Migrating usergroups, but not with ADMT2

[Jim]

Hai,

I want to copy all NT4 usergroups into a new AD domain.

The tool (from MS) ADMT2 is available, but will only
allow this when the AD domain is native, mine however is
still in mixed mode and needs to remain this for the time
being.

Does anyone know a tool which can copy/migrate all
UserGroups from a NT4 domain to a AD that is in mixed
mode ?

Thanx !

 

[Marin Marinov]

<snip>
In this case it won't be a migration - it will be creating new security
principal in the destination domain which won't have any of the access
the originals had. You cannot preserve the old SID since the sIDHistory
attribute is supported only in native mode. So what you can do is export
all groups to a file ('net group > NTGroups.txt' should do it) and then
import them with 'net group' (and a FOR loop) or a VBScript (check out
www.microsoft.com/technet/scriptcenter). However, first try migrating
the groups with ADMT and *not using* SID History (if you didn't already
do so). I can't see a reason why it won't work but unfortunately I can't
test it right now to give you a definite answer.

Then you can "migrate" the DACLs on your servers using the:
- Security Translation Wizard in ADMT
- Sidwalk.exe
- Microsoft File Server Migration Toolkit
http://www.microsoft.com/windowsserver2003/upgrading/nt4/tooldocs/msfsc.
mspx

HTH
--
Cheers,
Marin Marinov
MCT, MCSE 2003/2000/NT4.0,
MCSE:Security 2003/2000, MCP+I
-
This posting is provided "AS IS" with no warranties, and confers no
rights.

 

[Jim]

Indeed, it would be a copy. i dont want the SID go with
the users and groups...

with the ADMT i dont get as far as being able to say ' no
SID'. In the first Wizard screen it already starts with
telling me i am not native...

But the net group export/import will work as well, thanks
for the effort !

regards