Windows Server

panther3 · Guest

Hi, we are performing a paralell migration from NT domain to new pristine
2003 AD domain (new dc's etc). the plan is to do this gradually site by site
leaving the old NT domain in place is until everthing is migrated. The issue
is we have many global groups in the NT domain. As an example of the issue -
our first site has 30 w2k desktops a windows 2000 member file server and a
windows 2000 member application server in the NT domain. this is one of many
sites and the users at this site would only be members of a few of the total
global groups.

Q1 - Should we migrate ALL the global groups from the NT domain to the new
clean domain before we start the site migrations (will that impact our other
users) - or should we find out what groups are in use at that one site and
just migrate those groups to start with.

Q2 - Bearing in mind the servers are only changing domain from NT to 2003
and no data transfer is involved what is the recommended order for migrating
member servers, users, groups and local desktop profiles at this site?

thanks

Vincent Xu [MSFT] · Guest

Hello,

For your 1st Question: I think you should never mind if you migrate all
user and group to new domain before you migrate 1st site. Because they are
totally different users in different domains.

For your 2nd Question: You may just depart the member server from NT domain
and join the new domain. Or you may treat them as migrating computer
accounts. When you try to migrate a file server, I'd like to recommend you
use a tool named File Server Migration Toolkit (FSMT). More information
about FSMT please refers to following link:

<http://www.microsoft.com/windowsserver2003/upgrading/nt4/tooldocs/msfsc.msp
x>

Hope it helps.

Best regards,

Vincent Xu
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

--------------------
| Thread-Topic: Order of migration
| thread-index: AcWZqBTr4RrAo6yeThCInxjVspcIlQ==
| X-WBNR-Posting-Host: 159.134.94.21
| From: "=?Utf-8?B?cGFudGhlcjM=?=" <panther3@discussions.microsoft.com>
| Subject: Order of migration
| Date: Fri, 5 Aug 2005 03:26:03 -0700
| Lines: 20
| Message-ID: <4C36301D-9504-437D-AF69-602C2D2F0985@microsoft.com>
| MIME-Version: 1.0
| Content-Type: text/plain;
| charset="Utf-8"
| Content-Transfer-Encoding: 7bit
| X-Newsreader: Microsoft CDO for Windows 2000
| Content-Class: urn:content-classes:message
| Importance: normal
| Priority: normal
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
| Newsgroups: microsoft.public.windows.server.migration
| NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
| Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA03.phx.gbl
| Xref: TK2MSFTNGXA01.phx.gbl
microsoft.public.windows.server.migration:11498
| X-Tomcat-NG: microsoft.public.windows.server.migration
|
| Hi, we are performing a paralell migration from NT domain to new pristine
| 2003 AD domain (new dc's etc). the plan is to do this gradually site by
site
| leaving the old NT domain in place is until everthing is migrated. The
issue
| is we have many global groups in the NT domain. As an example of the
issue -
| our first site has 30 w2k desktops a windows 2000 member file server and
a
| windows 2000 member application server in the NT domain. this is one of
many
| sites and the users at this site would only be members of a few of the
total
| global groups.
|
| Q1 - Should we migrate ALL the global groups from the NT domain to the
new
| clean domain before we start the site migrations (will that impact our
other
| users) - or should we find out what groups are in use at that one site
and
| just migrate those groups to start with.
|
| Q2 - Bearing in mind the servers are only changing domain from NT to 2003
| and no data transfer is involved what is the recommended order for
migrating
| member servers, users, groups and local desktop profiles at this site?
|
| thanks
|
|

panther3 · Guest

Vincent, thanks for the reply - there is something regarding permissions that
is still not in my grasp.

Think of a windows 2000 member server, in an NT4 domain, this member server
is a file and print server with many folders controlling access with ntfs
permissions assigned mainly to global groups. If that member server joins the
new AD domain all the acl's on folders will still reference the old domain
users and groups.

When users and groups are migrated across to the new AD domain I understand
you can use sid history to maintain access to original resources - but if the
resources are on the member server as detailed above those resources would
now been in the AD domain and not the orginal domain.

So how do you change the acl's on the member server to reflect the
users/groups in the new AD domain? for example. the member server has a
folder called Accounts and the NT domain is called sand. the accounts-all
global group has certain permissions for this folder and the acl would read
sand\accounts-all. once that server changes membership to the AD domain the
acl on that server would still be sand\accounts-all, how do you change the
acl to reflect the new domain eg: newdomain\accounts-all?

thanks

"Vincent Xu [MSFT]" wrote:

Vincent Xu [MSFT] · Guest

panther3 · Guest

Hi, maybe I didn't explain clearly, we are not migrating our server OS which
seems to be what the fsmt assists in.

The issue we have refers to changing domain membership of our member server
and how to migrate the ntfs permissions on folders to reflect the new domain.

You answered a post from Mark on 1st August - Mark's issue seems to be the
same as ours.

thanks

"Vincent Xu [MSFT]" wrote:

Vincent Xu [MSFT] · Guest

Hi ,

For this situation, you may perform a computer migration via ADMT.

