Windows Forum

Ask something
Discussion Locked

moving user profiles between domains

0 helpful
7 replies

by mkfme 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I'm replacing an NT4 PDC (single domain LAN) with a Win2K server (my first.) I've researched using ADMT to move user accounts and that works well, but even the new version of ADMT apparently only moves user profiles for XP workstations. I'm tryingto determine the best way to move profiles to the new domain from Win2K and NT4 workstations as well. I've ordered a copy of the Win2K Server Resource Kit Supplement One, which has a Moveuser tool that might work from what I can tell. I've also wondered if it could be done somehow by converting everyone to roaming profiles. Is using the Copy feature in User Profiles a feasible option? Please provide a reasonable level of detail for your preferred methodology.

Thanks!

7 replies

by winterfrost

Roaming profiles would not work because once you moved the PCs to the new domain, the SIDs would not be recognized and they would appear as "Unknown" in the User Profiles list, and it will not allow you to "Change Type" back to local. There are better utilities, but I have always done it the "old fashioned" way. I'll split it over a few posts as the "detail" is lengthy:

by winterfrost

- Join WS to new domain.
- Login as user to create a blank profile (e.g. "jdoe.newdomain") and registry entries, then logout. (I find this easiest.)
- Login as administrative user.
- Delete blank profile, rename old profile to new profile name. (e.g. "jdoe" becomes "jdoe.newdomain")
- If on an NTFS partition, change NTFS permissions to remove old domain user and add new domain user. Make sure to *force* permissions down through the tree.
- Open REGEDT32 (regedit will not work on NT or 2k, but will on XP). Choose HKEY_LOCAL_MACHINE hive, and click "Registry -> Load Hive..." from the menu.
- Navigate to the renamed profile folder and load NTUSER.DAT (this is hidden by default).
- Chose the hive you just loaded, click "Security -> Permissions" remove the old user SID and add the new domain user with Full Control. Make sure to *force* the permissions through the whole tree.
- Unload the hive.
- Log out and log in as new domain user with old profile!

Sounds complex, but it is actually quite simple and fast once you do it a few times. Do be careful as there is a risk of overwriting the user's profile if you mess up the permissions.

by winterfrost

Oh, and the "copy" feature also will not work: the profiles show up as "Unknown" and you are unable to copy them in the "User Profiles" list.

One option might be to bring both domains on-line at the same time and create a trust relationship between them. Then it should work, but I have never done it this way. The only time I have done domain/profile migrations of this sort is when rebuilding NT domains to 2k domains on the same hardware.

by mkfme

Thanks for the detailed response - sorry it's taken me a while to get back to you but I got diverted by more urgent matters! It sounds like a good methodology - the only part I don't understand is the first statement "Join WS to new domain." Call me stupid, but what is "WS?" Thanks again for your help - I'll give it a try a soon as circumstances permit.

mfrank@centerofhope.org

This discussion is closed to new replies.