Moving users, groups, and computers between two different domains is a common task for IT professionals, especially during company mergers, acquisitions, or infrastructure upgrades. The Microsoft Active Directory Migration Tool (ADMT) is a standard, free utility designed to help automate this transition. While the process might seem overwhelming at first, breaking it down into manageable steps makes the migration reliable and efficient.
This guide provides a straightforward walkthrough of how to set up and use the tool effectively. By following these clear instructions, you can ensure that your data moves securely from a source domain to a target domain without losing critical permissions or user settings. Whether you are a seasoned administrator or a beginner, this guide will help you navigate the complexities of domain migration.
Understanding the Active Directory Migration Tool
The Active Directory Migration Tool (ADMT) is a free utility provided by Microsoft that allows administrators to move objects between Active Directory domains. It supports migrations within the same forest (intra-forest) or between different forests (inter-forest). The tool is essential because it helps maintain user access to resources like files and printers during the transition.
One of the most significant benefits of using this tool is its ability to migrate security identifiers, known as SIDs. By migrating the SID History, users can still access their old files in the original domain even after their account has been moved to the new one. This prevents downtime and ensures a seamless experience for employees.
Essential Prerequisites for a Successful Migration
Before you begin the migration, you must prepare your environment. Skipping these steps is the most common reason for migration failure. You need to ensure both the source domain (where the objects are currently) and the target domain (where they are going) can communicate effectively.
Establishing Domain Trust
The first requirement is a stable trust relationship between the two domains. For an inter-forest migration, you typically need a two-way forest trust. This allows the target domain to verify the identities of users coming from the source domain. Ensure that DNS resolution is working perfectly between both forests so the domains can find each other.
Setting Up a SQL Server Database
ADMT requires a database to store migration data and logs. You do not need a full, expensive SQL Server license for this; SQL Server Express works perfectly fine. You should install SQL Server on the machine where you plan to run the ADMT software. During installation, make sure the instance is accessible and that you have the necessary permissions to create a database.
Administrative Permissions
To perform a migration, you need high-level permissions. The account you use to run ADMT must be a member of the Domain Admins group in the target domain. Additionally, this account must be added to the Built-in Administrators group in the source domain. This ensures the tool has the authority to read data from the old domain and write it to the new one.
Installing and Configuring ADMT
Once your prerequisites are met, you can install the ADMT software on a server joined to the target domain. It is generally recommended to use a member server rather than a Domain Controller to keep the environment clean. Follow the installation wizard, point it to your SQL Server instance, and complete the setup.
After installation, you will need to configure the Password Export Server (PES). This is a separate service that allows user passwords to be migrated along with their accounts. Without PES, users would be forced to reset their passwords the first time they log into the new domain, which can cause significant frustration.
How to Set Up the Password Export Server
Setting up the PES service is often considered the most technical part of the migration, but it is straightforward if you follow these steps:
- Create an encryption key: On the computer where ADMT is installed, open the command prompt and use the admt key command to generate a .pes file.
- Move the key: Copy this file to a Domain Controller in the source domain.
- Install PES: Run the Password Export Server installer on that source Domain Controller, providing the encryption key when prompted.
- Restart and Start: Restart the source Domain Controller and ensure the “Password Export Server” service is running.
Once this service is active, ADMT will be able to securely transfer passwords, allowing for a much smoother transition for your end-users.
Executing the User Migration
With the infrastructure ready, you can now start the actual migration. It is always best to start with a small pilot group of test users before moving entire departments. Open the ADMT console and select the User Account Migration Wizard.
The wizard will ask you to select the source and target domains and the specific organizational units (OUs). You will have the option to migrate passwords (if PES is set up) and to migrate SID History. Checking the box for SID History is highly recommended to maintain resource access. The tool will also allow you to disable the source accounts after they are moved, ensuring there is no confusion about which account the user should be using.
Migrating Groups and Computers
After users are successfully moved, the next step is migrating groups. It is important to migrate groups before computers so that the security permissions on files and folders remain intact. The Group Account Migration Wizard works very similarly to the user wizard.
Finally, you will migrate the computers. This process involves the ADMT tool reaching out to the client machines and changing their domain membership remotely. This step usually requires a reboot of the client computer. Because this can disrupt work, it is often scheduled for after-hours or over a weekend.
Troubleshooting Common Migration Issues
Even with careful planning, you may encounter obstacles. Most issues stem from network or permission problems. If the migration fails, check the following:
- DNS Issues: Ensure the target server can ping the source domain by its fully qualified domain name (FQDN).
- Firewall Blocks: Active Directory migration requires several ports to be open, including RPC, DNS, and Kerberos ports. Temporarily disabling local firewalls on the servers can help identify if this is the cause.
- Registry Keys: For SID History to work, you may need to enable “AllowRPC” in the registry of the source domain controller.
The ADMT tool provides detailed log files after every migration attempt. These logs are your best friend when something goes wrong, as they pinpoint the exact object or permission that caused the failure.
Finalizing Your Migration
After the migration is complete, monitor the environment for a few days. Ensure that users can log in, access their email, and reach their shared drives. Once you are confident that everything is working correctly, you can begin the process of decommissioning the old source domain.
Using the Active Directory Migration Tool doesn’t have to be a daunting task. By focusing on the prerequisites, setting up the password service correctly, and testing with small groups, you can manage a complex migration with confidence. If you found this guide helpful, explore our other articles on network administration and server management to keep your IT environment running smoothly.