Right click the tool and select computer migration. Then choose files and
folders and then select replace mode.

This may fit you purpose.

Best regards,

Vincent Xu
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

--------------------
| Thread-Topic: Order of migration
| thread-index: AcWcuwGIbNoTa+t9SPy6WORd/pwhaw==
| X-WBNR-Posting-Host: 159.134.94.21
| From: "=?Utf-8?B?cGFudGhlcjM=?=" <panther3@discussions.microsoft.com>
| References: <4C36301D-9504-437D-AF69-602C2D2F0985@microsoft.com>
<PXLhll8mFHA.3120@TK2MSFTNGXA01.phx.gbl>
<CA486152-3E6F-4B40-B096-7BD5B58F556E@microsoft.com>
<yG#8pMLnFHA.940@TK2MSFTNGXA01.phx.gbl>
| Subject: RE: Order of migration
| Date: Tue, 9 Aug 2005 01:19:04 -0700
| Lines: 200
| Message-ID: <53C46D67-862D-4F96-8E1C-450DBCB4EDA8@microsoft.com>
| MIME-Version: 1.0
| Content-Type: text/plain;
| charset="Utf-8"
| Content-Transfer-Encoding: 7bit
| X-Newsreader: Microsoft CDO for Windows 2000
| Content-Class: urn:content-classes:message
| Importance: normal
| Priority: normal
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
| Newsgroups: microsoft.public.windows.server.migration
| NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
| Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA03.phx.gbl
| Xref: TK2MSFTNGXA01.phx.gbl
microsoft.public.windows.server.migration:11549
| X-Tomcat-NG: microsoft.public.windows.server.migration
|
| Hi, maybe I didn't explain clearly, we are not migrating our server OS
which
| seems to be what the fsmt assists in.
|
| The issue we have refers to changing domain membership of our member
server
| and how to migrate the ntfs permissions on folders to reflect the new
domain.
|
| You answered a post from Mark on 1st August - Mark's issue seems to be
the
| same as ours.
|
| thanks
|
|
| "Vincent Xu [MSFT]" wrote:
|
| > Hi ,
| >
| > I think I have answered this question in y last reply.
| >
| > There is a tool named File Server Migration Toolkit(FSMT) can achieve
you
| > goal.Please refer to following link for detailed informatino:
| >
| >
<http://www.microsoft.com/windowsserver2003/upgrading/nt4/tooldocs/msfsc.msp
| > x>
| >
| >
| > Best regards,
| >
| > Vincent Xu
| > Microsoft Online Partner Support
| >
| > Get Secure! - www.microsoft.com/security
| >
| >
| > --------------------
| > | Thread-Topic: Order of migration
| > | thread-index: AcWcGSIUAK2MsNSZRY6RLxd6Ej5onw==
| > | X-WBNR-Posting-Host: 159.134.94.21
| > | From: "=?Utf-8?B?cGFudGhlcjM=?=" <panther3@discussions.microsoft.com>
| > | References: <4C36301D-9504-437D-AF69-602C2D2F0985@microsoft.com>
| > <PXLhll8mFHA.3120@TK2MSFTNGXA01.phx.gbl>
| > | Subject: RE: Order of migration
| > | Date: Mon, 8 Aug 2005 06:00:21 -0700
| > | Lines: 113
| > | Message-ID: <CA486152-3E6F-4B40-B096-7BD5B58F556E@microsoft.com>
| > | MIME-Version: 1.0
| > | Content-Type: text/plain;
| > | charset="Utf-8"
| > | Content-Transfer-Encoding: 7bit
| > | X-Newsreader: Microsoft CDO for Windows 2000
| > | Content-Class: urn:content-classes:message
| > | Importance: normal
| > | Priority: normal
| > | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
| > | Newsgroups: microsoft.public.windows.server.migration
| > | NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
| > | Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA03.phx.gbl
| > | Xref: TK2MSFTNGXA01.phx.gbl
| > microsoft.public.windows.server.migration:11523
| > | X-Tomcat-NG: microsoft.public.windows.server.migration
| > |
| > | Vincent, thanks for the reply - there is something regarding
permissions
| > that
| > | is still not in my grasp.
| > |
| > | Think of a windows 2000 member server, in an NT4 domain, this member
| > server
| > | is a file and print server with many folders controlling access with
ntfs
| > | permissions assigned mainly to global groups. If that member server
joins
| > the
| > | new AD domain all the acl's on folders will still reference the old
| > domain
| > | users and groups.
| > |
| > | When users and groups are migrated across to the new AD domain I
| > understand
| > | you can use sid history to maintain access to original resources -
but if
| > the
| > | resources are on the member server as detailed above those resources
| > would
| > | now been in the AD domain and not the orginal domain.
| > |
| > | So how do you change the acl's on the member server to reflect the
| > | users/groups in the new AD domain? for example. the member server has
a
| > | folder called Accounts and the NT domain is called sand. the
accounts-all
| > | global group has certain permissions for this folder and the acl
