Windows Server

Dipti · Guest

I am looking for guidance to migrate local user profile.

After couple of unsuccessful attempt to translate user
profile via security translation wizard, I finally used computer migration
wizard to migrate local user profile. My clients are mostly windows XP with
some windows 2000 pro . After the profile migration when I loged into
target domain with my XP machine, I had an error message " windows can not
load your profile because it may be corrupted. You may be logged in using a
temporary user profile" . Looked into the documents & setting folder. There
are two profile folders -- one with the username.olddomain name, other is the
username.newdomainname. Compared both, desktop icons did not show up in the
username.newdomainname. So it is not a successful profile migration

What is the best way to migrate 500 user profile? At this time I am working
on test environment-- I need to resolve this issue for production domain
migration soon.

Thank you.

--
Dipti

Vincent Xu [MSFT] · Guest

Hi Dipti,

To migrate Local User Account, you need to use Computer Account Migration
Wizard

The detailed steps please refer to :

<http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/DepK
it/78c31b1c-ccdb-4957-bac6-0aa7cd59909e.mspx>

Note: When you perform Computer Selection or Translate Objects in the
article as above, please add computer or translate object one by one. This
methods are tested to work fine.

Hope it helps.

Best regards,

Vincent Xu
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

--------------------

mote · Guest

Where the Computers on the old domain already being used by the accounts in
the new domain?

"Dipti" <Dipti@discussions.microsoft.com> wrote in message
news:828D60D1-72D2-4A79-9E5D-5EF2CB1BF9FF@microsoft.com...

Dipti · Guest

perhaps I used to wroing terminology before. What I wanted to say is profile
used by the domain users is "local profile" not roaming profile. I seems to
have problem with profile migration using security translation wizard, even
though I am logging with domain admin credentails. I will run few more tests
to make sure I am not missing something. I will kepp you posted.
--
Dipti

"Vincent Xu [MSFT]" wrote:

Dipti · Guest

I have retried security translation wizard after migarting some computers and
users but I did not have any luck with this wizard. I am pasting the error
message for your review.

2005-08-24 15:16:52 Created account input file for remote agents: DCTCache.045
2005-08-24 15:16:52 Installing agent on 1 servers
2005-08-24 15:16:52 The Active Directory Migration Tool Agent will be
installed on \\sbmi-xpwrkstn2.testsbmi.local
2005-08-24 15:16:52 ERR2:7625 Unable to connect to
\\sbmi-xpwrkstn2.testsbmi.local\ADMIN$. The machine might be down or its
Server, Netlogon service might not be started. rc=1722 The RPC server is
unavailable.
2005-08-24 15:16:52 ERR2:7014 The Active Directory Migration Tool Agent
Service on \\sbmi-xpwrkstn2.testsbmi.local did not start. See the
application log on \\sbmi-xpwrkstn2.testsbmi.local for details.
2005-08-24 15:16:53 All agents are installed. The dispatcher is finished.

DCTCache :045 input file content:

jray jray user 0 459 475
nray nray user 0 45a 470
test1 test1 group 0 45b 46e
test5 test5 group 0 46b 46f
cbell cbell user 0 46d 476
jpop jpop user 0 46e 477

To test the RPC connection from 2003 DC to remote workstation I ran psexec
and was able to connect to that PC, so RPC connection is working. Netlogon,
RPC services are running on workstation, 2003 DC, 2000DC. Since these are XP
machine, I also made sure firewall is turned off.

I am out of ideas now. I hope MS will look into this issue ASAP.

