Server 2008: Moving a Group to Another Domain

[stephenx]

hey guys i need some urgent help from you all. I am using Windows server 2008 and i want to move one of the group to another domain using Active Directory Migration Tool (ATMT).

Do you have any idea how to do that ? Please help.

[Devasis]

To move the group with ATMT you need to have it inn your system, if don't than download ATMT Tool.

Now follow this steps:-

1. Install Active Directory Migration Tool
   
   
2. Open the ADMT MMC snap-in it is located in Administrative Tools.
   
   
3. Chose source and destination domains and click Next.
   
   
4. On the Group Selection screen, chose the group that you want to migrate and click Next.
   
   
5. On the next screen, select Browse and locate the desired OU.
   
   
6. On the Group Options screen, select one or more of the following and click Next:

Update user rights: Copies any user rights that are assigned in the source domain to the target domain.

Copy group members: Specifies whether the user objects that belong to the group should be migrated along with the group.

Adds the security identifiers (SIDs) of the migrated group accounts in the source domain to the SID history of the new group in the target domain.

• On the Naming Conflicts screen, select whether you want to migrate group objects that conflict with objects in the target domain and click Next.
  
  
• Follow the remainder of the wizard to complete the migration.

[Solomon]

Minimum System Requirements for ATMT Tool:-

• Supported Operating Systems: Windows Server 2008
  
  
• ADMT can be installed on any computer capable of running the Windows Server 2008 operating system, unless they are Read-Only domain controllers or in a Server Core configuration.
  
  
• Target domain: The target domain must be running either Windows 2000 Server or Windows Server 2003 or Windows Server 2008
  
  
• Source domain: The source domain must be running Windows 2000 Server, Windows Server 2003, or Windows Server 2008
  
  
• The ADMT agent, installed by ADMT on computers in the source domains, can operate on computers running Windows 2000 Professional, Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008.

[stephenx]

Thanks for the reply friend, I was really in need of that. could you give me some more tips regarding Server 2008. Please, it will be useful for me.

[MrChris-]

Well here are some tips. Just go through this:-

Finding Disabled Users:

get-qaduser –disabled

Create a new Active Directory user:

new-QADUser -name '<User CN>' -parentContainer '<Parent DN>' -UserPassword
'<Password>' -FirstName '<User First Name>' -LastName '<User Last Name>'
-UserPrincipalName '<User UPN>'

Create multiple users in Active Directory:

$parentDN = “<ParentDN>” $strPass = “userPaswd” For ($i = 1; $i -le 1000; $i++) { $strUserName = “User” + $i New-QADUser -name $strUserName -parentContainer $parentDN -UserPassword $strPass }

Modify Attributes for several users:
$

strfileServer = "\\Servername\"
$objOU = [ADSI] "LDAP://<OU DN>"
$objOU.psbase.Children |% {
$uac = [int](($_.userAccountControl).ToString())
if (($_.objectClass -eq "user") -and (($uac -band 2) -eq 0))
{
$_.put("homeDirectory", $strFileServer + $_.sAMAccountName)
$_.SetInfo()
}
}

Delete user in Active Directory

remove-QADObject -identity <User DN>

Set user profile in Active Directory

get-QADUser -identity "<User DN>" |
set-QADUser -HomeDirectory '\\Servername\Katrin' -HomeDrive
'H:' -ProfilePath '\\server1\profiles\jsmith'
-scriptpath '\\dcname\netlogon\logonscript.vbs'