AD Migration

my favorite tools for this kind of work is setacl. If your home directory names correspond to user's active directory accounts, i would dump directory listing to a file and then loop through that file and remove all domain\username and add new domain\username. So this will take care of NTFS permissions, same can be done with share names.

"SetACL.exe -on -ot file -actn ace -ace "n:microsoft\billgates;p:change"

http://setacl.sourceforge.net/

Since you are doing this big migration have you thought about using ABE (access based enumeration). Don't need to create share of user user's home directory, simply share root home directory and set abe on that share. Users will connect to \\CIFS-Server\HOME and the only thing they will see is the folder they have NTFS permissions to. It will make it so much easier for your help desk provision new accounts. Just a thought.

Typically you would start of using SID history but then eventually change the ownerships and ACLs to the new domain.

If you have the many servers it might make sense to invest in a special tool for this.

For example from Quest http://www.quest.com/migration/ or Scriptlogic http://www.scriptlogic.com/products/security-explorer/ or Hyena http://www.systemtools.com/hyena/index.html

Thanks for the feedback, but I need more help.

I'm having issues joining the cifs servers to our new domain after unjoining them from the current domain. I copied a log below. I've verified that the date and time are correct on the datamover.

Also, does anyone know why the domain in Celerra Manager doesn't change to none after I unjoin a cifs server from the domain? Do I have to delete and re-add the server with the new domain for this to change? What happens to the shares hosted on that cifs if I do that?

2009-09-29 17:49:57: SMB: 3: saveAccountPassword: Domain name mistmatch between 'cifs -add' and cifs -J' commands: DS.xxxxxx.COM - DS.xxxxxxx.COM

2009-09-29 17:49:57: SMB: 3: DomainJoin::DJ_setServerPassword: - Failed to update kerberos file for compname=simfs001

2009-09-29 17:49:57: SMB: 3: DomainJoin::reuseAccount Unable to set password for CN=simfs001,OU=emc celerra,OU=Servers,OU=Stock,DC=ds,DC=xxxxxx,DC=com

Message was edited by:
eemjay

One more thing concerning ACLs

server_cifs server_x -Migrate should take care of ACL during the migration right?

Then server_cifs server_x -Replace should be ran before the domain trust is broken?

Thanks!!!!!

For anyone interested in my scenerio ....

Once you unjoin a cifs server from its current domain, delete it from the datamover, recreate under the new domain, and join the new domain .....

All of the share permissions, and folder security for the filesystems on the datamovers pick up the SIDs from the new domain automatically.

In this case the trust is still in place between old and new domains.

Hello eemjay,

Did you need to run the "server_cifs -Replace" command? (after doing the join command to the new domain).

Last week we tried to do a Celerra domain migration (from W2003 to W2008) and we did the same steps that you indicates (unjoin a cifs server from its current domain, delete it from the datamover, recreate under the new domain, and join the new domain) but the SIDs were not updated automatically as you indicate in your environment. We didn't use  -Replace option because we were not sure about this.

About the domains:

- There is a trust between them

- The SID History options is enabled

- The user/groups, etc. were migrated previously between domains (we don't know exactly which tool they implemente to do this)

I think that the procedure is easy but we have the doubt about the replace option (we are not sure about its use).

Thank you very much in advance!!!

ok so i am trying to use the server_cifs server_x -Migrate however i can not get it to work i am missing something i am sure

server_cifs server_2 -Migrate stm_celerra_test -acl xxx.biz:if=test_migrate xxx.biz:if=test_migrate

i get

server_2 :

Error 2213: server_2 : stm_celerra_test : invalid name specified

Is stm_celerra_test a valid file system name ?

Any errors in the data mover log ?

HVR software at https://www.hvr-software.com/solutions/migrations/ is another possible solution.

There's also the Best Practices Guide to Migrations that you can download from http://www.hvr-software.com/resource/extend-timeframe-critical-migrations/ with instructions on how to do a migration.