How do two domain controllers implement AD migration?

TwoDomain ControllerImplementationADThe migration method is as follows:

Steps for migrating AD user accounts and passwords

Preface

Using MicrosoftActiveDirectoryMigrationTool, You can migrate accounts, such as users, groups, and computers between two independent AD domains. Version 2.0 allows you to migrate user accounts and passwords, this document describes how to migrate an AD user account and password between two independent Win2KAD domains.

Procedure

1. Establish a two-way trust relationship between the target domain and the source domain.

2. Add the system Administrator account of the target domain to the local Administrator group in the source domain controller ).

3. Install the Win2K 128-bit encryption package on the domain controller of the target domain and the source domain. I do not know whether this part is required, but I have installed this encrypted package in actual operations. In addition, according to Microsoft's data, the Win2K standard product already contains 128-bit encryption)

4. Install ADMTVersion2.0 on the domain controller of the target domain.

5. view the properties of the Pre-Windows2000CompatibleAccess group created in the system on the target domain and check whether Everyone is included in the members. If not, you must add Everyone and restart the server. By default, this group already contains Everyone ).

6. Check whether the security policy between the target domain and the source domain affects password migration, such as the password length limit. If yes, make adjustments accordingly.

7. Enter the following command at the command prompt of the domain controller of the target domain to save the Password file: admtkeySourceDomainNameDriveLetter [Password].

Note:

L although this password file can be stored on any disk, including a floppy disk or hard disk, we recommend that you store it on a floppy disk for security reasons.

L if you use the asterisk "*" instead of the password, you will be prompted to enter the password.

L SourceDomainName must be the NetBIOS name of the source domain.

8. We recommend that you select a BDC as the password export server in the source domain.

9、run pwdmig.exe on the password guide server in the source domain, and then select the password file generated in Step 7, such as inserting a floppy disk, in the corresponding prompt. If the password is entered in Step 7, you must also enter the password.

10. Open and modify the Registry on the source domain password export server. under HKEY_LOCAL_MACHINE/System/CurrentControlSet/Control/Lsa, Set

The value of AllowPasswordExport: REG_DWORD is changed from 0 to 1. Then restart the computer.

11. Run ADMTVersion2.0 in the domain controller of the target domain, select the migration user account, select the migration password in the password option, and complete account and password migration as prompted.

We hope that the two domain controllers described in this article will be helpful for you to implement AD migration.

Edit recommendations]