1. Windows Server 2003 La migrazione da Windows NT 4.0 a Windows Server 2003 Relatore: Corrado.Cappucci@pipeline.it MCSE - MCT

2. Restructuring Domains

3. How to Transition Service Accounts To transition service accounts: Identify service accounts 1 1 Modify the services on each server 3 3 Verify service accounts 4 4 Migrate the service accounts 2 2

4. How to Migrate Global Groups To migrate global groups, use the Group Account Migration Wizard to: Read the global group object in the source Add SID in the source to SID-History in the target Create a new global group object and SID in the target Log events in the source and target domains To verify migration of global groups: Verify global group accounts have been migrated Verify the original SID appears as the value of the SID-History attribute 1 1 2 2 3 3 4 4 1 1 2 2

5. How to Migrate Users Before migration: Notify users when credentials will be transitioned During migration:  Administer users in source domains  Manually synchronize any changes made in source domains After migration:  Re-migrate the global group accounts  Users can continue to log on to the source until switched To migrate user accounts in batches: Create a test account 1 1 Verify users have been migrated 3 3 Migrate user accounts in batch es 2 2 Translate any local user profiles 4 4 Verify migration of local user profiles 5 5 Migrate workstations for the users 6 6 Re-migrate global groups 7 7 Verify computer account migration 8 8

6. How to Migrate Trusts Trusts must be maintained if there is a delay between restructuring account and resource domains To verify that trusts have been migrated: Open Active Directory Domains and Trusts Right-click the domain target, click Properties Click the Trusts tab Select the trust from the list and click Properties In the Properties dialog box, click Validate Provide the appropriate user account and password 1 1 2 2 3 3 4 4 5 5 6 6 To migrate trusts: Start ADMT, open Trust Migration Wizard Complete the wizard 1 1 2 2

7. How to Migrate Client Computers and Member Servers To prepare an ADMT script, create an options file and an include file To migrate client computers and member servers: Start ADMT and then open the Computer Account Migration Wizard Complete the wizard 1 1 2 2 To verify migration of client computers and member servers: Review the migration log for errors Verify that the accounts exist in the target domain 1 1 2 2 Migrate computers in batches of up to 100 systems Accounts in the local SAM database do not need to be migrated

8. How to Migrate Domain Controllers When determining the resource domain migration order : Migrate resource domains that use dedicated domain controllers first Migrate all BDCs before migrating the PDC Migrate resource domains that use dedicated domain controllers first Migrate all BDCs before migrating the PDC Shared local groups should be migrated before upgrading Membership of the local group during the migration is retained Shared local groups should be migrated before upgrading Membership of the local group during the migration is retained When migrating shared local groups: To migrate shared local groups: Open ADMT and select Group Account Migration Wizard Complete the wizard Migrate domain controllers when shared resources are on the domain controller 1 1 2 2 Finally, migrate the BDCs

9. What Is Different About Restructuring After a Domain Upgrade? User and group accounts are moved together as a closed set Not as flexible as migrating users and group accounts between forests SID-History in a post-upgrade restructure SID-History can still be used to preserve users’ access to resources For SID-History to work properly, move an object from source domain to target domain Destructive operation Restructuring security principals within same Windows Server 2003 forest results in moved, not copied, objects Source domain objects cease to exist Closed sets User accounts and their groups must be moved at the same time ADMT does not calculate a complete closed set

10. How to Migrate Users and Groups Between Windows Server 2003 Domains To migrate users and groups between Windows Server 2003 domains: Open the Group Account Migration Wizard 1 1 Enter the required information 2 2 To verify the migration of users and groups: Review the migration log for errors Verify that the user accounts and global groups exist in the target domain Verify that the user with the migrated user account can access shared resources on the target domain