would
| > read
| > | sand\accounts-all. once that server changes membership to the AD
domain
| > the
| > | acl on that server would still be sand\accounts-all, how do you
change
| > the
| > | acl to reflect the new domain eg: newdomain\accounts-all?
| > |
| > | thanks
| > |
| > |
| > |
| > |
| > |
| > | "Vincent Xu [MSFT]" wrote:
| > |
| > | > Hello,
| > | >
| > | > For your 1st Question: I think you should never mind if you migrate
all
| > | > user and group to new domain before you migrate 1st site. Because
they
| > are
| > | > totally different users in different domains.
| > | >
| > | > For your 2nd Question: You may just depart the member server from
NT
| > domain
| > | > and join the new domain. Or you may treat them as migrating
computer
| > | > accounts. When you try to migrate a file server, I'd like to
recommend
| > you
| > | > use a tool named File Server Migration Toolkit (FSMT). More
information
| > | > about FSMT please refers to following link:
| > | >
| > | >
| >
<http://www.microsoft.com/windowsserver2003/upgrading/nt4/tooldocs/msfsc.msp
| > | > x>
| > | >
| > | > Hope it helps.
| > | >
| > | > Best regards,
| > | >
| > | > Vincent Xu
| > | > Microsoft Online Partner Support
| > | >
| > | > Get Secure! - www.microsoft.com/security
| > | >
| > | >
| > | > --------------------
| > | > | Thread-Topic: Order of migration
| > | > | thread-index: AcWZqBTr4RrAo6yeThCInxjVspcIlQ==
| > | > | X-WBNR-Posting-Host: 159.134.94.21
| > | > | From: "=?Utf-8?B?cGFudGhlcjM=?="
<panther3@discussions.microsoft.com>
| > | > | Subject: Order of migration
| > | > | Date: Fri, 5 Aug 2005 03:26:03 -0700
| > | > | Lines: 20
| > | > | Message-ID: <4C36301D-9504-437D-AF69-602C2D2F0985@microsoft.com>
| > | > | MIME-Version: 1.0
| > | > | Content-Type: text/plain;
| > | > | charset="Utf-8"
| > | > | Content-Transfer-Encoding: 7bit
| > | > | X-Newsreader: Microsoft CDO for Windows 2000
| > | > | Content-Class: urn:content-classes:message
| > | > | Importance: normal
| > | > | Priority: normal
| > | > | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.0
| > | > | Newsgroups: microsoft.public.windows.server.migration
| > | > | NNTP-Posting-Host: TK2MSFTNGXA03.phx.gbl 10.40.2.250
| > | > | Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGXA03.phx.gbl
| > | > | Xref: TK2MSFTNGXA01.phx.gbl
| > | > microsoft.public.windows.server.migration:11498
| > | > | X-Tomcat-NG: microsoft.public.windows.server.migration
| > | > |
| > | > | Hi, we are performing a paralell migration from NT domain to new
| > pristine
| > | > | 2003 AD domain (new dc's etc). the plan is to do this gradually
site
| > by
| > | > site
| > | > | leaving the old NT domain in place is until everthing is
migrated.
| > The
| > | > issue
| > | > | is we have many global groups in the NT domain. As an example of
the
| > | > issue -
| > | > | our first site has 30 w2k desktops a windows 2000 member file
server
| > and
| > | > a
| > | > | windows 2000 member application server in the NT domain. this is
one
| > of
| > | > many
| > | > | sites and the users at this site would only be members of a few
of
| > the
| > | > total
| > | > | global groups.
| > | > |
| > | > | Q1 - Should we migrate ALL the global groups from the NT domain
to
| > the
| > | > new
| > | > | clean domain before we start the site migrations (will that
impact
| > our
| > | > other
| > | > | users) - or should we find out what groups are in use at that one
| > site
| > | > and
| > | > | just migrate those groups to start with.
| > | > |
| > | > | Q2 - Bearing in mind the servers are only changing domain from NT
to
| > 2003
| > | > | and no data transfer is involved what is the recommended order
for
| > | > migrating
| > | > | member servers, users, groups and local desktop profiles at this
site?
| > | > |
| > | > | thanks
| > | > |
| > | > |
| > | >
| > | >
| > |
| >
| >
|

Dipti · Guest

Just to make sure I understood you clearly, when I am using ADMT to migrate
file serverfrom source domain to target domain, only option in the computer
migration wizard I need to choose is " File and Folders"? All other options
should be unchecked?
--
Dipti

"Vincent Xu [MSFT]" wrote:

Vincent Xu [MSFT] · Guest

Hi,

As I said, you need to treat it as migrate a member server. If you have
share folder on it, you also need to migrate it. As well as user right,
user profile. All depend on your requirments.

Best regards,

Vincent Xu
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

--------------------

	Windows Server Forum Index -> Migration	All times are GMT
Page 1 of 1