Migrating users and machines to a new domain

active-directorydesktop-management

Due to an acquisition of several smaller organizations we now have to migrate users and their machines (Windows 2000 & XP Pro) from their old domains (NT & 2000) to a 2003 domain. What are best practices? How best to ensure that locally installed apps do not break?

Are there good tools (free and non-free) available to help? We're looking at about 2500 users and machines.

Here's a twist: all users have had their email (Exchange 2003) set up on their current setup so they have user accounts on the new domain.

Best Answer

IME, the server side is relatively easy. Create new computer and user accounts and set the password to a known value, forcing change on next logon.

The real PITA is the local profile - though we sometimes like to pretend otherwise, users are really attached to their profiles. Just logging in as another user doesn't cut it.

I like ForensiT User Profile Wizard for this. It'll resync the NTFS and Registry permissions to the new SID, and point the new account to the old profile. When users login with their new user account, they're profile will just continue to work. It's scriptable, and can also join a new domain as part of the process.

Since Outlook is already setup under their existing profile, using the same profile should work fine for that.

The only possible oddity is having a user named mbrackett (eg., because of policies dictation first initial, last name) having a %USERPROFILE% of C:\Users\mark (eg., because that was the name of the old account).