Windows Forum

Ask something
Discussion Locked

Groups missing after NT to AD upgrade

0 helpful
13 replies

by kevin.square 2 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

after upgrade of NT PDC to W2k3 AD a few of our groups are MOSTLY missing. They do not show up in UserManager or ADUC BUT they are still in there somewhere.

Because, On XP or W2k3svr I can see them if I try to add them to an ACL through add permissions - advanced, find now. Not however on a W2K box.

I also did following test using a directory that listed one of the missing groups in its ACL.

- in NT User Manager I recreated the group with the same name. It did not argue.
- in ADUC the group showed up ok in Users
- back to directory which now showed a SID for a 'deleted' entry.
- added the 'replacement' group back in.

Nothing really common between the missing groups. Lost 2 of 3 that started with I. All the M's and a couple of R's. In between it picked up a K group and a bunch of N's. I know this probably doesn't matter but you never know.

Thanks for any and all suggestions.
Kevin

13 replies

by cg it

how did you upgrade?

Migration is the path for an NT to W2003 server using the ADMT.

by kevin.square

it was done by another group so I can't really answer that. Far as I know they took the existing NT PDC and upgraded it to W2K3. Did they use / need to use ADMT in the process ??

by kevin.square

one addition. on W2K box I can't browse for the 'hidden' group but I can enter it manually in the permissions list and it is accepted.

Kevin

by cg it

Well, You cannt upgrade from NT to W2003 if the initial O/S install was from OEM or retail, you can't. here's a link: http://support.microsoft.com/default.aspx?scid=kb;en-us;823762

In upgrading a NT PDC to W2003, there sometimes are problems like what your seeing.

here's a link to common mistakes made during an upgrade http://support.microsoft.com/default.aspx?scid=kb;en-us;555040

here's a link to other resources on How to upgrade http://support.microsoft.com/default.aspx?scid=kb;en-us;326209

by cg it

well this is an upgrade rather than a migration. The upgrade process should have rearrainged the NT domains [domains created in NT for security and administration] into a Single forest Single domain [first domain would be the root of the forest] Active Directory structure. You may not see all the security groups that you had in NT with Windows 2003 Active Directory because Windows 2003 Active Directory restructures what was in NT into a central directory services [Active Directory]. So if you had 3 domains within a forest for security and administration, those would be restructured into 1 forest 1 domain directory services so some groups would be present while others are merged.

That webcast is a pretty good one to understand what happens in NT when it's upgraded to Windows 2003 Active Directory.

by kevin.square

They had already created an empty root domain and upgraded the first subdomain to AD. We were the second. they have since done the 3rd NT domain without incident. The installers were moving pdc between different machines a couple times. I'm thinking at some point replication did not complete but that would not explain why groups are still 'there enough' to be seen and added but not managed.

by ghemant

Try to restore all the account using SAM Database Offline (copy it offline ) and then restore it using Active Directory it will make your all previous users / groups available.

Regards

by kevin.square

Installers sent a message today saying they were working with 3rd party but had no solution. I said if they haven't contacted MS yet they better.

Also are just now getting around to looking at the suggestion to extract from offline bdc.

by kevin.square

Installer said they used this but only checked to see that groups had migrated. they did not check for all groups.

by kevin.square

I will not forget to rate answers.

I have forwarded info to people who did the install. We do have offline BDC from before change so re-importing the offline SAM is a hopeful option.

What really gives pause is that the groups are in there somewhere but don't show up in mgmt tools - usermanager or ADUC. Supposedly installer also has checked with low level ldap queries and still does not see.

So how is it that they can still be added to a folders permissions by browsing on some OS and by manual entry on others. These machines are pulling up the entries from somewhere.

Kevin

This discussion is closed to new replies.