?
>
> If I have any misunderstanding, please let me know.
>
> Well, this can be achieved by using USMT. You can do it as follows:
>
> 1. Log on to the computerA with an administrative account (Administrator)
> in domainA. Then run the following command:
>
> scanstate \\fileserver\migration\mystore /ue:*\* /ui:domainA\user1
> /i:miguser.xml /i:migapp.xml /o
>
> 2. Remove the computerA from domainA.
>
> 3. After creating a new user "user1" in domainB and joining computerA to
> domainB, you should log onto computerA with an administrative account
> (Administrator) in domainB.
>
> 4. Run the following command on computerA:
>
> loadstate \\fileserver\migration\mystore /mu:domainA\user1:domainB\user1
> /i:miguser.xml /i:migapp.xml
>
> 5. Log on to computerA with the new user account (e.g. domainB\user1), see
> it the user profile has been migrated successfully.
>
> With this method, you don't need to create trust between domainA and
> domainB. However, you need to create a new user domainB\user1 for
> domainA\user1.
>
> I have checked this on my test environment, and I would like to know how it
> goes on your side.
>
> Additionally, if you want to perform this job via the WMI provider, the
> following resources will be more appropriate to provide efficient
> assistance:
>
> MSDN Public newsgroup
> http://msdn.microsoft.com/newsgroups/default.asp
>
> MSDN Forum:
> http://forums.microsoft.com/msdn
>
> I hope this helps.
>
> Sincerely,
> George Yin
> Microsoft Online Support
> Microsoft Global Technical Support Center
>
> Get Secure! - www.microsoft.com/security
> ================================================== ===
> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
> ================================================== ===
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
>

Hello,

I am just writing to see how everything is going. If you have any updates
or need any further assistance on this issue, please feel free to let me
know. I am glad to be of assistance.

Sincerely,
George Yin
Microsoft Online Support
Microsoft Global Technical Support Center

Get Secure! - www.microsoft.com/security
================================================== ===
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
================================================== ===
This posting is provided "AS IS" with no warranties, and confers no rights.

I have tested this on both Vista and XP and it successfully migrated most
settings.

We will have to determine which workstations have multiple profiles that
need to be migrated. It will be a bit tedious if there are any workstations
with lots of profiles to migrate, but we will just have to deal with it.

Ironically, since I first posted this, I was approached about an NT 4 domain
that is still on our network. There are less than 30 workstations, but they
are using their own user accounts and there is no outgoing trust from our AD
to that domain. I proposed USMT as the solution for that migration to our AD
domain and it looks like that will be approved.

Thanks.

"George Yin(MSFT)" wrote:

> Hello,
>
> I am just writing to see how everything is going. If you have any updates
> or need any further assistance on this issue, please feel free to let me
> know. I am glad to be of assistance.
>
> Sincerely,
> George Yin
> Microsoft Online Support
> Microsoft Global Technical Support Center
>
> Get Secure! - www.microsoft.com/security
> ================================================== ===
> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
> ================================================== ===
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
>

Hi Baboon,

Do you mean that you have some workstations running operating systems
earlier than Windows 2000?

If you do, you need to upgrade them to at least Windows 2000 as USMT
doesn't work on them. USMT only support Windows Vista, Windows XP, Windows
2000 as source for migrating data.

However, if you mean that the domain functional level is Windows 2000 mixed
mode (containing NT4.0), but the machines are running Windows XP, using
USMT is fine.

Sincerely,
George Yin
Microsoft Online Support
Microsoft Global Technical Support Center

Get Secure! - www.microsoft.com/security
================================================== ===
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
================================================== ===
This posting is provided "AS IS" with no warranties, and confers no rights.

No, the workstations are most likely all XP and Vista.

The domain that we need to collapse is not AD in mixed mode, it's actually
an NT domain with an external trust to our AD, but I am pretty certain only
the DCs are running NT4.

This was sort of a rogue domain, since it was never approved that they would
create their own user accounts, especially since each user that enters our
organization gets one from central IT. But since it's a university that's no
surprise, is it?

By the way, it looks like USMT won' be used after all. An outgoing trust
has been set up to that domain and one of the Quest migration tools will be
used. I can't remember the name of it, but it was used to migrate our large
NT4 account domains a few years ago.

"George Yin(MSFT)" wrote:

> Hi Baboon,
>
> Do you mean that you have some workstations running operating systems
> earlier than Windows 2000?
>
> If you do, you need to upgrade them to at least Windows 2000 as USMT
> doesn't work on them. USMT only support Windows Vista, Windows XP, Windows
> 2000 as source for migrating data.
>
> However, if you mean that the domain functional level is Windows 2000 mixed
> mode (containing NT4.0), but the machines are running Windows XP, using
> USMT is fine.
>
> Sincerely,
> George Yin
> Microsoft Online Support
> Microsoft Global Technical Support Center
>
> Get Secure! - www.microsoft.com/security
> ================================================== ===
> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
> ================================================== ===
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
>

Hi Baboon,

Thank you for your update.

That could be fine if only the domain is NT 4.0 domain. And the migration
will be much easier if there is a trust between them. If you are familiar
with some tools to do this, that could be your best choice.

If you have any other questions or concerns, please feel free to let me
know.

Thank you.

Sincerely,
George Yin
Microsoft Online Support
Microsoft Global Technical Support Center

Get Secure! - www.microsoft.com/security
================================================== ===
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
================================================== ===
This posting is provided "AS IS" with no warranties, and confers no rights.

I have finished the work on migrating the workstations. It turned out that
all of them were running XP, so since the trust now exists I simply used
moveuser.exe. It seems to have worked like a charm. Thankfully that is over
and we can finally collapse our last unneeded domain.

"George Yin(MSFT)" wrote:

> Hi Baboon,
>
> Thank you for your update.
>
> That could be fine if only the domain is NT 4.0 domain. And the migration
> will be much easier if there is a trust between them. If you are familiar
> with some tools to do this, that could be your best choice.
>
> If you have any other questions or concerns, please feel free to let me
> know.
>
> Thank you.
>
> Sincerely,
> George Yin
> Microsoft Online Support
> Microsoft Global Technical Support Center
>
> Get Secure! - www.microsoft.com/security
> ================================================== ===
> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
> ================================================== ===
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
>