Windows Server

Draiden · Guest

Hello all,

I am looking for some pointers on migrating the information from my current
Win2k servers to my new Win2k3 servers. I'll outline the current setup, the
new (desired) setup, and some issues. Thanks in advance - I am new to
migrating.

Current system:

3 Servers all Win2k Server Edition
1 Print/File/DNS server (machine name: A)
1 Exchange 2000 and IIS server (machine name: B)
1 MS SQL 2000 server (machine name: C)
Domain name on AD: domain.com

New network:

3 Servers all Win2k3 Server Edition
1 Print/File/DNS server (machine name: A)
1 Exchange 2003 and IIS server (machine name: B)
1 MS SQL 2000 server (machine name: C)
Domain name on AD: domain.local

Additional background:

Given the 2 configurations above, I would like to migrate all of my active
directory users, security, objects, etc. from the Win2k server to the new
Win2k3 network. Notice that the domain is different from one network to the
other. However, I have the 2nd network setup by itself currently and the
machine names, as well as IP addresses are the same between both networks. I
figured that this would make for a smoother transition.

Here is what I want to do and need direction for:

- Transition all user accounts, security, settings, files from the old
network (domain.com) to the new network (domain.local).

- Migrate all Exchange 2000 mailboxes, settings, etc. to the new Win2k3
network

- How to re-configure the users' machines (Win2k Pro) to hit the new
network, once in place, so as not to lose their individual configurations,
setup, etc. In other words, I need their profile from the old network login
to stay intact.

Here is what I was trying (and failed at):

Temporarily insert the new file server into the old network, changing the IP
address for the mean time. My hope was to make domain.com and domain.local
talk to each other and use ADMT to pull over settings. I tried to used AD
Domains and Trusts. Unfortunately, the two domains would never see each
other - likely my lack of knowledge at doing this.

Any help in the form of a plan of attack or criticism of my current plan
would be wonderful.

Dray

Draiden · Guest

Thank you Frances,

I appreciate the thorough answer. I am migrating a network with only 25
users. However, there are a lot of security dependencies and rights setup
that I don't want to lose - they would be very hard to re-create from scratch.

I do have a few more questions related to your answers...

- Will the ADMT be able to pull over all of the necessary files and folders
from the source server, along with the security configuration (user personal
folders, sharing restrictions, etc.)?

- If no to above, what is the best way to pull over data files and folders
so as to keep their security settings?

- I will change the IP adddress of the target server temporarily for the
migration, do I also need to change the machine name? Will having the
machine name the same hurt the process. When I connected the two networks
together temporarily last week, I got a message about a duplicate machine
mane existing on the network.

Thanks again!

Dray

"Frances [MSFT]" wrote:

Frances [MSFT] · Guest

Hello Dray,

Good to hear from you.

According to your message, I am not sure how many DC's you have in your
source and target domains. Please give me more details about your domain
configuration. It seems that you use the same IP addresses in the two
networks. Is this correct? I believe this is the main cause that you can
not set up trusts between the source and target domains. Since the same IP
will cause conflicts and confuses the DNS server, DHCP server and so on.

Please configure the target win2k3 domain with different IP addresses and
set up trusts again. You can refer to the following article to create the
trust between win2k and win2k3 domains:

To create a forest trust
http://www.microsoft.com/resources/documentation/WindowsServ/2003/standard/p
roddocs/en-us/Default.asp?url=/resources/documentation/windowsserv/2003/stan
dard/proddocs/en-us/x_createtrust.asp

As for your questions, I would like to answer them as follows:

Q: How to transfer all user accounts, security, settings, files from the
old network (domain.com) to the new network (domain.local)?
A: You can use ADMT to migrate user accounts, security, settings, files
from domain.com to domain.local. ADMT provides an effective tool that
simplifies the process of migrating users, computers, and groups to new
domains.

You can download ADMT from the link below:
Windows 2000 Active Directory Migration Tool
http://www.microsoft.com/windows2000/downloads/tools/admt/default.asp

Active Directory Migration Tool Overview
http://www.microsoft.com/windows2000/techinfo/planning/activedirectory/admt.
asp

Q: How to migrate all Exchange 2000 mailboxes, settings, etc. to the new
Win2k3 Network?
A: Exchange 2000 can not be installed in Win2k3. You need to post the
question in the microsoft.public.exchange.setup newsgroup since they are
the experts in Exchange and will provide the most accurate information on
this issue.

Q: How to re-configure the users' machines (Win2k Pro) to hit the new
network, once in place, so as not to lose their individual configurations,
setup, etc. In other words, I need their profile from the old network
login to stay intact.
A: If you mean the local user profiles, we don't need to manually
re-configure them. You can use ADMT to migrate them. Please tick the "user
profiles" to migrate the local user profiles in the computer migration
wizard.

Please refer to the articles for more information.

Remigrating User Accounts and Workstations in Batches
http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/deploy
guide/en-us/Default.asp?url=/resources/documentation/WindowsServ/2003/all/de
ployguide/en-us/dssbi_reer_zgwe.asp

Translating Local User Profiles
http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/deploy
guide/en-us/Default.asp?url=/resources/documentation/WindowsServ/2003/all/de
ployguide/en-us/dssbg_rent_vgkz.asp

If you have any further questions don't hesitate to get in touch!

Best regards,

Frances He

Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security

=====================================================

When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.

=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

Draiden · Guest

Frances,

A couple more things to add to my previous reply...

I did try changing the IP address before connecting the two networks
together (knowing that they cannot co-exist). However, in the Active
Directory Domains and Trusts tool, I was not able to "see" the source domain
form the target server. I used the Connect to Domain Controller function in
this tool and the domain that I wanted was not listed. I tried entering it
manually, however this did not work either. Either I am doing it wrong or I
am in the wrong tool... any suggestions?

Also, the long link that you provided for creating a trust forest was not
accessible to me. Since it was so long, I cut and pasted it into Explorer -
still no luck. Any other way to locate this document?

Thanks for the patience!

Dray

"Frances [MSFT]" wrote:

Draiden · Guest

Frances:

Last one on this subject, I promise...

If I understand correctly, the ADMT is also used to migrate the user's local
profile on their local computer to the new user account on the new domain.
In this process, we will not need to redo the user's settings (programs,
wallpaper, and the like) on their computers once they are transitioned. Is
this correct?

The reason I ask is that when we change a user from a local account to a
domain account (because they did not have network access), their profile
always seems to need to be re-setup from scratch for them to use their
computer like it was before the transition. It would be nice if we did not
have to do this when making this move.

Thanks,

Dray

"Frances [MSFT]" wrote:

Frances [MSFT] · Guest

Hello Dray,

I am not clear about your meaning of "I have the 2nd network setup by
itself currently and the machine names, as well as IP addresses are the
same between both networks."

Do you mean you name the DC in the win2k3 domain with the same name of the
DC in the win2k domain and with the same IP?

Currently, how many clients are there in your win2k3 domain?

I suggest you use different IP addresses in the win2k3 domain. ADMT is used
to migrate between 2 different domains. So it is alright with two different
networks. Potential problems will occur if you use the same IP.

Please check my answers inline:

Q1. Will the ADMT be able to pull over all of the necessary files and
folders
from the source server, along with the security configuration (user
personal
folders, sharing restrictions, etc.)?
Q2. If no to above, what is the best way to pull over data files and
folders so as to keep their security settings?

A: Yes. ADMT can migrate resources with the security configuration.

There are two scenarios. If you mean the share folders on clients, ADMT can
transfer them during the computer migration. If you mean the file server,
it is recommended to be migrated using FSMT (File Server Migration Toolkit).

ADMT (computer migration wizard)
=================

Resources on clients can be migrated to the target domain in the computer
migration process.

In the "translate objects" tab, you can choose "files and folders",
"shares" and "user profiles" to migrate.

Files and folders
Translates security on files and folders on the computer being migrated.

Shares
Translates security on the shares that exist on the migrated computer.

User profiles
Translates security on the user profiles that exist on the migrated
computer.

In the "security translation options" tab, there are three options related
to ACL references which decide the users' access to the resources in the
domain. They are: Add, Replace and Remove. We recommend using Replace mode.

You can refer to the following article for more information.

Remigrating User Accounts and Workstations in Batches
<http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/deplo
yguide/en-us/Default.asp?url=/resources/documentation/WindowsServ/2003/all/d
eployguide/en-us/dssbi_reer_zgwe.asp>

FSMT
====

If you plan to migrate the file server to the new domain, we recommend you
use FSMT (File Server Migration Toolkit), which helps you copy files and
folders from win2k servers to win2003 server. FSMT is designed to simplify
the process of copying data and minimize the impact of the consolidation or
migration on end users.

More information is offered in the article below.
Microsoft File Server Migration Toolkit
http://www.microsoft.com/windowsserver2003/upgrading/nt4/tooldocs/msfsc.mspx

Q3. I will change the IP address of the target server temporarily for the
migration, do I also need to change the machine name? Will having the
machine name the same hurt the process. When I connected the two networks
together temporarily last week, I got a message about a duplicate machine
mane existing on the network.

A: If the target DC has the same name with the source DC, we cannot create
the trust between them since the trust cannot identify the machines with
the same name.

Do you intend to use the same domain name and the same domain controller's
name? If this is the case, you have two choices.

Choice 1:
=============
Rename destination domain.
Migrate from the source to the destination domain.
Rename back.

Choice 2:
================
Use an interim domain. Set up the domain by installing a win2k3 DC .
Migrate from source to the interim domain.
Migrate from the interim domain to the target domain.

If you don't plan to retain the same domain name in the new win2k3 domain,
you can either rename the DC (use netdom.exe) or demote the DC to a
stand-alone server, rename the computer name and then promote it to be a DC.

Download Step-by-Step Guide to Implementing Domain Rename.doc from the link
below and refer to page 67 "Rename Domain Controllers (Optional)"

http://www.microsoft.com/windowsserver2003/downloads/domainrename.mspx

I am not clear about the migration you mean. A standard migration goes as
follows. We create two-way trusts between the source and the target
domains. Use ADMT wizards to migrate users, groups and resources.

The Recommended Migration Order is listed below for your reference:
1. Trust migration (UI Only)
2. Service account migration
3. Domain Global Group
4. Domain Local Group
5. User migration
6. Computer migration
7. Security translation
8. Report

Q4. In the Active Directory Domains and Trusts tool, I was not able to
"see" the source domain form the target server. I used the Connect to
Domain Controller function in this tool and the domain that I wanted was
not listed. I tried entering it manually; however this did not work either.
Either I am doing it wrong or I am in the wrong tool... any suggestions?

A: After renaming the target DC's name, please refer to the following steps
to create the trust between two domains:
To create a forest trust
1. Open Active Directory Domains and Trusts.
2. In the console tree, right-click the domain node for the forest root
domain, and then click Properties.
3. On the Trust tab, click New Trust, and then click Next.
4. On the Trust Name page, type the DNS name (or NetBIOS name ) of another
forest, and then click Next.
5. On the Trust Type page, click Forest trust, and then click Next.
6. On the Direction of Trust page, do one of the following:
6.1 To create a two-way, forest trust, click Two-way.
Users in this forest and users in the specified forest can access resources
in either forest.
6.2 To create a one-way, incoming forest trust, click One-way:incoming.
Users in the specified forest will not be able to access any resources in
this forest.
6.3 To create a one-way, outgoing forest trust, click One-way:outgoing.
Users in this forest will not be able to access any resources in the
specified forest.
7 Continue to follow the wizard.
Note: You must have certain permissions to create trusts. You must be a
member of the Domain Admins group or the Enterprise Admins group in Active
Directory, or you must have been delegated the appropriate authority.

The information above is from the link below. I have tried the link for you
and it seemed to work properly. Please recheck it to make sure all the
addresses appear in the address box. The link may have breaks which could
be influencing your inability to find the proper website.

To create a forest trust
http://www.microsoft.com/resources/documentation/WindowsServ/2003/standard/p
roddocs/en-us/Default.asp?url=/resources/documentation/windowsserv/2003/stan
dard/proddocs/en-us/x_createtrust.asp

Q5. If I understand correctly, the ADMT is also used to migrate the user's
local profile on their local computer to the new user account on the new
domain. In this process, we will not need to redo the user's settings
(programs, wallpaper, and the like) on their computers once they are
transitioned. Is this correct?

A: Yes, your understanding is correct.

More information can be found in the article below.

Translating Local User Profiles
http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/deploy
guide/en-us/Default.asp?url=/resources/documentation/WindowsServ/2003/all/de
ployguide/en-us/dssbg_rent_vgkz.asp

Hope this helps. If you have any further questions don't hesitate to get in
touch!

Best regards,

Frances He

Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security

=====================================================

When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.

=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

Frances [MSFT] · Guest

Hello Dray,

You are welcome. If there is any update, please let me know!

Best regards,

Frances He

Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security

=====================================================

When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.

=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

Draiden · Guest

Thank you Frances. I will try these suggestions and report back tomorrow.

Dray

"Frances [MSFT]" wrote:

	Windows Server Forum Index -> Migration	All times are GMT
Page 1 of 1