Best way to migrate AD users from one domain to new one

active-directory

Our company was recently bought out and as such, we are going to be required to join their AD.

Currently, and the way they had recommended is very cumbersome, especially with very large profiles. Especially it requires tremendous time copying/migrating, it has high downtime for the user, and keeps me occupied during this period.

To summarise, this is my current method and I feel there has to be a better way than this.

  • Get their current domain password so it will be identical on new server (file server will still be authenticating on legacy server until completed)
  • Restart PC
  • Login as local admin
  • Unjoin domain/join workgroup/join new domain
  • add user into admin group
  • rename users\default to default_bak
  • clone users profile
  • rename the clone as default
  • in advanced settings delete profile
  • reboot and login as user and wait again
  • revert previous changes
  • remove from admin group
  • reboot

For the most part, this works fine, provided they have the space to hold the profile twice, but if anything, it is very time consuming, copying the profile twice. Is there another way I am not seeing? A script? A tool?

Update/Edited: They will not allow us to have a trust relationship between both domains, I think that may remove ADMT?

Also, I prefer something remote, as while a good portion are local in our physical location, I have several machines that are in several different US states as well as several other countries.

Best Answer

There is absolutely a better way. Using the ADMT, Active Directory Migration Tool, you can handle the transitions in a much more streamlined approach. The domains would need to be setup with a trust and the software run from a server but the basic idea is that the software would be used to copy users/computers/groups/etc from one domain to another. This can include the users' current password (without you having to know it), as well as their SID. The SID can be copied into the destination user object and helps ease the transition for file shares and resource access. As for the computers, the ADMT tool can be used to migrate the computers to the new domain, and associate their existing profile with their new user object on the destination domain.

Related Topic