Thanks.
--
Dipti

"Vincent Xu [MSFT]" wrote:

Dipti · Guest

no. Please review my latest post. I now think problem is with translation
wizard.
--
Dipti

"mote" wrote:

Vincent Xu [MSFT] · Guest

Hi Dipti,

Regarding the error message, I'd like to provide some articles as below:

837366 The Active Directory Migration Tool displays a "RPC server is
http://support.microsoft.com/?id=837366

823735 Active Directory Migration Tool Version 2 Uses the DNS Name to
Resolve
http://support.microsoft.com/?id=823735

Regarding the problem you describe in the first post, I think it is a SID
related issue. Such issue may occur if the SID doesn't match after
migration. You cannot use the Active Directory Migration Tool (ADMT)
version 2.0 to migrate SID History for built-in groups such as the
Administrators group, the Users group, or the Power Users group. This
behavior occurs because the built-in account security IDs (SIDs) are the
same in every domain. Therefore, if you migrate these accounts to a
destination domain, duplicate SIDs exist in the destination domain.

However, while you cannot use ADMT version 2.0 to migrate an SID history
for built-in groups, you can migrate an SID history by using either of the
following
methods:

- Use a third-party tool such as NetIQ.
- Use the Sidhist.vbs Visual Basic script that is included with the
ClonePrincipal
Windows Server 2003 Support Tool.

Hope it helps

Best regards,

Vincent Xu
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

--------------------

Dipti · Guest

Thanks for your reply. Now I know we do need to get that Hotfix described in
837366.
--
Dipti

"Vincent Xu [MSFT]" wrote:

Vincent Xu [MSFT] · Guest

Hi,

I think you mean the hotfix in KB823735,am I right? This hotfix is
included in Windows 2003 SP1.

To obtain Service Pack 1, please visit following link:

<http://www.microsoft.com/windowsserver2003/downloads/servicepacks/sp1/defau
lt.mspx>

Thanks.

Best regards,

Vincent Xu
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

--------------------

Dipti · Guest

Sorry it took me so long to reply. I was on vacation last week.
-yes. you are right. I will download SP1 today.

I have a concern about file server permission issues. I believe I can use
FSMT and/or ADMT computer migration for this purposes. What I am wondering is:

If I want to migrate usetr,computer, user profile in batches over next few
weeks to the new domain ( 2003) and my file servers and exchange servers are
still in old domain (windows 2000), is that going to pose problem for file
permission and e-mail? I am going to migrate user account with SID history.
We have two ways trust set up between the domain.

Dipti

"Vincent Xu [MSFT]" wrote:

Vincent Xu [MSFT] · Guest

Hi Dipti,

From your description, I suspect you have migrate all user accounts and
some clients or member server to the new domain but leave the file server
and exchange server in the old domain.

Please understand in such situation, you need to grant the user account in
new domain some necessary permission in the old domain to make the
available in the old domain. Treat them as 2 different, seperate domain.

Best regards,

Vincent Xu
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

--------------------

Dipti · Guest

What I want to do in my production domain is Migrating account with SID
History (MS deployment guide in chpater 11 page 517 and onward.). I believe I
can migrate users in small group instead of whole company wide (500) user at
one tme. Is there a step by step guide available for migration in small
group. There are so many unresolved issues in my test environment that I
really worry about this production domain migration.

I want to migrate users/computers/profile etc by department. Example, I will
move the people work in IT from 2000 to 2003 domain first, then people in
engineering, project, etc Purpose is to test migration success This will
give us the opportunity to correct any problem arises with migration.

My question is: when I migrate the users from IT department to windows
2003 domain how is the file access/e-mail access will work for these migrated
user. The file server and e-mail server are going to be still in 2000 domain
which we will migrate to 2003 domain after all users are migrated to 2003
domain.

As I mentioned before we have two way trust set up between domain. We are
planning to use FSMT for file server migration. ADMT and Exchange migration
wizard for exchange 2000 server migration.

What is the recommened method for migration? Should I migrate file
server/exchange server before user/computer migration? Active directory
cookbook has a snapshot (figure 2.5) which shows the following order:

global group migration
user migration
idetify service account
migrate workstation/member server ***
migrate local profile
migrate local group
migrate service account
update user right

*** is this where we need to do file server migration and exchange server
migration ?

--
Dipti

"Vincent Xu [MSFT]" wrote: