Migration suites/tools- the players

Microsoft - ADMT 3.0, ADMT 3.1(BETA) - Users, Groups, Profiles, Workstations, Servers. ADMT 3.1 now support Server 2008.

Microsoft - FSMT (File Servers, only currently supported up to Server 2003), Print Migrator (Print Queue/Server Migrations, currently supported up to Server 2003)

Quest Software - DMW and Quest Migration Manager for AD

NetIQ - Domain Migration Administrator

WinZero - Server and Domain Migrator 2007

PointDev - PointDev's IdealMigration is a great product to demo. It includes MMC snap-in functionality, and the free reporting features included in the Demo alone make it worth checking out. Ideal for NT/2000/2003 environments.

PStools - Free, essential tools for all admins

If you haven't heard of the PStools free suite of tools (formerly from SysInternals, now owned by Microsoft), here is a great primer on the suite, and the thinking behind their creation:

The Desktop Files: PStools Primer

ADMT User Migration command-line syntax (and examples)

Technet reference article

Credit to Brent Dorrington for the below examples:

Admt.exe can be used to migrate users from the command-line (if you're sick of the ADMT GUI, or just want to automate/batch/script your migrations):

Appropriate syntax:

ADMT USER /N "user_name1" "user_name2" /SD:"source_domain" /TD:"target_domain" /TO:"target_OU" /MSS:YES

Therefore, if you have a CSV file, with your username in the 1st column, you could run

for /f "tokens=1,2,3* delims=,/ " %%i in (mycsvfile) do ADMT USER /N "%%i" "%%i" /SD:"source_domain" /TD:"target_domain" /TO:"target_OU" /MSS:YES

Note: if you are running from command line, remove the 2nd % in above syntax. The above syntax is fine if you are running in a batch file.

If the 1st column isn't command-line, then just increment %i (i.e. 2nd column would be %%j and so on. You will need to increase the tokens if the username is in column 3 or greater.

Thanks Brent!

ADMT UPN Issue when Merging Objects (zero appended)

Have you run into a strange issue in ADMT where you see a random zero ("0") or one ("1") appended to a UPN after using ADMT to migrate and merge a source object with a target object?

This happens in ADMT where target accounts, after merged with a source account, are randomly getting a zero appended to their UPN. If you fix the UPNs (using ADSIEdit, ADExplorer, or ADModify) and re-migrate the same batch of users, it will happen again, but to a different, random set of users. A workaround is using ADModify to query for (userprincipalname=*0@domain.com) …then reset their upns to samaccountname@domain.com. It’s a pain to run ADModify after every batch of users however, not to mention keeping track of any accounts to exclude (i.e., Student10@domain.com might accidentally get changed to Student1@domain.com).

This question was raised to the ADMT PM for Microsoft, and his comments were:

It happens when:

• there is an existing account in the Target domain with same UPN
• an include file is used to specify SourceName and TargetName values and these values are different

To fix it the best practice is to specify SourceName, TargetRDN, TargetSAM and TargetUPN in Include file.

We will be updating existing documentation to cover this better shortly for ADMT v3.1.

Sample SIDMapping file for ADMT

I've noticed the lack of available documentation around SIDMapping files used by ADMT. While they mention them briefly in the ADMT help file, and even in the MKB, there aren't any actual examples. I was originally stuck on this for a bit since I was used to the format of the normal ADMT include files (sourceName,TargetName,etc header on the first line, THEN the values - comma-delimited - on the subsequent line). Something to note: your SIDMapping file can contain multiple source domain SIDs (in a scenario where you're merging multiple source accounts - I've included examples of this below) that map to a single target domain object. I've seen user objects in AD with their SIDHistory attribute populated with 15-20 values. Anyway, below is a sample SIDMapping file I've used in the past. Notice that you can specity either by SID or by domain\username (in the second case, the domains will need to be reachable in order to resolve the domain\username to its actual Security Identifier).

sample sidmapping.txt file (cut and paste into Word, Notepad, etc to see the ends of lines trailing off the page):


S-1-5-21-1674060341-653213906-1520766640-1984,S-1-5-21-219123761-1972038647-3338400271-28241
S-1-5-21-1674060341-653213906-1520766640-5114,S-1-5-21-219123761-1972038647-3338400271-28241
S-1-5-21-602162358-299502267-839522115-2502,S-1-5-21-219123761-1972038647-3338400271-28241
NTDomain\janedoe,NEWCorp\janedoe1
S-1-5-21-1674060341-653213906-1520766640-2202,S-1-5-21-219123761-1972038647-3338400271-22263
S-1-5-21-1674060341-653213906-1520766640-5100,S-1-5-21-219123761-1972038647-3338400271-22263
XYZCorp\johndoe,NEWCorp\johndoe
NTdomain\jdoe,NEWCorp\johndoe






For more information on Security Identifiers (SIDs):

How to use a SID mapping file with the ADMT tool to perform a resource domain migration to Windows Server 2003
Why Understanding SIDs is Important
How to Associate a User Name with a Security Identifier