August | 2008 | Inderjeet

Hi Everyone,

I am writing the brief step by step procedure to Migrate from Windows 2000 to Windows 2003 Domain in an Intra Forest Topology

Scenario: we have Fabrikam.com (windows 2000 domain) and contoso.com (windows 2003 domain) two forests. Fabrikam.com has 1000 users and groups which needs to be migrated to contoso.com

Source Domain: Fabrikam.com

Target Domain: Contoso.com

note: if you want to keep the same name and for the domain as your current then the easiest way is to make ADC in the same forest and let all the objects migrate to the new domain controller

On contoso.com go to the DNS and add the IP address of Fabrikam.com’s DNS in it’s forwarder
Now, on fabrikam.com go to DNS and add the IP address of Contoso.com’s DNS in it’s forwarder
Test if both ways you can ping and resolve the names
Download the ADMT 3.0 from http://www.microsoft.com/downloads/details.aspx?familyid=6F86937B-533A-466D-A8E8-AFF85AD3D212&displaylang=en
Install the ADMT tool on the target domain. In our case its Contoso.com
Open ADMT console and right click on the left side "Active Directory Migration Tool" and seclect Migrate Groups Wizard
Follow the wizard and select the appropriate groups to be migrated
Once finished check the report if there are any errors
Now, you need to install the Password Export server (PES) on the Source Domain. In our case it’s Fabrikam.com. PES folder is by default created under the installation directory of your ADMT. Default location is <Drive:>/Windows/ADMT
While installing PES you would need to provide .PES file for password encryption
Go to the server on which we installed the ADMT tool
Run CMD
Type ADMT Key /Option:Create /SourceDomain: <Give Source Domain> /KeyFile:<path to store the key File>
Open the <path to store the key File> you created and copy it to the source domain
Now, complete the installation of the Password Export Server on the source domain
Go to Services on the source domain and search for "password Export Server Service"
Stop the service if its started. Open the service properties and go to "Log On" Tab
Click browse and select the target forest and select Administrator or similar privilaged user account
Start the service
Now, go to the target server and open ADMT tool
Right click on the left side "Active Directory Migration Tool" and select Migrate users Wizard
Complete the user migration wizard
Check for any possible errors
Once the user migration is done redo the step 6 and 7 to ensure that Group memberships are fixed
Right click on the left side "Active Directory Migration Tool" and select Computer Migration Wizard
Follow the wizard and select the computer accounts to be moved to the new domain
Once completed ADMT pop-ups a window which let you run the ADMT Agent on machine. Select "Run Pre-check and Agent Operation" and click start
For performing the above step, Add the target Domain’s Administrator account to the Local Administrators group for each of the client machines
Note ** All machines which you are migrating should be turned on at this point in time
Once the machine is restarted automatically, it will be joined to the new domain
Go to the target server and go to "Active directory Domains and Trusts". Break the forest level trust
Demote the source domain from the network

Additional resources

http://support.microsoft.com/kb/326480

http://support.microsoft.com/kb/216498

http://support.microsoft.com/kb/255504

http://www.petri.co.il/transferring_fsmo_roles.htm

Inderjeet

Monthly Archives: August 2008

Talking about Windows Internet Explorer 8: Home page

Forefront ISA Team Blog Wesbite

Migrating Windows 2000 to Windows 2003 Domain – Intra Forest

Microsoft Desktop Share Application